61–70 of 297 posts
On the other end, I'll chip in on https://onetimesecret.com/ for quickly sharing a secret. It will only allow the consumer to view the secret once, after that, the secret is no longer available. You can also set up One Time Secret with your company domain (self-hosted, I presume)
Just want to say that StackExchange is the place to get answers for questions like this (waiting for my downvotes). Is there a better place?
I think stack exchange would delete the question because it is too vague and open to opinion.
Folks are going to have strong opinions here about things, so I'll try to stick to my personal experience. I adopted 1Password at my current organization. Overall, I've been very satisfied with it. Here are the major points I've noticed: * Great authenticator support. We have some accounts that our team members have to share, and we want MFA on those accounts. I can add an MFA field to 1Password entry and the people…
inserting some line breaks...
* Great authenticator support. We have some accounts that our team members have to share, and we want MFA on those accounts. I can add an MFA field to 1Password entry and the people who have access to that entry can use it. Doesn't help when those entries require phone/e-mail based MFA; I'm working on a little Twilio / outlook group setup to take care of that.
* Easy to navigate group membership. Passwords are stored in vaults and individuals or groups can be given access to those vaults. The model for it fits in my head and I like that.
* Easy share ability. There are a few credentials that I occasionally need to share outside of a vault. I can create a link and grant access to specific individuals for a given amount of time.
* The browser extension and integration have been really smooth in my opinion.
* I find tagging and taxonomies of tags to be helpful, and 1Password supports those well.
* We've gotten some great mileage out of 1Password connect. Some of our infrastructure secrets now reside directly in 1Password, and 1PW connect pushes them into our k8s environment as secrets where our apps can refer to them. Makes secret management across environments that much easier.
* SCIM support (which I haven't yet implemented) and SSO support to bring more convenience for end-users.
* Easy ability to recover if an employee forgets their master PW (have done this a handful of times).
* A nice perk: our 1PW business comes with a free 1PW personal subscription for people, completely separate. If the employee leaves they have can convert their personal vault to a paid subscription or export it.
Folks are going to have strong opinions here about things, so I'll try to stick to my personal experience. I adopted 1Password at my current organization. Overall, I've been very satisfied with it. Here are the major points I've noticed: * Great authenticator support. We have some accounts that our team members have to share, and we want MFA on those accounts. I can add an MFA field to 1Password entry and the people…
So the server can read all data or how does this work?
Earlier quoted context omitted.
I think stack exchange would delete the question because it is too vague and open to opinion.
And (except on a specific site within their network), product recommendations are OT.
I work for a financial, we take security seriously. Production secrets like passwords, private keys etc are stored in Hashicorp Vault. They aren't stored on disk anywhere else. Privileged system account that runs the production processes can't be used by interactive users. SREs can get access if they have to but its locked down and every session is recorded. The secrets are rotated regularly. So your new hire never g…
For robotic accounts, cloud providers usually even come with a vault solution (Azure keyvault, etc.) that is audited. Those vaults can be integrated in kube/openshift and seen as secrets directly by applications.
For human users, SSO is a must, otherwise a password manager that also gets audited.
PCI-DSS audit would require this kind of things.
- A secrets manager (e.g. AWS Secrets manager) with an API key for each team, and the team can access their secrets on a team level there
- An encrypted file encrypted with e.g. KeePass, and one password for that
- Bitwarden or Lastpass on a team or department level (yes, shared passwords, for example where there is one password for one proxy)
- Yopass https://yopass.se/
Earlier quoted context omitted.
I think stack exchange would delete the question because it is too vague and open to opinion.
true, ask chatgpt to reword this post to be appropriate for stackexchange first. i cant think of a way to ask this and chatgpt failed also. maybe there is a link to a duplicate answered q there
When I see how people decide to use this tool, I really wonder if (the current state of the art at least) really is a tool for the good or if it needs big watermarks so it can be rejected when you try to propagate/submit the contents somewhere and it becomes only usable for the things it's good at like summarizing short texts to tweet size or helping with language learning or such
> We tend to have zillions of passwords in IT jobs right? Yes, but they should be unique to your account. I.e. via SSO. > What are the recommended ways to store and give access to passwords? Whenever possible, don't. Otherwise, it depends on the scale and security you need. A password manager is one possible solution. Another solution is something like Hashicorp's Vault or OpenBao. > How can a new hire be given acces…
SSO all the way (if you can). Chances are you've got Google Workspace or Microsoft 365 - both allow you to configure SAML based SSO into many SaaS apps either through their respective app galleries or some kind of custom configuration. Otherwise you could look at Okta, but be prepared to fork out serious cash. We use Entra ID (part of Microsoft 365) for SSO in our business, and it generally works well. There'll be ti…
They have had multiple serious breaches and to add insult to injury they have engaged in some gaslighting-esque style marketing to inquiries.
I've built security programs at 3 companies. This is how I would solve these problems. 1. SSO everywhere. Okta if budget is no concern and Keycloak if it is. 2. Password manager for the entire company. Even if it's possible to go SSO everywhere, there are still secrets employees will need to manage. Give them a solution or they'll solve it on their own and not in a good way. I like 1Password. 3. All services use a se…
About 1, unless you have a dev team and dedicated time to make compatibility layers, you're more or less limited to whatever application and saas supports your sso of choice though, correct ?
Although I’m not sure why you’d go with a 3rd party idp rather than just using Google Workspace (or Microsoft equivalent).