[dead]
Ask HN: How to store and share passwords in a company?
71–80 of 297 posts
Re: Ask HN: How to store and share passwords in a company?
#72LastPass, Keeper, or 1Password. This is a fully solved problem you don't need to ask SO about.
Re: Ask HN: How to store and share passwords in a company?
#73I can only say that using pass (https://www.passwordstore.org/) is an absolute nightmare, in case anyone else is considering that
It seems like perfect simplicity built on time-tested cryptography: store pgp-encrypted files in a git repository. We already had an internal git server and used PGP internally, it was the perfect marriage. The tool provides the common functions like selecting which colleagues to encrypt for, finding an entry and copying it to clipboard... but think of the moment your organization changes. Everyone has access to everything offline, which is great if you need it in a rainforest or when the server is down, but also you'd need to rotate all exposed-to-them entries whenever someone leaves. Re-encrypting everything to remove an old key is pointless because the git history will provide an attacker with whatever version they need.
Offline access is useful for selected credentials (like the disk unlock password for some central servers) but, to avoid unnecessary rotations, should not be the default unless you're a sysadmin mentioned on disaster recovery team
Skimming the recommendations, so far there are no tools mentioned that don't require maintaining another service or that can't read your data. At least pass had that going for it
Re: Ask HN: How to store and share passwords in a company?
#74https://keepass.info and share the database file on a shared folder or sync it somehow.
Re: Ask HN: How to store and share passwords in a company?
#75LastPass, Keeper, or 1Password. This is a fully solved problem you don't need to ask SO about.
I'd avoid LastPass. The UI is awful, and they've been breached before: https://krebsonsecurity.com/2023/09/experts-fear-crooks-are-...
Re: Ask HN: How to store and share passwords in a company?
#76We always used 1Password[0]. We still use it in the open-source projects that I work with.
I have heard that LastPass is about as good, but have no experience using it.
The latest version of 1Password isn't so good, but it works fine.
Re: Ask HN: How to store and share passwords in a company?
#77KeePassX file in a repo with long password is a reasonably good solution. Not perfect, but open source and you can segregate by user/team. Also in a team there can be 1 person who has write/update duties and updates the passwords if there a shared ones (not the best approach). BTW, not related to the passwords is to put everything non-public serving behind a firewall and access it only via individual VPN keys.
Don't put in a place where history is saved (as in, don't put it in a repo, put on a shared disk). Also, make sure to rotate the key when people change.
> Don't put in a place where history is saved
What risks & attack vectors do you have in mind here? Also, in how far is this an issue with KeePass (whose files are encrypted)?
Re: Ask HN: How to store and share passwords in a company?
#78If you're sharing lots of passwords you are really messing things up. Rethink your approach.
Re: Ask HN: How to store and share passwords in a company?
#79I can only say that using pass ( https://www.passwordstore.org/ ) is an absolute nightmare, in case anyone else is considering that It seems like perfect simplicity built on time-tested cryptography: store pgp-encrypted files in a git repository. We already had an internal git server and used PGP internally, it was the perfect marriage. The tool provides the common functions like selecting which colleagues to encrypt…
In that sense pass is no different from other password managers. What prevents the user of an "online" password manager from storing the passwords offline, remembering them, or not logging out and reusing cookies? You have to rotate the credentials themselves anyway.
Re: Ask HN: How to store and share passwords in a company?
#80This is a great question IMO. For those saying "just don't share passwords", consider that many of the vendor accounts you might need to use in business don't have team accounts, and there is no option but to share accounts. It's a legitimate thing that comes up rather often.