How do you manage passwords for shared services in your team(s)?
Ask HN: How do you manage passwords in teams?
1–10 of 69 posts
Re: Ask HN: How do you manage passwords in teams?
#2All three of us know it - i guess it depends on levels of trust.
Re: Ask HN: How do you manage passwords in teams?
#3I'v used a shared dropbox folder with a KeePassX instance in it with a shared password for that container. If needed we could just change the password on the KeePassX container and/or remove the access to dropbox.
Re: Ask HN: How do you manage passwords in teams?
#4you don't - you use an directory (LDAP, Active Directory) or AAA service (RADIUS,TACACS+) to manage that. There should never be a shared password. If it is a cloud shared service, same rules apply. You have to know who did what when, and with a shared PW you cannot. Even if all people have the same privileges, you gotta know who did what.
Re: Ask HN: How do you manage passwords in teams?
#5my smaller clients use keepass or https://lastpass.com/
Re: Ask HN: How do you manage passwords in teams?
#6I'v used a shared dropbox folder with a KeePassX instance in it with a shared password for that container. If needed we could just change the password on the KeePassX container and/or remove the access to dropbox.
Neither of those stop someone who saved a copy of the keepass db outside of dropbox. You'd also have to change every password contained in keypass.
Re: Ask HN: How do you manage passwords in teams?
#7We use Meldium[1] with Google Apps login to manage our passwords.
[1]: https://meldium.com/
Re: Ask HN: How do you manage passwords in teams?
#8With my last client we used to have a spreadsheet on Google Docs. Not at all secure but people weren't putting bank passwords in that either. More like test logins to various WP sites we had and stuff.
Re: Ask HN: How do you manage passwords in teams?
#9you don't - you use an directory (LDAP, Active Directory) or AAA service (RADIUS,TACACS+) to manage that. There should never be a shared password. If it is a cloud shared service, same rules apply. You have to know who did what when, and with a shared PW you cannot. Even if all people have the same privileges, you gotta know who did what.
This is fine for things your organization controls. It isn't possible when dealing with lots of outsourced services. Too few services provide a way to hook into your LDAP or Active Directory.
Re: Ask HN: How do you manage passwords in teams?
#10We are using LastPass for credentials to external services (e.g., Amazon Web Services, Twilio, Tropo). It has the advantage that all encryption/decryption happens on the client, so passwords are not stored in cleartext on LastPass's servers.