The way I'd in principle want to solve this problem (controlling access to root-level resources that don't support delegation) would be with some kind of "escorted remote access" system, wherein an authorized set of people can remotely log into a special browser session that's able to act as the root user, but only with another authorized party watching and monitoring the session and able to kill it, so that no one can act unilaterally. Unfortunately, I'm presently unaware of any off-the-shelf software that does this; I've been vaguely thinking about doing it as an open source side project.
Ask HN: Best practices for safeguarding master password in organization?
11–20 of 53 posts
Re: Ask HN: Best practices for safeguarding master password in organization?
#12There might be some open source tools that use https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing , which allows you to set a threshold for a number of people in a group with distinct keys that have to coordinate to unlock them. eg 5 shares and 3 of 5 have to combine their keys to unlock.
There is Horcrux https://github.com/jesseduffield/horcrux. One of the projects I've personally had in the back of my head is a completely self contained key system using just a self contained HTML file (so each shard is a static HTML file that can be run to read the other keys using file drag/drop).
Re: Ask HN: Best practices for safeguarding master password in organization?
#13Which password manager are you using? There shouldn’t be any sharing of a master password; each individual should have their own account and own master password.
I think the question is how to handle something like an AWS root password, which doesn't conceptually belong to a single individual and which isn't feasible to entirely eliminate from the system.
I think the answer above still stands.
Put it in a shared vault which can be accessed by however many people require it. They access the shared vault via their own password manager account.
Re: Ask HN: Best practices for safeguarding master password in organization?
#14Use 1password (or similar) so there is no master password?
You can have 2 trusted people be administrators of the 1P account. Then you create a shared vault for anyone who needs access to the master credentials and store them all in said shared vault. You can have multiple vaults with multiple different sets of credentials and access (Ex a vault for HR is going to have different creds and people than a vault for DevOps). Note: The list of administrators and the list of people with access to the shared vault doesn't need to be the same people.
If someone who's in the trust circle quits or gets fired, you have someone else remove their access (just like any other offboarding) and go change the applicable credentials.
As for insider threat, there isn't a lot you can do if you give someone access to the credentials. For the admin, that should be easy - certainly, you can find 2 people in an organization who can be trusted implicitly (even if one of them is required to be the CEO/founder). If you're worried that someone is going to go rogue, then don't give them access to the information in the first place.
There is some stuff that just doesn't need to be broadly shared...lets say master passwords for AWS accounts. Really very very very few people will ever need those - mostly for "Break glass in case of emergency" purposes, right? So your Director of DevOps has access and maybe one other person. If you can't trust that Director of DevOps to have those credentials.... well honestly your organization has bigger issues.
Re: Ask HN: Best practices for safeguarding master password in organization?
#15Which password manager are you using? There shouldn’t be any sharing of a master password; each individual should have their own account and own master password.
I think the question is how to handle something like an AWS root password, which doesn't conceptually belong to a single individual and which isn't feasible to entirely eliminate from the system.
With advanced/power user AWS IAM roles, it's feasible to eliminate it for day to day uses, meaning that you can have it so only one or two people you trust actually have access to the root creds, and everyone else can go about their business.
Shamir's Secret Sharing software, ssss, will let you encrypt a file and split it into pieces so that 3 of 5 people are needed to decrypt.
Re: Ask HN: Best practices for safeguarding master password in organization?
#16Others have already mentioned that you shouldn't be sharing a master password, and that's definitely true. I'll try to answer the question more holistically: RE: Sharing. Nobody should be sharing a password manager account. If this is happening it usually means somebody doesn't want to pay for the seats to have individual accounts. You give each user their own account, and if you need more than one admin, you have mo…
Re: root account password in a password manager vault. The problem with this from an enterprise-security perspective is that, once the password has been shared with somebody, it's difficult to prevent them from later using it in a way that's not authorized, or accidentally disclosing it to someone who shouldn't have it (e.g., by having their machine compromised). I suppose that a TOTP secret or FIDO/U2F dongle doesn't necessarily have this problem, though, so you could maybe rely on that rather than the password as the primary security factor.
Re: Ask HN: Best practices for safeguarding master password in organization?
#17> but ultimately doesn't there have to be someone who solely controls the changing and sharing of the password, and granting privileges? Not necessarily. You can set up things so that that requires two persons ( https://en.wikipedia.org/wiki/Two-man_rule ), or any 3 out of a group of 5, etc ( https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing )
More specifically, http://point-at-infinity.org/ssss/
Re: Ask HN: Best practices for safeguarding master password in organization?
#18Others have already mentioned that you shouldn't be sharing a master password, and that's definitely true. I'll try to answer the question more holistically: RE: Sharing. Nobody should be sharing a password manager account. If this is happening it usually means somebody doesn't want to pay for the seats to have individual accounts. You give each user their own account, and if you need more than one admin, you have mo…
Even without SSO, a bitwarden team subscription let's you administratively revoke organization access at negligible business cost.
Note that revocation is insufficient to protect current passwords: The user may have made a copy. For that you need password rotation and second factors like a hardware token.
Regardless, shared credentials should be reserved for when there no other solution is technically possible. At the very least when shared credentials cannot be avoided, try to split it into multiple domains - read-only vs "production open heart surgery", devs vs prod admins, automation vs humans, etc. For automation, always make new tokens for each use - and never store them, as you can always make more. Consider only issuing credentials to people upon request, and revoking them after the fact. There are many mechanisms to reduce risk.
Re: Ask HN: Best practices for safeguarding master password in organization?
#19> And what if that person gets fired or decides to become a malevolent actor Some of that is covered from a legal angle; they might be able to technically pull it off, but they'd also go to jail for doing so
Possibly putting the actor in jail and having them go bankrupt over damages does not help the company recoup their losses.
Even if that's true, it still serves as a deterrent.
Re: Ask HN: Best practices for safeguarding master password in organization?
#20Others have already mentioned that you shouldn't be sharing a master password, and that's definitely true. I'll try to answer the question more holistically: RE: Sharing. Nobody should be sharing a password manager account. If this is happening it usually means somebody doesn't want to pay for the seats to have individual accounts. You give each user their own account, and if you need more than one admin, you have mo…
Re: root account password in a password manager vault. The problem with this from an enterprise-security perspective is that, once the password has been shared with somebody, it's difficult to prevent them from later using it in a way that's not authorized, or accidentally disclosing it to someone who shouldn't have it (e.g., by having their machine compromised). I suppose that a TOTP secret or FIDO/U2F dongle doesn'…
If you're not using an MFA mechanism attached to your SSO (Google Authenticator or Okta or something) then that's a completely separate issue. There shouldn't be that much risk in letting all of your SRE's have access to the root credentials; you can lock down who can see what in your vault based on roles for any PW manager worth anything.
You could also rotate the root password every time there's a departure from the teams that have visiblity if it's that big of a deal.