To add on with another question, are there systems (like password managers, or others) which have "double password" as a first-class feature? For instance, a hacky way could be if personA knows passwordA only, and personB knows passwordB, and the literal password for a system is the concatenation "passwordA + passwordB" - you could get that if both people sat at the same keyboard (or did something else annoying), but a password manager for instance would need first-class support for that feature to be able to have the two individuals launch a shared session to enter both passwords. Or I would even love a system where if at least 2 out of 3 people entered their passwords it launched a shared session: no one single point of failure either for compromising a person or for that person getting hit by a bus.
Ask HN: Best practices for safeguarding master password in organization?
21–30 of 53 posts
Re: Ask HN: Best practices for safeguarding master password in organization?
#22> And what if that person gets fired or decides to become a malevolent actor Some of that is covered from a legal angle; they might be able to technically pull it off, but they'd also go to jail for doing so
I couldn't find it just now, but there was at least one case, where the admin did throw away the all keys when he left the company. Sometimes strange things can happen if you start having personal trouble, like the boss slept with admins wife ...
Re: Ask HN: Best practices for safeguarding master password in organization?
#23You give a few people at the top the master password. Typically it would be a director, a VP, maybe a CTO or CIO, in addition to whatever "low level grunt" has to actually carry out actions using the passwords.
For larger companies, you'd use CyberArk, so you can grant roles, get audit logs, use a HSM, etc.
Re: Ask HN: Best practices for safeguarding master password in organization?
#24Having one password that unlocks all the other passwords means one password hack lays everything bare.
Re: Ask HN: Best practices for safeguarding master password in organization?
#25There might be some open source tools that use https://en.wikipedia.org/wiki/Shamir%27s_secret_sharing , which allows you to set a threshold for a number of people in a group with distinct keys that have to coordinate to unlock them. eg 5 shares and 3 of 5 have to combine their keys to unlock.
There is Horcrux https://github.com/jesseduffield/horcrux . One of the projects I've personally had in the back of my head is a completely self contained key system using just a self contained HTML file (so each shard is a static HTML file that can be run to read the other keys using file drag/drop).
Something like [0] maybe?
Re: Ask HN: Best practices for safeguarding master password in organization?
#26Earlier quoted context omitted.
I think the question is how to handle something like an AWS root password, which doesn't conceptually belong to a single individual and which isn't feasible to entirely eliminate from the system.
With advanced/power user AWS IAM roles, it's feasible to eliminate it for day to day uses, meaning that you can have it so only one or two people you trust actually have access to the root creds, and everyone else can go about their business. Shamir's Secret Sharing software, ssss, will let you encrypt a file and split it into pieces so that 3 of 5 people are needed to decrypt. http://point-at-infinity.org/ssss/
Either the site really doesn't support https (odd, since it is the very page that supplies the verification hashes!) or something more scary is actually happening and it's getting universally man-in-the-middled, which feels plausible for a site that offers cryptographic tools for download.
Re: Ask HN: Best practices for safeguarding master password in organization?
#27Use 1password (or similar) so there is no master password? You can have 2 trusted people be administrators of the 1P account. Then you create a shared vault for anyone who needs access to the master credentials and store them all in said shared vault. You can have multiple vaults with multiple different sets of credentials and access (Ex a vault for HR is going to have different creds and people than a vault for DevO…
Why would you suggest 1password on any other shitty proprietary crap. Use Bitwarden, its Open Source you can self host it inside the company if you want ... and if they every do something (shady) you do not like you can switch to a fork that will instantly pop up as soon as that happens.
Re: Ask HN: Best practices for safeguarding master password in organization?
#28The way I'd in principle want to solve this problem (controlling access to root-level resources that don't support delegation) would be with some kind of "escorted remote access" system, wherein an authorized set of people can remotely log into a special browser session that's able to act as the root user, but only with another authorized party watching and monitoring the session and able to kill it, so that no one c…
I've been thinking of a similar project but over SSH rather than a browser based thing.
Re: Ask HN: Best practices for safeguarding master password in organization?
#29Use 1password (or similar) so there is no master password? You can have 2 trusted people be administrators of the 1P account. Then you create a shared vault for anyone who needs access to the master credentials and store them all in said shared vault. You can have multiple vaults with multiple different sets of credentials and access (Ex a vault for HR is going to have different creds and people than a vault for DevO…
Why would you suggest 1password on any other shitty proprietary crap. Use Bitwarden, its Open Source you can self host it inside the company if you want ... and if they every do something (shady) you do not like you can switch to a fork that will instantly pop up as soon as that happens.
Can we please keep these low-effort flames off of Hacker News? 1password is clearly offering value to somebody, as they have millions of users. Feel free to criticize it, but at least give specifics.
Re: Ask HN: Best practices for safeguarding master password in organization?
#30Use 1password (or similar) so there is no master password? You can have 2 trusted people be administrators of the 1P account. Then you create a shared vault for anyone who needs access to the master credentials and store them all in said shared vault. You can have multiple vaults with multiple different sets of credentials and access (Ex a vault for HR is going to have different creds and people than a vault for DevO…
> Use 1password (or similar) so there is no master password?
Isn't there still a "Secret Key" that you have to keep somewhere? It's a long random string, too, so you can't easily memorize it. I always lose this and have to keep it somewhere super-unsafe... it's the weakest part of my security, ironically.