Live data from Hacker News

Ask HN: How to store and share passwords in a company?

news.ycombinator.com

1–10 of 297 posts

Ask HN: How to store and share passwords in a company?

#1
We tend to have zillions of passwords in IT jobs right?

What are the recommended ways to store and give access to passwords?

How can a new hire be given access to all required passwords day 1?

And when such new hire gets promoted, how can we give access to the additional passwords they will need?

And if someone leaves the company, how can we change only the sensible passwords they had access to and preferably notify everyone with access to it that it was changed?

Any best practices? Any 80/20 suggestions? Low hanging fruits? Any warnings about what not to do?

Re: Ask HN: How to store and share passwords in a company?

#2
1. Don't have passwords. This is why there's an "SSO tax". If you setup SSO then there will be less passwords / accounts.

2. Use a password manager that enables sharing. There are 1s with company accounts and different ways to share. A new hire can pick up a certain role/group and get all the passwords.

Re: Ask HN: How to store and share passwords in a company?

#3
post #2

1. Don't have passwords. This is why there's an "SSO tax". If you setup SSO then there will be less passwords / accounts. 2. Use a password manager that enables sharing. There are 1s with company accounts and different ways to share. A new hire can pick up a certain role/group and get all the passwords.

And #2 is only to be used if absolutely unavoidable and even then, I would think hard about alternatives such as ditching the service that would require using that solution.

Re: Ask HN: How to store and share passwords in a company?

#9
post #3
post #2

1. Don't have passwords. This is why there's an "SSO tax". If you setup SSO then there will be less passwords / accounts. 2. Use a password manager that enables sharing. There are 1s with company accounts and different ways to share. A new hire can pick up a certain role/group and get all the passwords.

And #2 is only to be used if absolutely unavoidable and even then, I would think hard about alternatives such as ditching the service that would require using that solution.

[flagged]

Re: Ask HN: How to store and share passwords in a company?

#10
Lots of people suggest 1Password, and it works really well for larger or more disperse groups needing some shared vault capability, and perhaps those that want a more visual-driven web interface. Keep in mind there is the per-seat pricing for that.

What has also worked really well in the past for me and my teams, especially if they are more technical and these credentials really never need to go beyond this more technical team is setting up a single 'vault' encrypted with GPG. Each team member then gets the vault re-encrypted for them, adding them to the recipient list. While this takes a little bit of effort to get a workflow going, it keeps it out of a cloud service, if you're concerned about that, and you get to pass it around just like any other file. When someone leaves, or no longer needs access, their recipient is removed and then the file recommitted and redistributed. In the past I've had the ASCII-armored file committed in git and people just pull down a tools repo every so often.

If you are wanting to store credentials for, say, public cloud services, don't. Use roles as much as possible, don't pass around passwords, don't bother setting up individual users beyond those required to bind a role to it, grant only by roles as much as possible.

Post reply on HN