honestly wonder if this is a 1pass ad thinly veiled as a question on the hn front page? if you have to ask, you shouldnt be doing it - hire or at least consult an IT professional
Ask HN: How to store and share passwords in a company?
21–30 of 297 posts
Re: Ask HN: How to store and share passwords in a company?
#22I'd strongly advise against 1Password, several answers here recommending it and I suspect conflating personal use with 'good enough for business', hard disagree.
Your company can apply various aspects of threat modelling and more often than not several companies I've worked with find that Bitwarden self-hosted can meet a lot of requirements, this is the best solution in terms of privacy and security and controlling your trust boundaries. Failing that, Bitwarden Enterprise (they host) is also just as good. In either case there's granular controls for controlling what your new hires can be given access to.
There won't be a perfect solution such as notifying everyone about rotation, it's not needed though - simply rotate it and the next time they need it they get the new version.
Of course the general advice is something I agree with - use SSO where possible, but I fully recognise that it isn't always possible with some third party services that haven't implemented it yet.
There is a cruder solution I've often seen too, it's a bit painful but KeePass2/KeePassXC on a company hosted SAN is the ultimate offline, fully controlled solution but comes with extra hurdles to access, whereas Bitwarden is browser based and simpler to use.
Re: Ask HN: How to store and share passwords in a company?
#23I work for a financial, we take security seriously. Production secrets like passwords, private keys etc are stored in Hashicorp Vault. They aren't stored on disk anywhere else. Privileged system account that runs the production processes can't be used by interactive users. SREs can get access if they have to but its locked down and every session is recorded. The secrets are rotated regularly. So your new hire never gets to see production passwords effective.
For developers, everything is done in their individual accounts, no system accounts. There is a dev system account that does leak out some times but this is frowned upon. Production data that is synced to dev environments have to be scrambled so devs dont get to see all the real prod data.
Re: Ask HN: How to store and share passwords in a company?
#24I'd strongly advise against 1Password, several answers here recommending it and I suspect conflating personal use with 'good enough for business', hard disagree. Your company can apply various aspects of threat modelling and more often than not several companies I've worked with find that Bitwarden self-hosted can meet a lot of requirements, this is the best solution in terms of privacy and security and controlling y…
Why do you disagree 1password is good enough for business?
Re: Ask HN: How to store and share passwords in a company?
#25I'd strongly advise against 1Password, several answers here recommending it and I suspect conflating personal use with 'good enough for business', hard disagree. Your company can apply various aspects of threat modelling and more often than not several companies I've worked with find that Bitwarden self-hosted can meet a lot of requirements, this is the best solution in terms of privacy and security and controlling y…
We use Bitwarden as well. It seems to offer the sort of fine grained controls that let the right people have access to the right secrets.
Re: Ask HN: How to store and share passwords in a company?
#26I'd strongly advise against 1Password, several answers here recommending it and I suspect conflating personal use with 'good enough for business', hard disagree. Your company can apply various aspects of threat modelling and more often than not several companies I've worked with find that Bitwarden self-hosted can meet a lot of requirements, this is the best solution in terms of privacy and security and controlling y…
We used 1Password at a ~6,000 employee tech company and it was fine. Never had any issues with 1Password.
Re: Ask HN: How to store and share passwords in a company?
#27While building Adaptive (https://adaptive.live), I have been working very closely with regulated industries, financial institutions, healthcare orgs. Traditionally, people have been using Cyberark to do Identity management, paired with Privilege access management.
There are some modern Privileged Access Management platforms like Strongdm, teleport, us (https://adaptive.live) and few more in the market that works well with cloud and modern application architectures.
There is debate in the industry whether access should be given or not. There is pros and cons for either of them. This purely depends on the culture of the org in my opinion. But in scenario, you really have to give access, it should have the least privilege as well it should be time bound. Also, all the operations should be audited and recorded.
I believe you should have zero standing access in the org, but there are always use cases like data repair and administration where you have to give access to users. In that scenario, the access should be limit, time bound and audited. Also, you have to make sure you run access review campaigns and checks for over privileged or unused users.
Re: Ask HN: How to store and share passwords in a company?
#28Just want to say that StackExchange is the place to get answers for questions like this (waiting for my downvotes). Is there a better place?
Re: Ask HN: How to store and share passwords in a company?
#29Just want to say that StackExchange is the place to get answers for questions like this (waiting for my downvotes). Is there a better place?
I think stack exchange would delete the question because it is too vague and open to opinion.
Re: Ask HN: How to store and share passwords in a company?
#30> We tend to have zillions of passwords in IT jobs right?
Yes, but they should be unique to your account. I.e. via SSO.
> What are the recommended ways to store and give access to passwords?
Whenever possible, don't. Otherwise, it depends on the scale and security you need. A password manager is one possible solution. Another solution is something like Hashicorp's Vault or OpenBao.
> How can a new hire be given access to all required passwords day 1?
They should access it through their SSO account, and not need a billion passwords across systems.
> And when such new hire gets promoted, how can we give access to the additional passwords they will need?
Again, whenever possible, tie access to their SSO account.
> And if someone leaves the company, how can we change only the sensible passwords they had access to and preferably notify everyone with access to it that it was changed?
Well if you did all of the above this wouldn't be an issue, you just close the 1 account.
> Any best practices? Any 80/20 suggestions? Low hanging fruits? Any warnings about what not to do?
Another thing you can do is give people 2 accounts, a normal account and an Admin level account, this is useful for things where the employee needs a regular day to day account as well. i.e. for the employee self portal for instance.