Other than the popular password managers mentioned you can try Password Pusher [0]. It's open source, can be self-hosted, and has options like expire link after n loads or days.
Ask HN: How to store and share passwords in a company?
101–110 of 297 posts
Re: Ask HN: How to store and share passwords in a company?
#102You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2.
Remember, as you give people access to passwords, that those passwords will need to be rotated when those people change to incompatible roles or depart the company. If passwords aren't a total pain in the ass for you, you're probably doing something wrong.
Re: Ask HN: How to store and share passwords in a company?
#103Don't. Give them access to all systems they need with their own user/password. That way you can revoke them (if/when necessary) without disrupting everyone else.
Also automate as much as is reasonable, e.g. github access to push code to a dev branch, then enqueue merging of it. But a CI/CD pipeline does the actual deploy, the employee doesn't need to access any of the production systems. A very small number still will, but that's a much better situation.
Give the employee 1Password to manage their own passwords.
Re: Ask HN: How to store and share passwords in a company?
#104`pass` https://www.passwordstore.org/ , shared password are shared as long as PGP kays of the participants are in the repository.
Re: Ask HN: How to store and share passwords in a company?
#105> We tend to have zillions of passwords in IT jobs right? Yes, but they should be unique to your account. I.e. via SSO. > What are the recommended ways to store and give access to passwords? Whenever possible, don't. Otherwise, it depends on the scale and security you need. A password manager is one possible solution. Another solution is something like Hashicorp's Vault or OpenBao. > How can a new hire be given acces…
> Yes, but they should be unique to your account. I.e. via SSO. This is a great best practice, but user-based value metrics for many SaaS platforms make this untenable for some IT departments. If folks have to log in seldomly, it's very hard to make the business case to pay per user. Similarly, there's many SaaS platforms that charge A LOT extra for SSO because you have to upgrade to their Enterprise-pricing model. I…
We change our PW for some platforms every month, so that people leaving won’t have access anymore
Re: Ask HN: How to store and share passwords in a company?
#106[deleted]
Re: Ask HN: How to store and share passwords in a company?
#107I can only say that using pass ( https://www.passwordstore.org/ ) is an absolute nightmare, in case anyone else is considering that It seems like perfect simplicity built on time-tested cryptography: store pgp-encrypted files in a git repository. We already had an internal git server and used PGP internally, it was the perfect marriage. The tool provides the common functions like selecting which colleagues to encrypt…
In that sense pass is no different from other password managers. What prevents the user of an "online" password manager from storing the passwords offline, remembering them, or not logging out and reusing cookies? You have to rotate the credentials themselves anyway.
Not sure what cookies have to do with it. If we would use a system where the client software only obtains the secret that the user is asking for, it can later say which credentials were accessed and thus need to be rotated when the employee leaves. If session cookies are still usable by an employee whose account was deleted, that's a vulnerability...
Re: Ask HN: How to store and share passwords in a company?
#108We always used 1Password[0]. We still use it in the open-source projects that I work with. I have heard that LastPass is about as good, but have no experience using it. The latest version of 1Password isn't so good, but it works fine. [0] https://1password.com
The fanbase for LastPass on HN is close to zero.
Bitwarden paid allows for sharing folders out to other users. I believe those can be non-paid.
Various clients have used 1PW. It works but for reasons I don't recall atm I never liked it as much as BW.
Re: Ask HN: How to store and share passwords in a company?
#109Don't. Give them access to all systems they need with their own user/password. That way you can revoke them (if/when necessary) without disrupting everyone else. Also automate as much as is reasonable, e.g. github access to push code to a dev branch, then enqueue merging of it. But a CI/CD pipeline does the actual deploy, the employee doesn't need to access any of the production systems. A very small number still wil…
I agree with this. But I want to ask a similar question as OP but for services. How do you handle service account credentials in a good way? Typically multiple engineers need to be able to test out a given service account. So a number of users need to have access to the credentials of that service account. And you need a good way to enroll a new service to service connection, i.e give a service account access to another service.
I haven't seen this done in a way that didn't feel overly complex, prone to error and oversharing of secrets.
Re: Ask HN: How to store and share passwords in a company?
#110Don't. Give them access to all systems they need with their own user/password. That way you can revoke them (if/when necessary) without disrupting everyone else. Also automate as much as is reasonable, e.g. github access to push code to a dev branch, then enqueue merging of it. But a CI/CD pipeline does the actual deploy, the employee doesn't need to access any of the production systems. A very small number still wil…
I agree with this. But I want to ask a similar question as OP but for services. How do you handle service account credentials in a good way? Typically multiple engineers need to be able to test out a given service account. So a number of users need to have access to the credentials of that service account. And you need a good way to enroll a new service to service connection, i.e give a service account access to anot…
> the credentials of that service account
Why do these accounts only have a single user/password?
In any case, my answer would again be automation. Script the test, have the authorized process test out the service account on behalf of any employee who can create and run those tests.