It's Okta's key feature... Once a user logs in and reaches their 'Apps Dashboard,' they can click on any SaaS app to open it in an already authenticated session without needing to know the passwords. This makes it possible for multiple users to access a single license.
Ask HN: How to store and share passwords in a company?
151–160 of 297 posts
Re: Ask HN: How to store and share passwords in a company?
#152Echoing a lot of people here but...
Password manager like 1Password, for the few passwords that do need to be managed
SSO as much as possible. Fewer places to manage access = easier onboarding and off boarding
In general you want to use role based access control. I'm not familiar with off the shelf solutions, but the concept is that you grant people access to systems according to what they need for their job (role). A role in this case may be a team, or a specific job on that team (e.g. engineers on xxx product team). Then e.g. when that team has to add another engineer to their oncall rotation, they give them access associated to that role. When person moves off the team access gets removed. when the team realizes they need another permission to troubleshoot their systems, everyone in that role on the team gets it. Etc.
Re: Ask HN: How to store and share passwords in a company?
#153Strongly recommend using Bitwarden with various collections for different types of things. When someone leaves, we rotate every single password which was in a collection they had access to. It's a massive PITA, but it works /shrug.
Re: Ask HN: How to store and share passwords in a company?
#154Earlier quoted context omitted.
The critical missing piece of 1Password for Business is that it won't reveal to IT admins what passwords are weak across the org (Watchtower only works for the individual). Despite endless training, people still choose really weak passwords, and you need tools to spot this and require employees to change them.
Looks like they do have Watchtower for business https://support.1password.com/reports/#create-a-business-wat...
To clarify, this is only for Vaults, so all passwords outside of Vaults have no visibility.
Re: Ask HN: How to store and share passwords in a company?
#155Never bind critical services to the account of one employee. When that one employee gets hit by a bus you loose access to critical infrastructure.
ah, so one should ensure that the account is duplicated in some way. "shared", if you will.
Re: Ask HN: How to store and share passwords in a company?
#156You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…
What’s SSO and how do I put vendor API keys into it? Like one of the most important APIs we have is just 1 key and that’s it. I don’t think the vendor has heard the term “key rotation”
Re: Ask HN: How to store and share passwords in a company?
#157You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…
Never pay the "SSO tax" by outsourcing to Okta, etc. There many FOSS IdP solutions that are usable with some customization and integration.
[deleted]
Re: Ask HN: How to store and share passwords in a company?
#158You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…
Never pay the "SSO tax" by outsourcing to Okta, etc. There many FOSS IdP solutions that are usable with some customization and integration.
The SSO tax is the premium your vendors add to accounts that link with any IdP.
Re: Ask HN: How to store and share passwords in a company?
#159We always used 1Password[0]. We still use it in the open-source projects that I work with. I have heard that LastPass is about as good, but have no experience using it. The latest version of 1Password isn't so good, but it works fine. [0] https://1password.com
My last company settled on LastPass before they gave away all your passwords.
Well, the subject was about how to share passwords. LastPass is astoundingly good at that part.
Re: Ask HN: How to store and share passwords in a company?
#160You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…
That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.
Except the search function of bitwarden is totally broken. Searching for A B shows everything with A or B, not even with A and B at the top.