Ask HN: How do you manage shared company passwords? • Hacker News Board

Re: Ask HN: How do you manage shared company passwords?

#11

Post by jos3000 » Tue, Jan 29, 2013, 11:25 AM UTC

I wrote a custom script for Google Spreadsheets to encode our passwords using AES with on master password shared between me and my business partner.

We now use http://www.passpack.com/ to easily share passwords and other credentials with my staff.

Re: Ask HN: How do you manage shared company passwords?

#12

Post by Cogito » Tue, Jan 29, 2013, 11:26 AM UTC

lifeisstillgood wrote: post #9

Cogito wrote: post #6

Our company is a services company built around the Atlassian suite of tools. Part of what we do is write plugins for those applications. We developed a plugin called Security and Encryption Plugin (previously Vault) for Confluence, that allows you to protect any piece of text with GPG encryption. Any shared credentials get stored in the Vault on the corresponding client's spot in the Confluence wiki, where we store a…

Thats fascinating - does it need gpg on the client machines - or (and this is a guess) if you are logged in as Fred, does the server store Fred's private Key? Actually - I am going to stop guessing - how do you arrange keys and decryption please?

The 'traditional' method requires gpg on the client machine. The vault was just a way of uploading text and having it encrypted on the server automatically. The user was required to download the encrypted data and then decode it themselves.

You can now do more things, like password protect the data, provide access to specific users, and perform a 'server assisted' decryption, which allows you to provide the private key without needing a gpg client.

I haven't personally worked on this plugin, so I might not have the details perfectly correct, but that is more or less how it works :)

[edit]

I forgot to mention, the encryption keys are uploaded by the admin, so a user is able to select from a list of keys to encrypt with when they upload the data. That might not have been clear before.

Re: Ask HN: How do you manage shared company passwords?

#13

Post by raverbashing » Tue, Jan 29, 2013, 11:30 AM UTC

I've ran into this problem, but most of the time the passwords were shared orally

A good solution would also be able to manage private SSH keys as well

Re: Ask HN: How do you manage shared company passwords?

#14

Post by Ecio78 » Tue, Jan 29, 2013, 11:37 AM UTC

tallanvor wrote: post #4

There isn't a perfect solution, but LastPass Entrprise or a similar service is probably the closest you're going to get. KeePass is great, but it's a single user solution. --Even I have to be careful about forgetting to save the database after adding a new entry at work and then going home and adding something else there. You shouldn't even be entertaining the idea of a Google Docs sheet or an Excel file in Dropbox w…

We use KeePass as a multi-user solution: the kdb file is on a network share (with relevant ACLs). The only thing you have to take into account is that you dont have to leave it opened on your computer, so the typical use is: Open / Read (or Write) Password / Close it.

It works in small groups (we're three guys using it, two more frequently)

Re: Ask HN: How do you manage shared company passwords?

#15

Post by pkhamre » Tue, Jan 29, 2013, 11:37 AM UTC

I'm using cpm[1] with revision control (git).

https://github.com/comotion/cpm/wiki/Revision-control

Re: Ask HN: How do you manage shared company passwords?

#16

Post by SeanKilleen » Tue, Jan 29, 2013, 11:42 AM UTC

I used PassPack (http://www.passpack.com/en/home/) for a while and that seems more than sufficient for sharing passwords providing you don't mind that your encrypted data lives on another server. Unfortunately they don't have a white-label version for use internally. I spoke with the leadership there about it but it seems the idea was abruptly dismissed during a leadership change a while back.

Re: Ask HN: How do you manage shared company passwords?

#17

Post by davidbanham » Tue, Jan 29, 2013, 11:49 AM UTC

We've been using PassPack for around a year now and it's been great. The only gotcha is that if I store a password and share it with you, you can't then share it with someone else.

Re: Ask HN: How do you manage shared company passwords?

#18

Post by agranig » Tue, Jan 29, 2013, 11:50 AM UTC

We use plain GPG-encrypted files stored in our version control system (git/svn). The files get encrypted with all the public keys of the users who have access to these files, and can be decrypted with their private keys then. Not perfect, but works.

Re: Ask HN: How do you manage shared company passwords?

#19

Post by lflux » Tue, Jan 29, 2013, 11:50 AM UTC

Binder in the safe.

Re: Ask HN: How do you manage shared company passwords?

#20

Post by robin_reala » Tue, Jan 29, 2013, 11:50 AM UTC

tallanvor wrote: post #4

There isn't a perfect solution, but LastPass Entrprise or a similar service is probably the closest you're going to get. KeePass is great, but it's a single user solution. --Even I have to be careful about forgetting to save the database after adding a new entry at work and then going home and adding something else there. You shouldn't even be entertaining the idea of a Google Docs sheet or an Excel file in Dropbox w…

LastPass Enterprise is working well enough for our organisation. The only thing I dislike about it is that I have a personal LastPass account and can’t keep them both logged in at the same time through the browser plugin.