https://github.com/gdb/password-vault, which provides GPG encryption of data at rest on the server, and only stores data (encrypted or not) transiently on the client to mitigate the effects of a stolen machine.
Ask HN: How do you manage shared company passwords?
21–30 of 65 posts
Re: Ask HN: How do you manage shared company passwords?
#22We use plain GPG-encrypted files stored in our version control system (git/svn). The files get encrypted with all the public keys of the users who have access to these files, and can be decrypted with their private keys then. Not perfect, but works.
you mean you have for N users N copies of the file, each encrypted with a different key, or one file that is encrypted with N keys and then you need N keys to decode?
Re: Ask HN: How do you manage shared company passwords?
#23I have used http://www.strongbox.io/ - it allows you to create a 'box' of passwords or other data that is securely shared with other users.
Re: Ask HN: How do you manage shared company passwords?
#24We use plain GPG-encrypted files stored in our version control system (git/svn). The files get encrypted with all the public keys of the users who have access to these files, and can be decrypted with their private keys then. Not perfect, but works.
you mean you have for N users N copies of the file, each encrypted with a different key, or one file that is encrypted with N keys and then you need N keys to decode?
You've one copy of the file, encrypted with N public keys. Each of the corresponding private keys can decrypt the files.
Assuming you've all the public keys in your keychain, then for each key you pass "-r " for the encryption, like "gpg -e -r foo@bar.com -r baz@bar.com plain.txt", and for decryption you do something like "gpg --output plain.txt -d plain.txt.gpg".
Re: Ask HN: How do you manage shared company passwords?
#25If you are using plain FTP for something then it is safe to assume that security is not a priority anyway, so a shared .txt file with the password in should suffice.
Re: Ask HN: How do you manage shared company passwords?
#26We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy.
It goes something like this (of course, this is slightly different):
(First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name)
So, for instance, www.mcondalds.com would be:
mc + To01n + com + ds || mcTo01ncomds
This appears random to the client but is easy for us to work out once you've done it a couple of times, but of course there are exceptions:
Hosted on Localhost TLD: loc
.co.uk TLD: couk
Once you adapt your company to a procedure like this is becomes simple and quick to log in to client sites, but also saves you the overhead in time of managing a large spreadsheet or application for it.
Re: Ask HN: How do you manage shared company passwords?
#27We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…
Wouldn't this mean ex-employees would know your password scheme indefinitely?
Re: Ask HN: How do you manage shared company passwords?
#28We use plain GPG-encrypted files stored in our version control system (git/svn). The files get encrypted with all the public keys of the users who have access to these files, and can be decrypted with their private keys then. Not perfect, but works.
you mean you have for N users N copies of the file, each encrypted with a different key, or one file that is encrypted with N keys and then you need N keys to decode?
You can encrypt a file to N users in GPG with only one output file, and require only one of the corresponding private keys to decrypt. More information here [0]; TLDR, it encrypts with a symmetric key then includes the symmetric key encrypted with the public key of each recipient.
[0]: http://security.stackexchange.com/questions/8245/gpg-file-si...
Re: Ask HN: How do you manage shared company passwords?
#29We simply don't need to - we use a procedural password which any of our employees can easily emulate but which still provides enough entropy. It goes something like this (of course, this is slightly different): (First 2 letters of domain name) + (To01n) + (TLD) + (Last two letters of domain name) So, for instance, www.mcondalds.com would be: mc + To01n + com + ds || mcTo01ncomds This appears random to the client but…
Wouldn't this mean ex-employees would know your password scheme indefinitely?
I suppose so, yes, but on the other hand, wouldn't it mean that every time an employee left, wouldn't you have to go through every single password (currently 436) and change them?
In any case, once we sign off on a project, the client normally like to set up their own usernames and passwords for admin accounts, it gives them a sense of control.
Re: Ask HN: How do you manage shared company passwords?
#30KeePass + some kind of bidirectional file syncing service.
Personally, I use dropbox to sync personal passwords to my work computer.
Professionally, I use OpenText Tempo Box. I work for Open Text, I don't personally work on the product, but do like it. The Tempo Box product has similar features to dropbox, but it is for those that need to keep their data within corporate controlled servers.
Despite the service you choose the most important lessons learned are: 1. People need to close keepass every night. So if new passwords arrive, they will get them. (People tend to leave the application running) 2. People need to be taught to use a keepass and encouraged to use it! People are afraid to update the entries and things fall out of date. 3. Sync first, then update! 4. Please use a title naming convention. We didn't and things got messy. We have many instances of the same application. Naming is very important. 5. Auto-type is nice, please configure it and teach everyone to use it. (There are some applications it refuses to work on: Remote Desktop)
I hope this helps. Internally, we gotta do some of the above and clean it up. But overall it's a working out pretty well for us. We have a global team that spans multiple offices and timezones. If anyone has a better solution, I'm all ears.
edited for spacing and glaring grammer errors