Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do you manage passwords? Esp. for a company?

news.ycombinator.com

Post reply on HN
Print view View original

1–10 of 19 posts

Ask HN: How do you manage passwords? Esp. for a company?

#1

Post by Jacqued »

Everyone around here always says that you should not reuse passwords, make them long, complicated, impossible to crack with a dictionary, etc. I must admit, out of laziness, I have barely ever followed any of that advice.

How do you manage that ? Is there a foolproof and practical enough way to store the passwords somewhere secure ? (If they're random, 16+ char strings, I can't remember many of these).

More importantly : how do you manage them for a company ? I have recently started mine and am having trouble figuring a smart way to do it. For now we have a physical notebook where we write all of them down but I'm quite paranoid about losing it, and having some ill-intentioned person get their hands on it would be a real and complete catastrophe for us (it contains financial passwords, root passwords to our servers, etc.)

So what's a really secure way to manage passwords ? Especially when more than one individual needs to access it ?

Re: Ask HN: How do you manage passwords? Esp. for a company?

#2

Post by KiwiCoder »

There's really just one answer to this - Lastpass with two-factor auth. Enterprise features described here: https://lastpass.com/enterprise/enterprise-features/

Replace Lastpass with any other secure password manager, and use any 2F auth you prefer, but that's the bog standard way to secure your passwords.

Re: Ask HN: How do you manage passwords? Esp. for a company?

#4

Post by ksatirli »

I managed all my passwords with 1Password (with a recipe that is between 20 and 24 alphanumeric characters).

Since 1Password 4 it is possible to have multiple vaults - one of which I share with my colleagues via Dropbox. That way, everyone has access to the passwords if they know the master password for the vault AND have access to the shared Dropbox.

Re: Ask HN: How do you manage passwords? Esp. for a company?

#5

Post by dirktheman »

We use keepass, our .kdb is stored in a shared dropbox folder. I know this is not 100% safe, but it's infinitely more secure than the way we handled things before. Keepass is open source, free, and with KeepassX and MiniKeePass you can use it on Mac, IOS and Android, too.

Re: Ask HN: How do you manage passwords? Esp. for a company?

#6

Post by zaroth »

The notebook will not be your point of entry.

You can say that to yourself at night before you go to sleep, if it helps. But, really, the notebook is not the problem.

My advice is to keep your eye on the ball, and do the big things that move the needle. Security is about layers, and there are a lot of layers that are bleeding right now, all over the industry.

There are also a lot of really good suggestions here for password management, if that's what you want to focus on.

Re: Ask HN: How do you manage passwords? Esp. for a company?

#7

Post by codebeaker »

ksatirli wrote: post #4

I managed all my passwords with 1Password (with a recipe that is between 20 and 24 alphanumeric characters). Since 1Password 4 it is possible to have multiple vaults - one of which I share with my colleagues via Dropbox. That way, everyone has access to the passwords if they know the master password for the vault AND have access to the shared Dropbox.

> Since 1Password 4 it is possible to have multiple vaults - one of which I share with my colleagues via Dropbox. That way, everyone has access to the passwords if they know the master password for the vault AND have access to the shared Dropbox.

My co-founder and I switched to that today, rather than me being the "gatekeeper", feels much better. I'm a dev, he's a marketing guy, and it works perfectly for us. 1Password is the best $35/head (With volume discounts available) you can spend to keep things safe and secure.

Re: Ask HN: How do you manage passwords? Esp. for a company?

#8

Post by caw »

We have a custom password database application. You request the to view a particular password or set of passwords, and then it goes through an approval chain to grant you access. Afterwards, you can see the password. Depending on the security requirements, these passwords are changing every 90-180 days so when you really need the password it's probably not the one you used last time.
Post reply on HN