Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How Do You Securely Share Passwords in Teams?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 67 posts

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#41

Post by bazzargh »

brokentone wrote: post #10

Honestly the original "share" isn't the big issue -- many ways to communicate securely. But the history is what will get you if your communication platform ever gets broken into. Most of the external accounts (log analysis, analytics, CDN, etc) have individual accounts, no sharing necessary, up to the individual to maintain complexity and remember the password. For other services, certificates and multiple authentica…

OTR messaging gives perfect forward secrecy. So you can't attack the history without breaking AES entirely: http://en.wikipedia.org/wiki/Perfect_forward_secrecy The bigger attack on OTR is social engineering, you need to verify signatures out of band.

But as you say, it's better not to have the secret at all.

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#43

Post by [deleted] »

aroch wrote: post #29
simonw wrote: post #26

Earlier quoted context omitted.

Do you have a company Twitter account?

Yes/no, one exists but its unrelated to my job. Its probably worth noting that we also have sets of accounts that while password protected are essentially considered public. Those accounts are accessible to anyone who knows the well-known standard passphrase

[deleted]

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#45

Post by icebraining »

karthikv2k wrote: post #25

https://www.secureshareme.com/ Pros: 1. Open source tool, you can run internally in your company. https://github.com/saravanacp/secureshareme 2. Very secure: it encrypts the data in the browser and the key is stored in the URL anchortag which is not sent to server at any point of time. Only the sender and the receiver has access to the keys. 3. You can also opt to send a secondary verification code to receiver's mobi…

They should point out that it's vulnerable to JavaScript injection, particularly if you use their servers. One simple change and suddenly they can get your key on your next access.

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#46

Post by emeidi »

cones688 wrote: post #5

Large enterprises usually use PIMs (Privileged Identity Managers), web based consoles where you check out credentials for the task. I have seen IBMs and it has some pretty creepy (if you are the dev)/powerful (if you are CISO) features like session recording etc [0], does allow you to see who used what at what time and rotates passwords for the systems required between use.. [0] http://www-03.ibm.com/software/product…

As an IT Auditor, I have seen one such tool at a client once and found it to be the best solution for this specific problem (if personal logins and sudo or another custom made script couldn't do the trick).

But I've also come across dozens of unprotected .xlsx and .txt files stored on group shares which give me shivers every time I see it.

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#48

Post by emeidi »

cones688 wrote: post #5

Large enterprises usually use PIMs (Privileged Identity Managers), web based consoles where you check out credentials for the task. I have seen IBMs and it has some pretty creepy (if you are the dev)/powerful (if you are CISO) features like session recording etc [0], does allow you to see who used what at what time and rotates passwords for the systems required between use.. [0] http://www-03.ibm.com/software/product…

"rotates passwords" Which I think is an awesome feature, especially when the rotation can be forced. Also, very desireable, one-time passwords. And a way to enforce password complexity and to prevent the same password being used for two different devices. And a way to audit password strength and rotation, of course :-)

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#49

Post by karthikv2k »

icebraining wrote: post #45
karthikv2k wrote: post #25

https://www.secureshareme.com/ Pros: 1. Open source tool, you can run internally in your company. https://github.com/saravanacp/secureshareme 2. Very secure: it encrypts the data in the browser and the key is stored in the URL anchortag which is not sent to server at any point of time. Only the sender and the receiver has access to the keys. 3. You can also opt to send a secondary verification code to receiver's mobi…

They should point out that it's vulnerable to JavaScript injection, particularly if you use their servers. One simple change and suddenly they can get your key on your next access.

Yes, you are right we can modify our JS and get your keys. This vulnerability is in most of the commercial tools out there too. Thats why it is open sourced so you can run it in your own servers. Running it on your own heroku account is close to zero dollars.

Re: Ask HN: How Do You Securely Share Passwords in Teams?

#50

Post by furyg3 »

For user specific passwords, our team uses whichever software they prefer (usually LastPass or KeePass)

For passwords that can absolutely not be made user-specific, we use SimpleSafe (https://www.simplesafe.net/). It allows you to make groups of passwords and assign rights to those passwords, and has decent logging. It's web based and works ok on mobile.

These few passwords are for network devices, passwords for websites where only one account can be made, or master/root/administrator passwords that we don't use but need to write down somewhere just in case.

These are the keys to the kingdom, so it should be behind VPN/SSH, ideally completely isolated from your regular infrastructure, and with tested backup procedures.

Post reply on HN