Hacker News Reader

Comment by Artemis2 | Hacker News Reader

Cloudflare will not let you have individual users without the (unspecified) “Enterprise” pricing plan. Even on the Business plan, we get to copy/paste one password around the team. Great for security.

Every other service (especially that critical!) we use gives it away with the actual service. I really dislike this about Cloudflare.

View on HN

Enterprise pricing starts at $5k per month.

You should have mandatory 2FA authentication for this sort of things.

How would multiple people share the second factor?

We have a two-man rule for such accounts: one person (or one group) is responsible for the password, and the other has the 2FA secret on their Yubikey. The other rule is to not use these accounts; as an example use use root AWS accounts once or twice a year when we need to fill in their forms.

How about just do it?

Ever shared a USB key or a company phone. There isn't much to describe.

I guess if all the people who need access are in the same physical location that works.

By sticking the same base code into Google Authenticator or similar?

I didn't think that was possible at least with Google accounts. But now that I think about it, if you set up both devices from the same QR code (instead of running through the process twice) it should work. Good idea.

Have you thought of using a group password manager like 1Password, Dashlane, etc so you're not copy and pasting a password around the team? Just a suggestion :)

Good advice for password management but that doesn’t change the fact any internal malicious actor can take the password and be very difficult to identify

Very true, but still better than pasting a password around?

That only addresses one (and arguably the smallest) of the various issues with a shared username/password.

Isn't it bad to have passwords in plain text though? Sure, it's a small issue, but it definitely exacerbates the problem. I don't understand why this is earning me downvotes....

You're proposing a band-aid for a gaping wound.

I love 1Password, but it doesn't solve the auditing issues inherent in a single shared account. It doesn't stop an angry employee from changing the email and password to lock everyone else out.

It's upsetting that Cloudflare, with their otherwise good approach to security, apparently puts multi-user accounts behind a $5k/month paywall.

True. I agree with you!

We do use Dashlane and GPG for sharing secrets. In this article’s case I would bet that nobody changed the account’s password because (i) it’s no one’s responsibility (ii) they do not want to disrupt someone else’s workflow.

Nice. Didn't mean to insinuate that you weren't. Yeah it's definitely not the best thing but some people really do copy and paste passwords around!

Reply on news.ycombinator.com