Ask HN: How does your company manage passwords?

4 points·HNBRN··8 comments

We're a startup based in Paris. Our staff is growing, we use a lot of third part saas and we find it increasingly complicated to deal with passwords and access management.

View on HN

1Password is great, the vault management and sharing makes it pretty slick and allows you to control who has access to what. You can have production vaults, separate from staging, test and development etc.

I started using it for family sharing of security at first and it proved super valuable. It is also nice you can add attachments and aws, ssl keys etc to it easily.

Also, it allows for easy 2fa to be shared amongst the team for most websites and products.

edit: added 2fa line.

sso+2fa all the things. easy for users as they only need 1 token and set of credentials. so no need to manage databases full of passwords.

okta is useful service for it which is popular because it's good / useful, but it needs to be set up properly and securely by people with experience in it. since messing it up can be BAD as any compromise is obviously going to be more of impact. might be a bit of an investment at first, but it will save in administrator's time / maintenance etc. later.

do it carefully though. really carefully :) only need to do it once, so it's worth to take the time and investment and do it right.

there's also products like 'secret server' , but i tend to dislike password management solutions ,as they are not a solution to the root cause and if compromised, it's a major issue instead of 1 limited user being owned.

A .txt File on a Network Share which has a FTP-Access. :)

You should publish it to the web to make it easy to use, but give it an obscure filename to make it secure.

is "passw0rds.txt" not obscure enough? xD

My current employer uses Password Manager Pro, not sure how much they paid for it.

Lastpass

Reply on news.ycombinator.com