5 ms·
Cloudflare will not let you have individual users without the (unspecified) “Enterprise” pricing plan. Even on the Business plan, we get to copy/paste one passw
by Artemis2 9y ago
Cloudflare will not let you have individual users without the (unspecified) “Enterprise” pricing plan. Even on the Business plan, we get to copy/paste one password around the team. Great for security.
Every other service (especially that critical!) we use gives it away with the actual service. I really dislike this about Cloudflare.
- CaveTech 9y agoEnterprise pricing starts at $5k per month.
- thebiglebrewski 9y agoHave you thought of using a group password manager like 1Password, Dashlane, etc so you're not copy and pasting a password around the team? Just a suggestion :)
- jackweirdy 9y agoGood advice for password management but that doesn’t change the fact any internal malicious actor can take the password and be very difficult to identify
- thebiglebrewski 9y agoVery true, but still better than pasting a password around?
- ceejayoz 9y agoThat only addresses one (and arguably the smallest) of the various issues with a shared username/password.
- thebiglebrewski 9y agoIsn't it bad to have passwords in plain text though? Sure, it's a small issue, but it definitely exacerbates the problem. I don't understand why this is earning me downvotes....
- ceejayoz 9y agoYou're proposing a band-aid for a gaping wound. I love 1Password, but it doesn't solve the auditing issues inherent in a single shared account. It doesn't stop an angry employee from changing the email and password to lock everyone else out. It's upsetting that Cloudflare, with their otherwise good approach to security, apparently puts multi-user accounts behind a $5k/month paywall.
- thebiglebrewski 9y agoTrue. I agree with you!
- Artemis2 9y agoWe do use Dashlane and GPG for sharing secrets. In this article’s case I would bet that nobody changed the account’s password because (i) it’s no one’s responsibility (ii) they do not want to disrupt someone else’s workflow.
- thebiglebrewski 9y agoNice. Didn't mean to insinuate that you weren't. Yeah it's definitely not the best thing but some people really do copy and paste passwords around!
- deleted 9y ago[deleted]
- user5994461 9y agoYou should have mandatory 2FA authentication for this sort of things.
- eli 9y agoHow would multiple people share the second factor?
- Artemis2 9y agoWe have a two-man rule for such accounts: one person (or one group) is responsible for the password, and the other has the 2FA secret on their Yubikey. The other rule is to not use these accounts; as an example use use root AWS accounts once or twice a year when we need to fill in their forms.
- user5994461 9y agoHow about just do it? Ever shared a USB key or a company phone. There isn't much to describe.
- eli 9y agoI guess if all the people who need access are in the same physical location that works.
- lotsofcows 9y agoBy sticking the same base code into Google Authenticator or similar?
- eli 9y agoI didn't think that was possible at least with Google accounts. But now that I think about it, if you set up both devices from the same QR code (instead of running through the process twice) it should work. Good idea.