6 ms·

> Service passwords are still stored in clear text in the corporate wiki. I know this painfully well :(. Can you recommend some good solution? Ideally open sou

> Service passwords are still stored in clear text in the corporate wiki. I know this painfully well :(. Can you recommend some good solution? Ideally open source and self hosted, instead of cloud password manager.

Operyl 7y ago
While I’ve not personally used it, I’m happy with 1Password Teams, bitwarden has a pretty well received project. If you want self hosted teams, though, you will need to purchase a license (it’s one of their money makers, and I think that is completely fair). Most of their product is otherwise open, afaik.
tmikaeld 7y ago
Bitwarden is fully open source and audited. You can self host the server and client if you want without additional cost (they charge small per user).
- sneak 7y ago
  Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count. The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589 “It was audited” is meaningless if the audit missed this, or reported this and the dev dismissed it. Either way, it is unsafe.
  - phonon 7y ago
    It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/auth/hashers.py#L238 https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.
    - deleted 7y ago
      [deleted]
    - sneak 7y ago
      Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.
      - tmikaeld 7y ago
        In the Audit they pointed this out, but didn't see it as a huge issue. I'd rather they use Argon2id to be as safe as can be. However, I've not yet seen a fully cross-platform javascript-only implementation of Argon2 at all, which is problematic for an extension.. :-/ UPDATE: There actually exist an Argon2 implementation that's used by another vault, https://www.npmjs.com/package/argon2-browser https://www.npmjs.com/package/argon2-browser
      - phonon 7y ago
        Errr...most systems (like Django) send passwords in plaintext to the server! (Over SSL of course). The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.
        sneak 7y ago
        Django’s auth system is for a single site. Bitwarden’s master passphrase protects the key that decrypts my password for every single site I use. This is not some random webapp. It is a password manager.
        phonon 7y ago
        So use a longer password with BitWarden. Think about it.
pixiemaster 7y ago
Disagree about the Cloud requirement. Because: in this scenario you need to drive adoption first,if it is any complicated the humans will not use it. so you need the easiest tool possible. when everybody is using it, THEN go for the real security move. (you can try to find a non-cloud one that is super easy, but...)
- n00b123 7y ago
  You may be correct, but in current mindset u would get "What do you mean store all our password with someone else? No." answer. No amount of explaining can fix it.
- bartread 7y ago
  > Because: in this scenario you need to drive adoption first ... Be careful: that sort of behaviour can get you fired and potentially land your company in hot water from a legal and/or compliance standpoint, as well as lose them customers. Compliance is often as much, or more, about having and following documented processes, as it is about having good processes. This can include an approved list of software and services. If you step outside this you are likely breaching your compliance regime. In the specific case of passwords you may have policies and procedures around secret management that would be violated by storing this information in the cloud, even with a service specifically designed for this. As stupid as it is, the quality (or lack thereof) of your current solution is not the key point here. If you decide to get all subversive and start using a cloud service then, at the very least, if discovered you're going to get into trouble. At worst, if customers become aware they might leave, and as I've already said, the company might find themselves in legal difficulties.
weystrom 7y ago
https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass Crossplatform, git versioning, gpg security (allows you to integrate with smartcards and tokens that you might already have in place for your employees). Decent UX too, works with clipboard, supports totp.

Operyl 7y ago

While I’ve not personally used it, I’m happy with 1Password Teams, bitwarden has a pretty well received project. If you want self hosted teams, though, you will need to purchase a license (it’s one of their money makers, and I think that is completely fair). Most of their product is otherwise open, afaik.

tmikaeld 7y ago

Bitwarden is fully open source and audited. You can self host the server and client if you want without additional cost (they charge small per user).

sneak 7y ago
Bitwarden derives its keys using SHA256 on the passphrase and a hilariously low iteration count. The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server. https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/server/issues/589 https://github.com/bitwarden/server/issues/589 “It was audited” is meaningless if the audit missed this, or reported this and the dev dismissed it. Either way, it is unsafe.
- phonon 7y ago
  It looks like people are getting confusing between using SHA256 directly as a key stretching mechanism, and what PBKDF2-SHA256 is. https://crypto.stackexchange.com/a/61306 https://crypto.stackexchange.com/a/61306 Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/auth/hashers.py#L238 https://github.com/django/django/blob/master/django/contrib/... Given Bitwarden allows almost 10x that, not sure I see the issue.
  - deleted 7y ago
    [deleted]
  - sneak 7y ago
    Bitwarden’s auth protocol allows the server to tell the client that the iteration count is 5000, regardless of the actual iteration count, and the client will send 5000-iteration passphrase-derived material to the bitwarden server (run by the developer in the usual case). PBKDF-SHA256 is far too fast, even with the HMAC step.
    - tmikaeld 7y ago
      In the Audit they pointed this out, but didn't see it as a huge issue. I'd rather they use Argon2id to be as safe as can be. However, I've not yet seen a fully cross-platform javascript-only implementation of Argon2 at all, which is problematic for an extension.. :-/ UPDATE: There actually exist an Argon2 implementation that's used by another vault, https://www.npmjs.com/package/argon2-browser https://www.npmjs.com/package/argon2-browser
    - phonon 7y ago
      Errr...most systems (like Django) send passwords in plaintext to the server! (Over SSL of course). The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.
      - sneak 7y ago
        Django’s auth system is for a single site. Bitwarden’s master passphrase protects the key that decrypts my password for every single site I use. This is not some random webapp. It is a password manager.
        phonon 7y ago
        So use a longer password with BitWarden. Think about it.

pixiemaster 7y ago

Disagree about the Cloud requirement. Because: in this scenario you need to drive adoption first,if it is any complicated the humans will not use it. so you need the easiest tool possible. when everybody is using it, THEN go for the real security move. (you can try to find a non-cloud one that is super easy, but...)

n00b123 7y ago
You may be correct, but in current mindset u would get "What do you mean store all our password with someone else? No." answer. No amount of explaining can fix it.
bartread 7y ago
> Because: in this scenario you need to drive adoption first ... Be careful: that sort of behaviour can get you fired and potentially land your company in hot water from a legal and/or compliance standpoint, as well as lose them customers. Compliance is often as much, or more, about having and following documented processes, as it is about having good processes. This can include an approved list of software and services. If you step outside this you are likely breaching your compliance regime. In the specific case of passwords you may have policies and procedures around secret management that would be violated by storing this information in the cloud, even with a service specifically designed for this. As stupid as it is, the quality (or lack thereof) of your current solution is not the key point here. If you decide to get all subversive and start using a cloud service then, at the very least, if discovered you're going to get into trouble. At worst, if customers become aware they might leave, and as I've already said, the company might find themselves in legal difficulties.

weystrom 7y ago

https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass Crossplatform, git versioning, gpg security (allows you to integrate with smartcards and tokens that you might already have in place for your employees). Decent UX too, works with clipboard, supports totp.