4 ms·

Use of 3rd party password trackers has been a periodic concern for our organization. We do B2B business with banks, so the temperature is increased somewhat. Th

Use of 3rd party password trackers has been a periodic concern for our organization. We do B2B business with banks, so the temperature is increased somewhat. There are kinds of credentials we have access to that genuinely terrify me. I've been debating building an in-house solution for managing secrets, if for no other reason than to get all of this information off of 3rd party computers. No serious proposals have been put forth, but I don't think this stuff is exactly rocket science either. Our requirements are functionally-equivalent to a copy of passwords.xlsx on a network share.

1123581321 4y ago
If I were a bank customer, I would not want to hear your second paragraph…
- bob1029 4y ago
  The system is fairly broken from my perspective. Especially, as the size of the financial institution decreases. We work with smaller customers. At this small scale, everything is vendored out. Many times, 2+ different vendors will need to directly exchange something like a password for the bank's core system. Email is the preferred technique, typically with some theatrical secure email crap on top - involving yet another 3rd party in the secret exchange mess. As you get into the scale of an organization like Capital One or BofA, you start to see more of that Hollywood-style credential exchange & control with multiple consenting parties, Iron Mountain trash cans, biometric doors and one-time passwords. If you are concerned about the IT/security of your financial institution, you may prefer larger ones. These have more employees running just IT compliance than many of our clients have in total. If you are concerned about bad customer service or losing access to funds, you may prefer smaller ones. Being able to realistically talk to a board member of the bank about a dispute makes a lot of people feel better about where their money is.
29083011397778 4y ago
Why not whichever Keepass client you prefer, and Syncthing (if it's even necessary for your use-case)? Open-Source, old enough to have a few revisions and be looked at pretty closely, completely off-line, and forgiving if updates are needed to passwords (with many clients having the option of merging changes with your open database). This way, you don't make the same mistake as Telegram as well; I.E., don't roll your own crypto if you can help it, especially if there are ready-made tools that already do what you want, doubly so when those tools are battle-tested and looked over by actual experts.
- bob1029 4y ago
  > doubly so when those tools are battle-tested and looked over by actual experts. The "actual experts" part is where I trip over this. What is the standard in this context? I've written a lot of software that utilizes cryptographic primitives in a wide variety of business contexts. Does this make me an expert? Or, do I need some special piece of paper that says I have permission to conduct cryptographic implementation business? If so, where do I obtain this? I thought this whole comment thread was a matter of the "actual experts" not being who they claimed to be. Switching to Keepass, 1password, et. al. is just continuation of the same madness in my view.
drdaeman 4y ago
> Our requirements are functionally-equivalent to a copy of passwords.xlsx on a network share. Really?! That's the least secure option I can think about, including LastPass. No encryption whatsoever, and the whole setup relies on no one ever making copies or otherwise getting unauthorized access to the file. Audits could be tricky, too - Excel may save some temporary copies of this file somewhere (like in %TEMP%) without anyone realizing. This stuff isn't rocket science (pass is a simple shell script, after all), but your comment sounds quite concerning. I mean, I know banks are notoriously backwards when it comes to technologies and information security, but this is just... wrong.

1123581321 4y ago

If I were a bank customer, I would not want to hear your second paragraph…

bob1029 4y ago
The system is fairly broken from my perspective. Especially, as the size of the financial institution decreases. We work with smaller customers. At this small scale, everything is vendored out. Many times, 2+ different vendors will need to directly exchange something like a password for the bank's core system. Email is the preferred technique, typically with some theatrical secure email crap on top - involving yet another 3rd party in the secret exchange mess. As you get into the scale of an organization like Capital One or BofA, you start to see more of that Hollywood-style credential exchange & control with multiple consenting parties, Iron Mountain trash cans, biometric doors and one-time passwords. If you are concerned about the IT/security of your financial institution, you may prefer larger ones. These have more employees running just IT compliance than many of our clients have in total. If you are concerned about bad customer service or losing access to funds, you may prefer smaller ones. Being able to realistically talk to a board member of the bank about a dispute makes a lot of people feel better about where their money is.

29083011397778 4y ago

Why not whichever Keepass client you prefer, and Syncthing (if it's even necessary for your use-case)? Open-Source, old enough to have a few revisions and be looked at pretty closely, completely off-line, and forgiving if updates are needed to passwords (with many clients having the option of merging changes with your open database). This way, you don't make the same mistake as Telegram as well; I.E., don't roll your own crypto if you can help it, especially if there are ready-made tools that already do what you want, doubly so when those tools are battle-tested and looked over by actual experts.

bob1029 4y ago
> doubly so when those tools are battle-tested and looked over by actual experts. The "actual experts" part is where I trip over this. What is the standard in this context? I've written a lot of software that utilizes cryptographic primitives in a wide variety of business contexts. Does this make me an expert? Or, do I need some special piece of paper that says I have permission to conduct cryptographic implementation business? If so, where do I obtain this? I thought this whole comment thread was a matter of the "actual experts" not being who they claimed to be. Switching to Keepass, 1password, et. al. is just continuation of the same madness in my view.

drdaeman 4y ago

> Our requirements are functionally-equivalent to a copy of passwords.xlsx on a network share. Really?! That's the least secure option I can think about, including LastPass. No encryption whatsoever, and the whole setup relies on no one ever making copies or otherwise getting unauthorized access to the file. Audits could be tricky, too - Excel may save some temporary copies of this file somewhere (like in %TEMP%) without anyone realizing. This stuff isn't rocket science (pass is a simple shell script, after all), but your comment sounds quite concerning. I mean, I know banks are notoriously backwards when it comes to technologies and information security, but this is just... wrong.