5 ms·

Which password manager are you using? There shouldn’t be any sharing of a master password; each individual should have their own account and own master password

Which password manager are you using? There shouldn’t be any sharing of a master password; each individual should have their own account and own master password.

ameliaquining 3y ago
I think the question is how to handle something like an AWS root password, which doesn't conceptually belong to a single individual and which isn't feasible to entirely eliminate from the system.
- xeromal 3y ago
  This is what I had in mind too!
- sjm-lbm 3y ago
  At a business roughly the size of the one OP is talking about, we shared the password with a small group of people and kept a hardware two factor authentication device locked behind a door accessible only to a different small group of people. The basic idea is that you'd need both someone with the password (usually technical leads) and someone with access to a secret spot in the office (generally someone in finance/accounting) to log in, and locking anyone out of the office would instantly ensure they had no access. I don't think a solution like this works directly for the specific situation that OP describes, but I do think it's a good solution for an AWS root account at an organization of the size he is talking about.
- ziddoap 3y ago
  I think the answer above still stands. Put it in a shared vault which can be accessed by however many people require it. They access the shared vault via their own password manager account.
- fragmede 3y ago
  With advanced/power user AWS IAM roles, it's feasible to eliminate it for day to day uses, meaning that you can have it so only one or two people you trust actually have access to the root creds, and everyone else can go about their business. Shamir's Secret Sharing software, ssss, will let you encrypt a file and split it into pieces so that 3 of 5 people are needed to decrypt. http://point-at-infinity.org/ssss/ http://point-at-infinity.org/ssss/
  - lsedgwick 3y ago
    Either the site really doesn't support https (odd, since it is the very page that supplies the verification hashes!) or something more scary is actually happening and it's getting universally man-in-the-middled, which feels plausible for a site that offers cryptographic tools for download.
    - thinkmassive 3y ago
      What tools are you seeing offered for download there? Yeah it’d be better to use https since it lists some checksums, but it was last updated in 2018, and Debian packages are verified anyway.
      - matrss 3y ago
        It contains a http link to "ssss-0.5.tar.gz", which I would assume is meant to be a source code archive. That really looks suspicious.
        thinkmassive 3y ago
        My apologies, I didn’t realize those were links. Hopefully anyone interested for more than academic reasons does their research on the range of solutions more widely available.
        matrss 3y ago
        To be fair, the color is misleading. I associate red text with dead links and that is the only reason I checked what they point at.
    - ficklepickle 3y ago
      It serves the cert for 0pointer.net, which is served from the same IP. I think it is more likely to be a poorly configured personal site than something nefarious. If you are concerned, 0pointer.net has contact info.

Which password manager are you using? There shouldn’t be any sharing of a master password; each individual should have their own account and own master password.

ameliaquining 3y ago

I think the question is how to handle something like an AWS root password, which doesn't conceptually belong to a single individual and which isn't feasible to entirely eliminate from the system.

xeromal 3y ago
This is what I had in mind too!
sjm-lbm 3y ago
At a business roughly the size of the one OP is talking about, we shared the password with a small group of people and kept a hardware two factor authentication device locked behind a door accessible only to a different small group of people. The basic idea is that you'd need both someone with the password (usually technical leads) and someone with access to a secret spot in the office (generally someone in finance/accounting) to log in, and locking anyone out of the office would instantly ensure they had no access. I don't think a solution like this works directly for the specific situation that OP describes, but I do think it's a good solution for an AWS root account at an organization of the size he is talking about.
ziddoap 3y ago
I think the answer above still stands. Put it in a shared vault which can be accessed by however many people require it. They access the shared vault via their own password manager account.
fragmede 3y ago
With advanced/power user AWS IAM roles, it's feasible to eliminate it for day to day uses, meaning that you can have it so only one or two people you trust actually have access to the root creds, and everyone else can go about their business. Shamir's Secret Sharing software, ssss, will let you encrypt a file and split it into pieces so that 3 of 5 people are needed to decrypt. http://point-at-infinity.org/ssss/ http://point-at-infinity.org/ssss/
- lsedgwick 3y ago
  Either the site really doesn't support https (odd, since it is the very page that supplies the verification hashes!) or something more scary is actually happening and it's getting universally man-in-the-middled, which feels plausible for a site that offers cryptographic tools for download.
  - thinkmassive 3y ago
    What tools are you seeing offered for download there? Yeah it’d be better to use https since it lists some checksums, but it was last updated in 2018, and Debian packages are verified anyway.
    - matrss 3y ago
      It contains a http link to "ssss-0.5.tar.gz", which I would assume is meant to be a source code archive. That really looks suspicious.
      - thinkmassive 3y ago
        My apologies, I didn’t realize those were links. Hopefully anyone interested for more than academic reasons does their research on the range of solutions more widely available.
        matrss 3y ago
        To be fair, the color is misleading. I associate red text with dead links and that is the only reason I checked what they point at.
  - ficklepickle 3y ago
    It serves the cert for 0pointer.net, which is served from the same IP. I think it is more likely to be a poorly configured personal site than something nefarious. If you are concerned, 0pointer.net has contact info.