3 ms·
Use 1password (or similar) so there is no master password? You can have 2 trusted people be administrators of the 1P account. Then you create a shared vault fo
by ShakataGaNai 3y ago
Use 1password (or similar) so there is no master password?
You can have 2 trusted people be administrators of the 1P account. Then you create a shared vault for anyone who needs access to the master credentials and store them all in said shared vault. You can have multiple vaults with multiple different sets of credentials and access (Ex a vault for HR is going to have different creds and people than a vault for DevOps). Note: The list of administrators and the list of people with access to the shared vault doesn't need to be the same people.
If someone who's in the trust circle quits or gets fired, you have someone else remove their access (just like any other offboarding) and go change the applicable credentials.
As for insider threat, there isn't a lot you can do if you give someone access to the credentials. For the admin, that should be easy - certainly, you can find 2 people in an organization who can be trusted implicitly (even if one of them is required to be the CEO/founder). If you're worried that someone is going to go rogue, then don't give them access to the information in the first place.
There is some stuff that just doesn't need to be broadly shared...lets say master passwords for AWS accounts. Really very very very few people will ever need those - mostly for "Break glass in case of emergency" purposes, right? So your Director of DevOps has access and maybe one other person. If you can't trust that Director of DevOps to have those credentials.... well honestly your organization has bigger issues.
- redder23 3y agoWhy would you suggest 1password on any other shitty proprietary crap. Use Bitwarden, its Open Source you can self host it inside the company if you want ... and if they every do something (shady) you do not like you can switch to a fork that will instantly pop up as soon as that happens.
- aeries 3y agoCan we please keep these low-effort flames off of Hacker News? 1password is clearly offering value to somebody, as they have millions of users. Feel free to criticize it, but at least give specifics.
- redder23 3y ago[flagged]
- aerojoe23 3y agoGood point about Bitwarden, and the more we can convert the better. I think we can catch more fly's with honey than vinegar. What do you think about trying something like, "Good points about using a password manager. I think Bitwarden is better than 1password becuase it: is open source, it can be self hosted, and you could switch to a fork if they get shady." Because you wouldn't be implicitly calling them ignorant this way, they're more likely to hear your message.
- solardev 3y ago> Use 1password (or similar) so there is no master password? Isn't there still a "Secret Key" that you have to keep somewhere? It's a long random string, too, so you can't easily memorize it. I always lose this and have to keep it somewhere super-unsafe... it's the weakest part of my security, ironically. https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- ahar083 3y agoEach user has their own secret key, so the above still applies (2 trusted users who are admins, each with their own unique 1Password enterprise login + password + secret key)