3 ms·

Lots of people suggest 1Password, and it works really well for larger or more disperse groups needing some shared vault capability, and perhaps those that want

Lots of people suggest 1Password, and it works really well for larger or more disperse groups needing some shared vault capability, and perhaps those that want a more visual-driven web interface. Keep in mind there is the per-seat pricing for that. What has also worked really well in the past for me and my teams, especially if they are more technical and these credentials really never need to go beyond this more technical team is setting up a single 'vault' encrypted with GPG. Each team member then gets the vault re-encrypted for them, adding them to the recipient list. While this takes a little bit of effort to get a workflow going, it keeps it out of a cloud service, if you're concerned about that, and you get to pass it around just like any other file. When someone leaves, or no longer needs access, their recipient is removed and then the file recommitted and redistributed. In the past I've had the ASCII-armored file committed in git and people just pull down a tools repo every so often. If you are wanting to store credentials for, say, public cloud services, don't. Use roles as much as possible, don't pass around passwords, don't bother setting up individual users beyond those required to bind a role to it, grant only by roles as much as possible.

Xylakant 2y ago
We uses D the same approach for a while. Pass/gopass will do that for you. However, the downside here is that it quickly gets unwieldy as you’ll end up with a relatively large vaults. And you can’t really remove people, they can always keep and decrypt old versions of the vault, that means that you do have to rotate all of the secrets in that vault manually if someone leaves. And then, there’s also the support cost for non-tech people. GPG on windows is a particular pain. You’ll have a similar effect in all password storage solutions, but since adding/removing people from vaults is much simpler, you end up with smaller, more fine-grained vaults and less secrets to rotate. Also, SSO, SCIM, tying the password management into a proper group/authentication system will help.
- pxc 2y ago
  > And you can’t really remove people, they can always keep and decrypt old versions of the vault, that means that you do have to rotate all of the secrets in that vault manually if someone leaves. And then, there’s also the support cost for non-tech people. GPG on windows is a particular pain. In a way doesn't this just more directly reflect the reality that anyone you've ever given access to a password may have made a private copy of it? It's not actually safe to leave passwords unrotated when someone who had access to them leaves.
  - Xylakant 2y ago
    Absolutely. My point is that pass/gopass in practice lead to larger vaults, so.you need to rotate more passwords. And more advanced password managers offer assistance for that task, which the more basic ones do not.
bootloop 2y ago
I use a similar flow with the technical team to avoid unencrypted credentials in SCM. The vault (or other secrets) are encrypted with a common passphrase and then only this passphrase is whats encrypted with GPG for multiple recipients.

Xylakant 2y ago

We uses D the same approach for a while. Pass/gopass will do that for you. However, the downside here is that it quickly gets unwieldy as you’ll end up with a relatively large vaults. And you can’t really remove people, they can always keep and decrypt old versions of the vault, that means that you do have to rotate all of the secrets in that vault manually if someone leaves. And then, there’s also the support cost for non-tech people. GPG on windows is a particular pain. You’ll have a similar effect in all password storage solutions, but since adding/removing people from vaults is much simpler, you end up with smaller, more fine-grained vaults and less secrets to rotate. Also, SSO, SCIM, tying the password management into a proper group/authentication system will help.

pxc 2y ago
> And you can’t really remove people, they can always keep and decrypt old versions of the vault, that means that you do have to rotate all of the secrets in that vault manually if someone leaves. And then, there’s also the support cost for non-tech people. GPG on windows is a particular pain. In a way doesn't this just more directly reflect the reality that anyone you've ever given access to a password may have made a private copy of it? It's not actually safe to leave passwords unrotated when someone who had access to them leaves.
- Xylakant 2y ago
  Absolutely. My point is that pass/gopass in practice lead to larger vaults, so.you need to rotate more passwords. And more advanced password managers offer assistance for that task, which the more basic ones do not.

bootloop 2y ago

I use a similar flow with the technical team to avoid unencrypted credentials in SCM. The vault (or other secrets) are encrypted with a common passphrase and then only this passphrase is whats encrypted with GPG for multiple recipients.