3 ms·

Question: has anybody actually worked in a password-less or even “zero trust” environment? Most environments I have worked with struggle with sharing passwords

by xyst 2y ago

Question: has anybody actually worked in a password-less or even “zero trust” environment? Most environments I have worked with struggle with sharing passwords like OP and it’s a massive pain. One time, dev team was sharing active directory credentials to access service. At some point service account gets locked because someone was using an older password of the account. Usually a quick problem to solve with 2-3 people in same region (or prevented entirely), but teams across time zones and countries (US vs Vietnam or India). It becomes painful. Doesn’t matter if they are “senior” or green/“junior” engineers. If I ever have my own company, I want my own internal IdP (identity provider) and all internal and external services integrated with it. Employees issued (multiple) physical hardware keys. This is required to authenticate with work computer and subsequent access to VPN/tail scale. Individual services and products must support oauth. Access to public cloud resources? AuthN through company IdP. Admin creates roles for you to access resources necessary for work Access to database? No shared passwords. get admin to add authorization, then authN via IdP and get access token Version control? Same as above. E-mail? Same as above. Company document repository? AuthN through IdP which requires physical security key. Access to company laptop/desktop? Plug-in security key. Permissions/roles managed remotely (give bob sys access for dev work but jenny from HR is given very basic system access). Then once you are done, then remove security key and all established sessions are removed and logged out of computer (or just locked). Employee leaves? Just disable the account. Maybe leave a small window of access to certain services (ie, email) so they could say their goodbyes, turn in company equipment. Then revoke access completely. Hostile or state actor obtained security key of active employee? From IdP, mass revoke all access. Can also track what actor accessed as well. With this, problem OP has proposed has disappeared completely.

wavemode 2y ago
This setup strongly describes how the process was inside Amazon.
jon-wood 2y ago
This setup is absolutely the ideal. Sadly it doesn’t often survive first contact with reality. Bob in sales will sign up for a tool that suddenly becomes load bearing, and it doesn’t support SSO without a 10x increase in the monthly fee. A million dollar client needs you to integrate with one of their services which only supports a single shared API key. And so on. You also have to consider whether doing the heavy lifting required to get to this point is really the highest priority for your one man company which is yet to make a single penny and has no customers. What you describe is certainly much easier to implement early on when you’re not dealing with a ton of legacy services, but it will still probably take a few weeks of work to make it reliable for everything.

by xyst 2y ago

wavemode 2y ago

This setup strongly describes how the process was inside Amazon.

jon-wood 2y ago

This setup is absolutely the ideal. Sadly it doesn’t often survive first contact with reality. Bob in sales will sign up for a tool that suddenly becomes load bearing, and it doesn’t support SSO without a 10x increase in the monthly fee. A million dollar client needs you to integrate with one of their services which only supports a single shared API key. And so on. You also have to consider whether doing the heavy lifting required to get to this point is really the highest priority for your one man company which is yet to make a single penny and has no customers. What you describe is certainly much easier to implement early on when you’re not dealing with a ton of legacy services, but it will still probably take a few weeks of work to make it reliable for everything.