6 ms·

Meldium (YC W13) Controls Your Team’s Shared App Passwords For You

108 points by bradleybuda 14y ago

signed0 14y ago
I almost thought this was related to medium.com. I wish they would have compared this to other existing products such as LastPass instead of comparing it to an excel spreadsheet.
jasonostrander 14y ago
This looks fantastic. It sounds like it uses a similar setup as Lastpass, but with a service for startups to manage accounts. They should offer a free tier for end users to store and manage passwords ala Lastpass, and then keep the team focused features as a premium upgrade.
- bradleybuda 14y ago
  Thanks for the suggestion Jason. Our free tier actually covers up to five users, so it works great for both individuals and small teams. We knew that Meldium would be useful for large companies, but we've been surprised to learn that even very small teams love it too.
nopassrecover 14y ago
Couldn't you just set up an account on LastPass or OneLogin and share access to that account?
- tlrobinson 14y ago
  "The second is a split infrastructure security system, which lets key data such as passwords be entered in by an admin and used for login purposes, but not extracted back out by rank and file users. “With this cryptography, the only thing that can come back out is the logged in account, not the credentials themselves,” Buda says."
  - nopassrecover 14y ago
    Which sounds like OneLogin (unless I'm recalling wrong), one of the options I suggested.
- bradleybuda 14y ago
  We think of Meldium as a tool for sharing accounts, not for just sharing passwords. While there are a lot of password managers out there, none of them are built for teams first. Meldium's browser extension makes passwords go away completely - they are never echoed or revealed to your teammates. We wanted to build a product that has geek-level security but also fantastic UX for end users of any technical sophistication.
  - subsection1h 14y ago
    We think of Meldium as a tool for sharing accounts, not for just sharing passwords. Meldium seems to be a tool for sharing web app accounts. Some of the accounts my team shares aren't for web apps. While there are a lot of password managers out there, none of them are built for teams first. What about Passpack, which is what my team uses? Passpack has worked well for us, but I'm interested in alternatives because Passpack doesn't seem to be actively developed (bugs I reported months ago haven't been fixed and Passpack's blog is rarely updated).
- WadeF 14y ago
  LastPass enterprise is pretty janky. I'd love to switch our team over to a better working version of LastPass enterprise.
- headbiznatch 14y ago
  I second the bizarre unfriendliness of LastPass enterprise. I have recently been using PassPack (https://www.passpack.com/ https://www.passpack.com/) which has a decent pricing model and a fairly sensible sharing workflow. Browser integration is only bookmarklets and not as strong as LastPass's browser extensions, but for small group password sharing, it's been convenient enough so far.
harryh 14y ago
How does it actually work? How can it fill out a password form field for me, but make it so I can't find out the password? Can't I just sniff what my browser sends to the server? I'm suspicious. This is a real problem though. PS: You might want to reconsider that name. Meldium, to me at least, just looks like someone typoed when trying to type Medium.
- harryh 14y ago
  To make this more clear, here is the Network tab under Developer Tools when I log into twitter: http://cl.ly/image/3f3x3R0N0y2W http://cl.ly/image/3f3x3R0N0y2W If I had actually logged in you would see my password in the space that currently says NotActuallyMyPassword. I don't see how Meldium could prevent that.
  - soumyadeb 14y ago
    This can be done using SSL proxying. You can run a proxy server and send the HTTP login POST request (with a fake password) through the proxy server. The proxy server can in turn replace the fake password with the actual password and forward the POST request to the end website. It is also possible to run the proxy server on the end user machine and use a mechanism called SSL tunneling to securely replace the password. Its hard to explain it here but it can be done. The benefit of running the proxy on the end user machine is that you don't have to route your traffic through a remote proxy. I have a system which has this thing working - will open-source it under github soon.
    - stanleydrew 14y ago
      I doubt it's a local proxy since it's a Chrome/FF extension. Or maybe I've not kept up with the state of Chrome/FF extension development and it is completely possible to write a proxy that runs within the browser.
      - Hello71 14y ago
        Extensions don't proxy anything. They do, however, have access to everything you do (type, click, etc) and everything you can see. (i.e. close enough)
MattRogish 14y ago
This is really cool. We use 1password with the 1pass file stored in a Team dropbox, but 1pass still doesn't have any group-facilities so we have to revoke/change passes by hand when someone leaves, etc. Very much looking forward to trying this out. One thing that groupware password things never remember is that folks like to use their personal services, too, and requiring multiple-accounts for personal stuff is not workable. Is there support for personal (e.g. private only to my login) accounts? That way, I could store all my stuff with a single browser plugin...
- bradleybuda 14y ago
  Yes - by default your logins are only available to you, and they are only shared with the individuals that you explicitly add. We definitely want folks to be using the same tool for both team and individual passwords.
barrydahlberg 14y ago
This looks great and is close to something I've specifically looked for in the past. My only suggestion would be that the pricing is going to be awkward for my use case. Typically we work with many small clients and one of our issues is managing access to admin sites etc for these clients across our team. We have relatively few 'users', perhaps 5 - 10, but a large amount of shared apps. I currently have around 100 sets of login details on file in 1Password.
dannygarcia 14y ago
Wow this is great! It would be nice to see Facebook as a supported app since it's useful for dev teams.
- bradleybuda 14y ago
  Great suggestions - we'll have it soon. If you'd like to suggest apps, hit our UserVoice at http://support.meldium.com/ http://support.meldium.com/ - we use that to decide what to build next.
jameshart 14y ago
Sharing an account is a breach of terms of service on most of the services where this system would be used. It's really not clear to me whether every supported service has actually opted in to being handled by Meldium, or if it's something driven by clients, or even simply set up by end users. I could imagine a SaaS vendor might not be very happy with someone providing tools to help users get around their per-seat licensing model by automating account sharing...
- bradleybuda 14y ago
  We're not looking to help anyone evade a vendor's pricing model. The unfortunate reality is that many services do not support multiple user accounts, and customers have no choice but to share. For services that do support many users, we have deep integration that actually creates individual accounts for every new employee you hire. We have almost 20 of these services integrated now and we're always looking to add more. We've had the opportunity to talk to many service vendors in the process of building Meldium and the response has been overwhelmingly positive. With provisioning integrated, Meldium removes one of the barriers to service adoption - it makes it easy for a company to add more accounts when the hire more people, and service vendors love this. We're always looking for tighter and higher-quality integrations with vendors - if you run a SaaS app and you'd like to see it supported on Meldium, ping me at brad@meldium.com and we'll find a way to make it happen.
  - jameshart 14y ago
    Thanks.. but you still didn't make it clear whether Meldium always works with the service-provider's co-operation and authorization, or whether you support account-sharing for services your customers want to use, without the vendor's explicit permission.
    - dotBen 14y ago
      Come on, one would assume they would let you share a password even if it is "without the vendor's explicit permission". Who's the customer here?
philfreo 14y ago
Looks cool, but I wish 1Password would add a simple password sharing feature.
JoeH 14y ago
I was initially very excited by this as I skipped over the part where it was "Shared App Passwords". I'm currently using 1Password and sharing the password file via a dropbox account, however, as I look into the details, it appears Meldium would only work for a portion of what we use 1Password for. I need a solution like this, but allows the storage and potential sharing of other types of passwords not associated with a specific website or service (server passwords, door codes, etc) That being said, it looks like a great start!
- borisjabes 14y ago
  We definitely agree that this can apply to more than just apps and we may extend to more kinds of data over time. We just opted to focus on apps for this first release.
kuahyeow 14y ago
It's 2013, sharing passwords is so insecure. Things like OAuth should be used. I wouldn't be secured if they move towards something like http://www.okta.com/what-we-do/single-sign-on.html http://www.okta.com/what-we-do/single-sign-on.html
stanleydrew 14y ago
Don't most of the services listed in the article already have multiple user accounts? Github, Salesforce, Box, Google Apps, WordPress. These all support using multiple accounts right?
- bradleybuda 14y ago
  The article doesn't really make it clear, but for each of those services we support (and prefer) multiple accounts. They can be connected under the "Team Services" link in the tool.
100k 14y ago
I have been waiting for 1Password to add some kind of team feature for years. Even if it was as simple as adding an additional password file with a different unlock password, I would use that in a heartbeat. They've really left themselves open to competition. Good luck to Meldium taking them on.
WestCoastJustin 14y ago
Scary as hell. Download password safe and keep your crown jewels at home! I don't care if users never see the password or if they are encrypted on their side. Giving your Twitter, Github, or AWS?! keys to someone else. Jesus, this is the wrong idea and anyone who gets burned deserves it! This speaks to a wider trend of turning your business information over to other people. Your internal helpdesk, mail, wiki pages, your source code, and now your passwords?! Come on. A rouge employee and you are fucked! It would be interesting to see what they offer if someone exposed their database and caused your financial ruin?
- josephlord 14y ago
  Don't worry about the rouge employees it is easy to spot the red ones, it is the rogues that you need to worry about! But I fundamentally agree, you need to consider that in many cases you are not just subject to your own risks and threats (internal and external) but each of your suppliers (and their suppliers such as Heroku and AWS) and their internal and external risks added to yours.
tlogan 14y ago
We actually made some hack with 1Password and Dropbox. I still wonder why 1Password does not do something like this. It should be easy to do.
727374 14y ago
I'm not terribly worried about ex-team members improperly accessing accounts and the like. There are pretty powerful legal deterrents in place to prevent this not to mention that I believe our team is trustworthy. Plus, common sense dictates that we only give super sensitive account credentials to a couple people. On the other hand, I'm terrified of giving my account info to a 3rd party. Seems like the sweetest hacker target ever.

108 points by bradleybuda 14y ago

I almost thought this was related to medium.com. I wish they would have compared this to other existing products such as LastPass instead of comparing it to an excel spreadsheet.

jasonostrander 14y ago

This looks fantastic. It sounds like it uses a similar setup as Lastpass, but with a service for startups to manage accounts. They should offer a free tier for end users to store and manage passwords ala Lastpass, and then keep the team focused features as a premium upgrade.

bradleybuda 14y ago
Thanks for the suggestion Jason. Our free tier actually covers up to five users, so it works great for both individuals and small teams. We knew that Meldium would be useful for large companies, but we've been surprised to learn that even very small teams love it too.

nopassrecover 14y ago

Couldn't you just set up an account on LastPass or OneLogin and share access to that account?

tlrobinson 14y ago
"The second is a split infrastructure security system, which lets key data such as passwords be entered in by an admin and used for login purposes, but not extracted back out by rank and file users. “With this cryptography, the only thing that can come back out is the logged in account, not the credentials themselves,” Buda says."
- nopassrecover 14y ago
  Which sounds like OneLogin (unless I'm recalling wrong), one of the options I suggested.
bradleybuda 14y ago
We think of Meldium as a tool for sharing accounts, not for just sharing passwords. While there are a lot of password managers out there, none of them are built for teams first. Meldium's browser extension makes passwords go away completely - they are never echoed or revealed to your teammates. We wanted to build a product that has geek-level security but also fantastic UX for end users of any technical sophistication.
- subsection1h 14y ago
  We think of Meldium as a tool for sharing accounts, not for just sharing passwords. Meldium seems to be a tool for sharing web app accounts. Some of the accounts my team shares aren't for web apps. While there are a lot of password managers out there, none of them are built for teams first. What about Passpack, which is what my team uses? Passpack has worked well for us, but I'm interested in alternatives because Passpack doesn't seem to be actively developed (bugs I reported months ago haven't been fixed and Passpack's blog is rarely updated).
WadeF 14y ago
LastPass enterprise is pretty janky. I'd love to switch our team over to a better working version of LastPass enterprise.
headbiznatch 14y ago
I second the bizarre unfriendliness of LastPass enterprise. I have recently been using PassPack (https://www.passpack.com/ https://www.passpack.com/) which has a decent pricing model and a fairly sensible sharing workflow. Browser integration is only bookmarklets and not as strong as LastPass's browser extensions, but for small group password sharing, it's been convenient enough so far.

harryh 14y ago

How does it actually work? How can it fill out a password form field for me, but make it so I can't find out the password? Can't I just sniff what my browser sends to the server? I'm suspicious. This is a real problem though. PS: You might want to reconsider that name. Meldium, to me at least, just looks like someone typoed when trying to type Medium.

harryh 14y ago
To make this more clear, here is the Network tab under Developer Tools when I log into twitter: http://cl.ly/image/3f3x3R0N0y2W http://cl.ly/image/3f3x3R0N0y2W If I had actually logged in you would see my password in the space that currently says NotActuallyMyPassword. I don't see how Meldium could prevent that.
- soumyadeb 14y ago
  This can be done using SSL proxying. You can run a proxy server and send the HTTP login POST request (with a fake password) through the proxy server. The proxy server can in turn replace the fake password with the actual password and forward the POST request to the end website. It is also possible to run the proxy server on the end user machine and use a mechanism called SSL tunneling to securely replace the password. Its hard to explain it here but it can be done. The benefit of running the proxy on the end user machine is that you don't have to route your traffic through a remote proxy. I have a system which has this thing working - will open-source it under github soon.
  - stanleydrew 14y ago
    I doubt it's a local proxy since it's a Chrome/FF extension. Or maybe I've not kept up with the state of Chrome/FF extension development and it is completely possible to write a proxy that runs within the browser.
    - Hello71 14y ago
      Extensions don't proxy anything. They do, however, have access to everything you do (type, click, etc) and everything you can see. (i.e. close enough)

MattRogish 14y ago

This is really cool. We use 1password with the 1pass file stored in a Team dropbox, but 1pass still doesn't have any group-facilities so we have to revoke/change passes by hand when someone leaves, etc. Very much looking forward to trying this out. One thing that groupware password things never remember is that folks like to use their personal services, too, and requiring multiple-accounts for personal stuff is not workable. Is there support for personal (e.g. private only to my login) accounts? That way, I could store all my stuff with a single browser plugin...

bradleybuda 14y ago
Yes - by default your logins are only available to you, and they are only shared with the individuals that you explicitly add. We definitely want folks to be using the same tool for both team and individual passwords.

barrydahlberg 14y ago

This looks great and is close to something I've specifically looked for in the past. My only suggestion would be that the pricing is going to be awkward for my use case. Typically we work with many small clients and one of our issues is managing access to admin sites etc for these clients across our team. We have relatively few 'users', perhaps 5 - 10, but a large amount of shared apps. I currently have around 100 sets of login details on file in 1Password.

dannygarcia 14y ago

Wow this is great! It would be nice to see Facebook as a supported app since it's useful for dev teams.

bradleybuda 14y ago
Great suggestions - we'll have it soon. If you'd like to suggest apps, hit our UserVoice at http://support.meldium.com/ http://support.meldium.com/ - we use that to decide what to build next.

jameshart 14y ago

Sharing an account is a breach of terms of service on most of the services where this system would be used. It's really not clear to me whether every supported service has actually opted in to being handled by Meldium, or if it's something driven by clients, or even simply set up by end users. I could imagine a SaaS vendor might not be very happy with someone providing tools to help users get around their per-seat licensing model by automating account sharing...

bradleybuda 14y ago
We're not looking to help anyone evade a vendor's pricing model. The unfortunate reality is that many services do not support multiple user accounts, and customers have no choice but to share. For services that do support many users, we have deep integration that actually creates individual accounts for every new employee you hire. We have almost 20 of these services integrated now and we're always looking to add more. We've had the opportunity to talk to many service vendors in the process of building Meldium and the response has been overwhelmingly positive. With provisioning integrated, Meldium removes one of the barriers to service adoption - it makes it easy for a company to add more accounts when the hire more people, and service vendors love this. We're always looking for tighter and higher-quality integrations with vendors - if you run a SaaS app and you'd like to see it supported on Meldium, ping me at brad@meldium.com and we'll find a way to make it happen.
- jameshart 14y ago
  Thanks.. but you still didn't make it clear whether Meldium always works with the service-provider's co-operation and authorization, or whether you support account-sharing for services your customers want to use, without the vendor's explicit permission.
  - dotBen 14y ago
    Come on, one would assume they would let you share a password even if it is "without the vendor's explicit permission". Who's the customer here?

philfreo 14y ago

Looks cool, but I wish 1Password would add a simple password sharing feature.

JoeH 14y ago

I was initially very excited by this as I skipped over the part where it was "Shared App Passwords". I'm currently using 1Password and sharing the password file via a dropbox account, however, as I look into the details, it appears Meldium would only work for a portion of what we use 1Password for. I need a solution like this, but allows the storage and potential sharing of other types of passwords not associated with a specific website or service (server passwords, door codes, etc) That being said, it looks like a great start!

borisjabes 14y ago
We definitely agree that this can apply to more than just apps and we may extend to more kinds of data over time. We just opted to focus on apps for this first release.

kuahyeow 14y ago

It's 2013, sharing passwords is so insecure. Things like OAuth should be used. I wouldn't be secured if they move towards something like http://www.okta.com/what-we-do/single-sign-on.html http://www.okta.com/what-we-do/single-sign-on.html

stanleydrew 14y ago

Don't most of the services listed in the article already have multiple user accounts? Github, Salesforce, Box, Google Apps, WordPress. These all support using multiple accounts right?

bradleybuda 14y ago
The article doesn't really make it clear, but for each of those services we support (and prefer) multiple accounts. They can be connected under the "Team Services" link in the tool.

100k 14y ago

I have been waiting for 1Password to add some kind of team feature for years. Even if it was as simple as adding an additional password file with a different unlock password, I would use that in a heartbeat. They've really left themselves open to competition. Good luck to Meldium taking them on.

WestCoastJustin 14y ago

Scary as hell. Download password safe and keep your crown jewels at home! I don't care if users never see the password or if they are encrypted on their side. Giving your Twitter, Github, or AWS?! keys to someone else. Jesus, this is the wrong idea and anyone who gets burned deserves it! This speaks to a wider trend of turning your business information over to other people. Your internal helpdesk, mail, wiki pages, your source code, and now your passwords?! Come on. A rouge employee and you are fucked! It would be interesting to see what they offer if someone exposed their database and caused your financial ruin?

josephlord 14y ago
Don't worry about the rouge employees it is easy to spot the red ones, it is the rogues that you need to worry about! But I fundamentally agree, you need to consider that in many cases you are not just subject to your own risks and threats (internal and external) but each of your suppliers (and their suppliers such as Heroku and AWS) and their internal and external risks added to yours.

tlogan 14y ago

We actually made some hack with 1Password and Dropbox. I still wonder why 1Password does not do something like this. It should be easy to do.

727374 14y ago

I'm not terribly worried about ex-team members improperly accessing accounts and the like. There are pretty powerful legal deterrents in place to prevent this not to mention that I believe our team is trustworthy. Plus, common sense dictates that we only give super sensitive account credentials to a couple people. On the other hand, I'm terrified of giving my account info to a 3rd party. Seems like the sweetest hacker target ever.