4 ms·
Passwords: We don't. Everything that could use a password is either keyed or certificate auth. Edit: I should add that there are things that use passwords but t
by aroch 12y ago
Passwords: We don't. Everything that could use a password is either keyed or certificate auth. Edit: I should add that there are things that use passwords but those are user-specific accounts or communal accounts (which are considered, essentially, public accounts) and are accessible only on the internal network. Users are responsible for the safe-keeping of those passwords and user accounts can do no harm, so to speak, if compromised.
Secrets: In a closed office, verbally.
- bjelkeman-again 12y agoDon't you have external services which use a password? DNS provider, VPS admin console for example?
- aroch 12y agoNot really, we have our own datacenter and DNS servers. We have HSMs for somethings (like CA certs) and yubikey/similar for things that require passwords but those are all protected by user-specific certificates.
- simonw 12y agoDo you have a company Twitter account?
- aroch 12y agoYes/no, one exists but its unrelated to my job. Its probably worth noting that we also have sets of accounts that while password protected are essentially considered public. Those accounts are accessible to anyone who knows the well-known standard passphrase
- deleted 12y ago[deleted]
- FireBeyond 12y agoIt kind of negates your first point. "Passwords? No. We don't. Everything is a certificate or key." ... "We have sets of accounts ... accessible to anyone who knows the well-known standard passphrase."
- aroch 12y agoAs a company "we" don't have passwords for our company infrastructure, individual users may have passwords for their accounts but those aren't secret/ as important. Its not practical to deploy PKI to and expect ~100K users to use it. As for communal accounts they're almost all for paying for services offered in-house by a group other than yours.