Information Security Stack Exchange is a question and answer site for information security professionals. It only takes a minute to sign up.
Sign up to join this community
My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit?
The Confluence page is limited so that only the sysop team can access it, so what's the difference with a password manager? They need to use a password to login into their Confluence account and therefore, for accessing the passwords. If they were using a password manager, they would need a password to unlock it.
There are significant differences, both concrete and general, between the security provided by Confluence and a good password manager.
One specific problem is that Confluence doesn't encrypt data at rest. This means that someone with physical access to the disk can access the passwords. Even if you encrypt the disk, someone who gets access to the disk once the computer has booted (eg: via incorrectly configured remote disk access, or running a process on the server), can read the clear-text passwords.
Confluence also has many configuration settings that combine to grant or deny access to resources. Incorrectly setting these may lead to users unintentionally getting access to data.
Confluence also doesn't support common password manager features such as short authentication time-outs and masking passwords. The former is important because passwords are considered too critical to be trusted to the authentication of a computer or web portal such as Confluence. Masking passwords is important to prevent shoulder surfing which, in the case of a list of passwords in a table on a wiki page, seems a serious concern.
More generally, Confluence is a large and complex app that is written with the goal of sharing data. Password managers are very targeted apps that are written with the goal of securing data. As such, they are likely to have had more security-focused testing and code reviews, been written by more security-aware engineers, and to have been subjected to more security abuse by users. All of this leads to password managers being less likely to have vulnerabilities.
password, then I don't think that Confluence is a good store. That said, specific threats would need to be taken into account to do a full evaluation. That sounds like a separate question, one that may be too complex for StackExchange.
Jun 19, 2019 at 14:41
Most password managers use encryption to protect the data at rest, Confluence most likely won't. Whether this matters or not would depend on who has access to the Confluence database.
