4

My SysOP team is using a page in Confluence for sharing the passwords of common accounts. I suggested them to use a password manager, but now thinking... is there any benefit?

The Confluence page is limited so that only the sysop team can access it, so what's the difference with a password manager? They need to use a password to login into their Confluence account and therefore, for accessing the passwords. If they were using a password manager, they would need a password to unlock it.

6

There are significant differences, both concrete and general, between the security provided by Confluence and a good password manager.

One specific problem is that Confluence doesn't encrypt data at rest. This means that someone with physical access to the disk can access the passwords. Even if you encrypt the disk, someone who gets access to the disk once the computer has booted (eg: via incorrectly configured remote disk access, or running a process on the server), can read the clear-text passwords.

Confluence also has many configuration settings that combine to grant or deny access to resources. Incorrectly setting these may lead to users unintentionally getting access to data.

Confluence also doesn't support common password manager features such as short authentication time-outs and masking passwords. The former is important because passwords are considered too critical to be trusted to the authentication of a computer or web portal such as Confluence. Masking passwords is important to prevent shoulder surfing which, in the case of a list of passwords in a table on a wiki page, seems a serious concern.

More generally, Confluence is a large and complex app that is written with the goal of sharing data. Password managers are very targeted apps that are written with the goal of securing data. As such, they are likely to have had more security-focused testing and code reviews, been written by more security-aware engineers, and to have been subjected to more security abuse by users. All of this leads to password managers being less likely to have vulnerabilities.

  • I have my own password manager for my personal accounts. However, the nature of the environment that I'm in at work, means that a 'normal' solution that works on the desktop is impossible, and there's little or no chance of it getting officially recognised. Further, if we consider it to be used for very narrow use cases - e.g. account details for shared team laptops (for non-forensic use), do you feel that it would be adequate for that? Merely to provide a central storage area for non-essential passwords that isn't a spreadsheet. – Ian Jun 18 at 8:09
  • @Ian - if you need a password that is more complex than password, then I don't think that Confluence is a good store. That said, specific threats would need to be taken into account to do a full evaluation. That sounds like a separate question, one that may be too complex for StackExchange. – Neil Smithline Jun 19 at 14:41
  • Hey @neil-smithline cheers for that. I pretty much came to that conclusion myself and in an effort to get some kind of resolution, have installed free dashlane on one of the shared laptops (where I do have admin and the env't isn't so closely controlled'. This will have to do until a more official; strategy is defined. – Ian Jun 20 at 9:25
1

Most password managers use encryption to protect the data at rest, Confluence most likely won't. Whether this matters or not would depend on who has access to the Confluence database.

1

We are aware of the needs of sharing passwords and confidential information in Confluence. Since it's a center of our team collaboration it would make sense to share information through Confluence. I'd recommend evaluating the Security & Encryption add-on which provides a macro to encrypt (with PGP) and store your passwords.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.