1

Please bear with me, I'm a total newbie about security.

I work in a company whose main goal is to maximize profits and use free stuff as much as possible. It's effect is that we use tons of freeware web apps that helps us the production with the efficiency.

Also with regards to reports, we mostly use excel to pass around information or dashboards.

Couple of months ago, the company needed to adhere to data privacy act which required everything to be password protected which scopes the excel files.

Now, everyone keeps forgetting their passwords. So a solution was raised, to create a system that centralizes all the passwords of a certain group. Basically it's a notepad containing all the passwords of a team for their reports.

Is this even a good idea?

From a developer POV, there should be systems that helps people do their stuff not using excels and SSO must be implemented but since the company won't provide budget for technology we are in this situation.

  • 5
    How about introducing password managers? You can have Keepass (keepass.info) with a store on a per group file store, then they need to remember one password, which gives access to all others they might need. Free, no additional development requirement... – Matthew May 9 at 8:15
  • 3
    Protecting data with passwords and making those passwords available to everyone renders the protection useless. I'm not a lawyer, but I doubt that you would still be compliant with the data privacy act if you share the passwords with everybody. – A. Hersean May 9 at 8:33
  • 2
    Hello niccolo and welcome to StackExchange. I see a bit of a discrepancy between the title and the body of the question. The title asks if "Creating a system to store passwords" is advisable (it is), while the body asks if storing passwords in plain text is a bad idea (it is). Please edit your question to bring more clarity to the situation. – MechMK1 May 9 at 12:35
  • Hi MechMK, I am actually being tasked to create a system/web app to store passwords. I was just comparing it to an online notepad since basically it will function like a notepad which is web based and only accessible to a certain group. sorry for the confusion. – niccolo m. May 10 at 2:06
  • @A.Hersean yes definitely true. The ideal solution would be to move information online, but due to lack of resource we have to do patch up solutions for now. – niccolo m. May 10 at 2:08
5

You are right in suspicion that storing all passwords in unencrypted notepad file is a bad idea.

Good news is, systems you seek exist and they are called password managers.

Password managers store passwords in secure way. They make you remember only login and a master password that gives you access to all the rest.


For your case I'd recommend KeePass. It's open source, free and tested by various security audits.

In company I work for we use KeePassXC, because it's open source, works on windows aswell as linux and supports browser addons that ease access (we use KeePassHelper addon). The addon we use provides 'bonus' layer of defense against phishing sites - as it displays something along like "domain unknown" (which I cannot emphasize enough how helpful it is in my company).

KeePassXC also supports synchronization across devices and can use iCloud, Google Drive or Dropbox as cloud service for password database - but please note that this doesn't mean you share your passwords with Google, Apple or w/e as the the password database is heavily encrypted.

KeePass also has android and iOS apps but since I don't use them, I don't really know how they operate.


Please note that there are other password managers like 1Password, LastPass and recently widely advertised Dashlane. Some of them offer bonus paid features (like synchronization across devices in their cloud) so make research what would suit your company the most.

  • While recommending keepass for storing password is definitely a good thing and while it can effectively be used for managing team passwords, you're failing to address the primary issue raised by the OP: is having a (set of) common password for controlling access to a shared resource advisable (it is usually not) – Stephane May 9 at 12:50
2

I'll address your question in two parts.

Are password the proper way to protect a data set

Shared access is actually a terrible a way to control access to a resource: they do not actually identify anyone or even verify that the access is really legitimate. This means that:

  • They cannot be used for auditing.
  • The only way to revoke access is to change the credentials for everyone.
  • If the access is revoked, it is revoked for everyone (for instance, if anyone enters the wrong password too many time on a system that has an account lockout policy, nobody can access the system anymore).

This means that, in most cases, you should shy away from sharing passwords between team members and that this practice is usually incompatible with regulatory framework related to personal data protection (at least every one that require an audit log to be maintained).

How to store shared passwords (when you have to)

First, the obvious: don't use anything cleartext, don't use anything that does not provide a very easy way to generate strong passwords, don't use anything that implements a robust data protection in the first place. This means always use a password manager. Really, there is no excuse whatsoever not to do so.

Ideally, every user should have a personal password for every resource but, in practice, this is not always possible. Often, you will need to have access to system that do not let you handle your access accounts the way you want (create user accounts and delegate their rights yourself). You will also need some way to save passwords for shared accounts (service accounts, for instance) or encryption password for data,

In such a case, you should always use a dedicated password management product.

Offline tools (like keepass) can fit the bill but you need to be aware of the risk: once you grant access to someone, you can't easily revoke it: changing the password database access key is not enough sine everyone might have made a copy so you are left with no choice but change ALL the passwords that were stored in the DB.

If an offline database does not offer sufficient granularity, then you can fallback to a team password manager. These products usually store all password database on a central server and let administrators grant access to each individual password to a user or group of user. This can provide a good granularity for access control.

In all case, however, you need to keep in mind that once access to a shared password has been granted to someone, the ONLY way to revoke that access is to 1/ revoke access to the password storage (by changing the master password, for instance) AND changing the password itself.

  • Btw. some password managers allow easy password sharing. E.g. lastpass.com/team-password-manager – domen May 9 at 13:32
  • Every password manager solution has it's own set of capabilities. It does not really change much, however, regarding the basic issue with shared passwords – Stephane May 9 at 13:41
  • I agree, I'm just commenting on second half of your answer - some tools are designed for that. – domen May 9 at 13:55
1

Oops... As per my understanding a password is a secret, and a secret that is shared among more that 2 actors(1) is no longer a secret. Password vaults are indeed nice tools, provided they contain passwords belonging to one single user. A file containing password shared by various users is, er..., a bad idea (my first word was stronger than that...).

The correct way is to forget the internal encryption provided by Word or Excel, for any file that has to live on a shared folder. The security must be provided at the shared folder (or file) access level. Any decent OS provides ways to do that properly, with access auditing to know who accessed what and at what time. This is much better than a shared password on an Excel file...

If you really need to have at rest encryption, you should try to find a system based on asymetric crypto: the file is encrypted with a symetric (random) key, and that key is encrypted with the public keys of any user allowed to read it. That is the way MIME encoded mails work. Unsure whether a freeware easy solution already exists, but it is easy to build manual (and later automated) procedures based on openssl.


(1) Outside of the IT world the 2 actors are 2 human beings. When it comes to IT security, one actor is a person and the other actor is the system or application that will grant of refuse access. And the most common use case is that the secret is only known by one single actor, the other one has only ways (hash or public key) to validate the secret knowledge.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.