Disclaimer: I've worked for large tech companies, and this answer is based on that. No company-specific or proprietary techniques are disclosed.
I bet Facebook, Google, Twitter and other super big tech companies don't use such third-party services for their internal passwords
Actually, at least some do use third-party password managers - for employees and non-critical services. By the nature of the business, employees often need to interact with third party websites (employee information management, travel booking, employee credit cards, ...). Note these are individual credentials - they authenticate a person, not a resource or process
The largest of the services will support SSO (single sign-on) provided by the company. SSO is a lot more secure, but not all vendors will support it.
Another adopted practice in most large tech companies is the use of security keys for two factor authentication using U2F/FIDO or more recently WebAuthn/FIDO2
TOTP ("Google Authenticator") is common too, but more vulnerable to MITM attacks.
Authenticating resources and processes
How can a very big company manage some of the world's most sensitive passwords? (example: Gmail team root access password!)
There's no such thing as the "gmail team root password". Its existence would be a huge threat to the privacy of user data - and by extension, to the company.
There's a subtle difference with your last case here. We're not authenticating people - we're authenticating resources and processes.
There's usually no need or benefit to use a password for those cases, but they're still used for convenience, ease of implementation, or because there's no other alternative.
Let's walk through some scenarios inspired in real-life examples at large tech companies:
The 8 digit pin to the safe containing the cable that connects you to the data center
This safe might or might not actually hold a cable
Here we're talking about a shared resource that is authenticated using a shared credential. There's no (easy) way of making it more secure by making it support individual credentials, or isolated access.
The best practice for this type of resource is:
- Secret sharing through a secure channel (such as a password manager)
- Secret access auditing (individuals are authenticated, and access to the secret is logged)
- Secret rotation - the secret is changed periodically
Of course, you will also find sub-par practices often!
Scenario 2 - The software process that stores user email
Would you trust this random piece of code to store your most intimate secrets?
This scenario is more complex. Here we have a process that needs to identify itself to other processes (such as a database, or a web server).
The best practices can include:
- No usage of passwords (or shared secrets) at all.
- Usage of short-lived authentication tokens, common in protocols like Kerberos
- Usage of key management platforms like Hashicorp Vault or AWS Key Management Services, which facilitate secret generation, rotation and authentication.
- Usage of Hardware Security Modules, ensuring that access to a physical device must occur for the process to perform its function
- Usage of code review protocols. This serves a dual purpose of access control and auditing, to ensure that no single person can gain control of the system
Worst practices include:
Scenario 3 - the worldwide admin group that can reboot all the servers
You know you have a problem when you need to explain to this many people not to press the red button
Here we have an action or task that can be performed by certain types of people.
The best practice is the usage of a proper Role-based access control (RBAC) system. These are often tailor-made, and vary from organization to organization. A primitive example is a UNIX group.
As in the "shared credential" example, auditing / logging is essential, and easier in this case, since the resource is electronic / software-based. Group membership can be freely given or taken, either by an administrator group (which is just another group!) or even by a quorum of members of the group itself
About the importance of processes vs tech
Are big companies known to use implementations of Shamir's Secret Sharing?
Kind of. Even in the realm of crypto-nerds conducting super-secure computation, you'll find that in practice human processes are often just as important as technical ones.