32

In $SomeCorpo there is a policy that passwords must never be stored anywhere else except employees' heads. Paper notes, password managers, storing passwords in browsers, etc, are all forbidden. To facilitate this they are even willing to relax a little bit password strength requirements, as long as the resultant passwords are memorable. Rationale is that storing a password anywhere except the person's head risks password leakage. However, passwords must still not be reused, requiring employees to memorize multiple passwords.

For multiple reasons password managers have, for a long time, been recommended to replace password memorization. The way I understand general recommendations is that the user should memorize one and only one password - namely the password guarding the PW manager - for which reason this password should be a long diceware passphrase, 7 words minimum. All other passwords must be randomly generated, utterly unmemorable and stored exclusively in the PW manager.

The above corporate policy is clearly contradictory to that general recommendation. However, that recommendation was crafted for regular people. Maybe corporations have different requirements?

Does it make sense to ban PW managers in corporate environments and insist that all passwords must be memorized?

5
  • 21
    It depends on the risk profile. But generally, these corporate policies that ban password managers a based on a misunderstanding and the risks around password managers
    – schroeder
    Commented Jun 17 at 14:20
  • 21
    There are even password managers specifically marketed for businesses which have features addressing specific business needs (like selected password sharing, centrally managed security settings, ...) Commented Jun 17 at 14:46
  • 10
    Why is $SomoCorpo not using SSO?
    – fdomn-m
    Commented Jun 18 at 7:46
  • 5
    I'll say it, It is ridiculous policy, most likely to cause people to make passwords less secure by writing them down, making them too easy, reusing them, and all the other bad things that people do. No one can remember 25 passwords much less 200 passwords, which many of us have these days.
    – user8356
    Commented Jun 18 at 20:24
  • 3
    @fdomn-m using SSO for everything is not possible and not reasonable. (one example that comes to mind: a development database credentials)
    – ave
    Commented Jun 19 at 12:56

5 Answers 5

61

The idea that storing passwords is inherently wrong and that employees should have to memorize them is just naive and detached from reality.

There's simply a limit to the number of random strings a person can remember, no matter how hard they try. At some point, it's necessary to think about realistic alternatives – like password managers. Of course password managers aren't perfect, and companies should have clear guidelines for which tools and features are acceptable (local or online, synchronization or no synchronization etc.). But an outright ban makes no sense.

A much better approach would be to distinguish between particularly critical passwords (which shouldn't be stored) and less critical passwords (which may be stored with a sufficiently complex master passwords). It can also be worthwhile to figure out why there are so many passwords, and if there's a way to implement better authentication mechanisms with hardware tokens (smartcards, FIDO2 keys etc.) or a Single Sign-On service.

8
  • 16
    I think Single Sign-On, in a corporate context, is the most important point. It would reduce the number of passwords to memorize to essentially just one -- for corporate reasons -- leaving the user free to use whichever password manager for passwords to non corporate services. Commented Jun 18 at 10:38
  • 7
    @MatthieuM. However that also means that there is only one password/system to be compromised. And it assumes that all relevant systems are compatible with SSO, which is err "Bold".
    – MikeB
    Commented Jun 18 at 15:06
  • 2
    A password manager can be thought of as a very basic, inefficient, federated SSO system. You sign on once to the password manager, then it signs you in to everything else. Commented Jun 18 at 16:08
  • 10
    Single sign-on cannot be applied to passwords for other organisations' websites, bug trackers, support systems and so on. I'm atypical, but I have have over a hundred such accounts on other companies systems (I port software to many operating systems). Fortunately, my employer hasn't tried to restrict password managers. Commented Jun 18 at 17:42
  • 1
    @marcelm Its less efficient/easy to use from the users point of view. They still have to manage the existence of multiple user names, generating passwords that are compliant with systems rules (not unusual to see 'complexity' requirements still), deal with multiple login screens, handle the case of being on a machine away from their password manager. All of these UX issues go away with a good SSO system. Commented Jun 19 at 14:27
14

In terms of security outcomes, there is nothing different between corporate and non-corporate environments here. Password managers lead to better outcomes than memorized passwords.

The reason $SomeCorpo has this policy might be that they have goals other than optimizing security outcomes.

It's often the case that they have regulatory or certification requirements that prescribe a specific approach to passwords. It is not uncommon for regulations and standards to be out-of-touch with the latest security practices, or for large organisations to work to older versions of standards until they are required to recertify to the latest standard.

1
  • The difference is that for a 'home user' that person has pretty much zero control over how authentication/authorisation is done. In a big Corp, there is at least some control, though typically not full control.
    – MikeB
    Commented Jun 18 at 15:08
5

The other answers are really good for the theory, practice, and rationale behind password managers. I'll just add that the Center for Internet Security, which publishes the CIS controls targeted at corporations, also states the following in their password policy guide (also targeting a corporate audience), section 5.2.3 on page 13 of the Optional Recommendations section:

Encouraging the use of an approved password manager lets users create strong passwords that are not reused on multiple systems.

A password manager is like a book of a user’s passwords, locked by a master key that only that user knows. On the surface that might sound bad. What if someone gets the user’s master password? That’s a reasonable fear; but assuming the user has chosen a strong, unique, and memorable master password they’re not using anywhere else, or better yet MFA, password managers are effective. Like anything else in IT security, passwords managers aren’t 100% fail safe, but they are a great alternative for users who need to manage multiple strong passwords for different accounts. It reduces reusing the same password for multiple accounts, storing passwords in plain text on their system, or writing them down and storing them in an unsecure location

In addition to password managers storing user passwords, they also help users create and save strong, unique passwords. This means whenever users go to a website or application, they can pull up their password manager, copy their password, paste it into the login box. Often, password managers come with browser extensions that can fill in a saved user’s password for them in a secure manner.

If a password manager (preferably one) is used, it is suggested that organizations restrict this to a small approved list of software that provide features the organization needs. This will make it easier to maintain the software (upgrades), patches, and track any published vulnerabilities and their mitigations.

Which answers "Yes" to the original question do "password managers also apply to corporate environments" question, approached from a policy direction.

4

TLDR;

Does the recommendation to use password managers also apply to corporate environments?

Yes. Okay, but why?


Pretty long, still gonna read;

Let's start with some of the things being disallowed by $SomeCorpo.

Paper notes, [...] storing passwords in browsers, etc, are all forbidden.

This is actually good advice. Paper notes are problematic because they have to be stored somewhere an adversary can't get to, & they can't really be encrypted. Meanwhile, the browser(0)(1) & JavaScript(2) Password Manager cryptography / security are fraught with potential perils. The issue is primarily that of untrusted environments: insecure physical locations; online services; the aforementioned vulnerable browsers or JavaScript; &, compromised operating system software. However, the idea that our brains are the only environments which can truly be trusted is flawed, as there exists coercion, compulsion(3), & increasingly nowadays, outright theft(4).

This all begs the question: If I can't trust the environment, what security can I possibly achieve? The best answer I have to that great question is: Not great. Nevertheless, all we can do is choose the best environments, methodologies, & tools that we possibly can. And, dedicated Password Managers do happen to be great tools.


The idea of a Password Manager:

You only need to memorize one password!

What does that mean? ...It means:

  • You can make it really long.
  • You can make it really hard for anyone else to guess.
  • You can follow all the best password guidelines.
  • You can learn to make a passphrase instead. (The Diceware mnemonic idea was great.)

xkcd comic on password strength

Figure 1: xkcd comic on password strength.

  • And, you can let the new SUPER passphrase open an encrypted vault of unique, well organized, & actually random keys for use elsewhere.

passwords must never be stored anywhere else except employees' heads

That's a good guideline for how this main passphrase should be handled.

they are even willing to relax a little bit password strength requirements, as long as the resultant passwords are memorable

Memorability is good! But, weakening security isn't necessary to make something more memorable, as the above comic shows. The weakening of security that $SomeCorpo is considering here is the result of expecting humans to memorize a plethora of distinct passwords. They shouldn't be doing that.

A practically unlimited, encrypted collection of unique cryptographic keys are always going to offer better flexibility, usability, & security tradeoffs than organizational policies which rely solely on people memorizing all of their secrets.

Passphrases & Keys, what's that got to do with a Password Manager?

Ok. Same difference. Though, maybe we should be calling it a Secrets Manager instead...

This new name might better convey their versatility. They don't just store passwords, or passphrases, or keys. They can hold any digital secrets — to be used for encryption, authentication, or for any other purpose. Such as, securely extending what we can memorize. They're just encrypted databases, with additional functionalities, designed in response to strong threat models, that can be extremely useful in corporate contexts.

But, my work is really sensitive!

Good point. Then you should really be using a Secrets Manager. And, consider how some other factors of authentication can be applied to your context. Multi-factor authentication (MFA) with things like hardware passkeys, & timed one-time passwords (TOTP), can do plenty to mitigate adversarial attempts at auth bypass.

Thankfully, passkeys are coming into mainstream use as we speak. However, instead of just replacing Secrets Managers, they're often being integrated synergistically. After all, there's no reason why a hardware passkey couldn't also be used to open the Secrets Manager, which itself can store distinct passkeys, potentially enhancing options for both privacy & identity management. It's worth considering that having only one public key for someone, or $SomeCorpo, to use across the whole internet is not the most privacy-preserving, or secure, idea. Managing distinct scopes & identities scales better in software Secrets Managers. Just how many hardware dongles is considered too many to carry around?

The last things I'll mention regarding MFA are just: stay clear of SMS auth; &, for the love of Claude(Shannon), stay away(5)(6)(7)(8)(9) from biometric auth, if you can. Even though biometrics are quite convenient, they're also immutable, privacy-problematic, & difficult to keep secret. Their security decreases as forgery technologies improve, more services / products capture & use that data for their own auth processes, & adversaries find it more attractive to attack.


Conclusion

Does it make sense to ban PW managers in corporate environments and insist that all passwords must be memorized?

Absolutely NOT.

Even with the strictest requirements, a Secrets Manager can play an important role in $SomeCorpo's security story. But, it doesn't have to play all the roles. Though, neither can the human memory™.

$SomeCorpo should at least let employees keep their Secrets Manager local / in an environment with approved security controls. $SomeCorpo can also require the use of an open-source Secrets Manager, allaying their concerns by taking advantage of the transparency & community of support that provides. And, if they see a way to make the Secrets Manager more secure for their context, it can be branched, forked, patched, or pull requested with the necessary improvements. $SomeCorpo shouldn't be banning an entire class of such versatile security tools. Especially not to improve security. That there is an oxymoron(a).

2
  • 2
    Storing passwords in the browser has nothing to do with JavaScript. Browsers have their own built-in password manager which isn't tied to any website-specific code.
    – Ja1024
    Commented Jun 19 at 4:26
  • Right. They're definitely mostly separate concerns in modern browsers because there's so much sandboxing going on. But, they're also highly interconnected, hence all the sandboxing. Web pages, browser plugins, network connections, OS calls, etc. can influence each other. And if a vulnerability can jump the sandbox, $SomeCorpo is gonna have a bad time. I added some more links & reworded the first paragraph to hopefully address your comment.
    – aiootp
    Commented Jun 19 at 5:18
3

Even though I am no security expert, it is quite clear to me that many people in a corporate environment have more than one, if not many, passwords each. Avid, a mod on this site, has a very appropriate saying:

Security at the expense of usability comes at the expense of security.

For arguments sake, let's say on average, the people in your corporation have four different passwords each to remember, only in their head (unless you use the same password for everything which is neither a good choice or what you have implied).

Like you said, the company is slightly more relaxed on the usability side of things, but also slightly more relaxed on the security side of things, from the quote.

But with a password manager you can have both. I’d say it’s definitely easier to remember one complicated, strong password than four (or more) weaker ones.
Because let’s face it, if the password for a reliable password manager is strong enough- your actual passwords are almost guaranteed safe.

This also means that you don't need to remember the corporate PWs so they can be un-memorably strong!

I for one use a password manager to manage over 10 passwords- but I only need to remember one, and that one password is just really, really strong!

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .