New answers tagged password-management
1
Argon2 is not meant to protect anything against MITM. It's not the right tool for the job. Using Argon2 on the client side (with or without TLS) will force you to either store the plaintext password on the server side, or it will make the hash become the password: in both cases you end up usually worse than when sending the plaintext password over TLS.
You ...
0
Disclaimer: I am not affiliated in anyway with Yubico, neither have I tried the products listed on the web-page below. This is not an endorsement of any of those companies.
Related to mti2935's answer about the use of YubiKeys, it appears from the section Works with YubiKey: Securing Password Managers on Yubico's website that there are at least a couple of ...
1
This is a problem I've been trying to solve for a while, but I'm not ready to share a complete solution, since I'm still working on it. For now, I will only share some details and general principles.
The problem of password managers is that they introduce a single point of failure, that is, once your machine is infected all the passwords might be used by the ...
1
You can split the passwords into two pieces. Keep one piece in your password manager and make it complex (local or cloud or browser - each has its own pros/cons).
Keep the second piece easy to type but not necessarily short and make it unique to each of your customers. Keep this list in another place (Google spreadsheet - or printed if same customer has many ...
1
This is exactly the threat that standards such as FIDO and WebAuthn aim to mitigate. These standards use public key authentication to authenticate with web sites and other services, using a private key that is stored on a device (such as YubiKey).
The private key never leaves the device, so even if the computer is compromised, the attacker is not able to ...
3
Worth revisiting is the RSA hack from 2011. The fact that their private token keys (or seeds, which can be turned into keys with a reverse-engineered algorithm) were not held physically separate came as shock to many of us. At the time, I had more confidence that once I was logged into my RSA 2FA token secured corporate account, I was truly working in a ...
1
But I bet Facebook, Google, Twitter and other super big tech companies don't use such third-party services for their internal passwords and have their own password managers for their most critical passwords.
Funny that you mention Twitter. Reportedly:
hackers breached employee Slack accounts and found credentials for the Twitter backend pinned inside a ...
9
Excellent question!
Disclaimer: I've worked for large tech companies, and this answer is based on that. No company-specific or proprietary techniques are disclosed.
Authenticating people
I bet Facebook, Google, Twitter and other super big tech companies don't use such third-party services for their internal passwords
Actually, at least some do use third-...
36
Facebook authentication, when I left, focused heavily on multifactor authentication. Both Facebook and Google invested in purchasing Yubikeys, and Google went on to develop U2F which became FIDO. Server access was based on signed SSH certificate issuance. There was a "break glass" ssh key that was physically stored in a safe as well as a few "...
4
The most sensitive keys should be generated and stored on Hardware Security Modules (HSMs) and never leave them. Security then becomes one of physical access to the HSM itself, plus some way to manage revoking the key if the device were stolen. The most obvious example for this being sufficient is managing the private keys to web server TLS certificates. If ...
7
Risk Management, and Role Based Access Controls (RBAC)
OP is asking for technological solutions to what is, ultimately, a problem around Risk. Other answers provide a good sampling of the kinds of tools available (e.g. 1Password, Hashicorp Vault, etc...) but I'd like to address the underlying question of risks. That will determine which of the many options ...
30
I work for 1Password.
We do have a number of large companies using 1Password, but we do not talk about our customers without their express permission. Note also that we can't see what is being stored where, so we can't really infer from what we can see how they are handling some of the questions very good management questions you asked. However, we sometimes ...
19
You mention private keys. For these, a well known method is to use hardware security modules (HSM). Like chip-based credit cards, they keep the key inside a box you cannot open, and you store the box in a safe location. Access to the signing feature of the box (without revealing the secret key, of course) may also be protected electronically, like your ...
11
While technical solutions are great, the reality is that many companies don't use them. And often it's a matter of inertia.
I have worked in a variety of companies, from tiny 2-people startups to massive FTSE-100 multinational. What you'll find is that small, agile companies are usually way ahead of large incumbent multinational in terms of technological ...
13
@CaffeineAddiction Thanks. I'm specifically speaking about important keys like encryption keys, root passwords, etc. Who keeps them? the CEO/CTO and a few trusted employees?
It depends on who needs access, and the hierarchy in the company. Larger companies typically have multiple departments comprised of multiple teams. And not all staff in each department ...
42
In General
There's not really one answer to this question, and I wouldn't necessarily consider "large companies" to be a distinct thing with different approaches. Certainly, the particular companies you have named have their own way of doing things, but the people who would be best able to answer for them are employees of those companies.
As for ...
0
With GPG the file is actually first encrypted using symmetric encryption, and the key used for that is then encrypted to every recipient using their public keys. Therefore, instead of transferring a single private key between the systems, it's possible to just encrypt the file with multiple recipients.
gpg --encrypt --recipient <comp1> --recipient <...
1
Disclosure: I work for 1Password and had a hand to play in the design of exactly what you are asking about.
What you are after is described in more detail in the 1Password Security Design document. I will leave out some details here so that I can focus on the essential part of the question.
1Password works with the notion of vaults, and vaults are what ...
1
This Python script uses the Thunderbird/Firefox libraries to read the passwords stored in the logins.sqlite or signons.sqlite files from your profile folder.
It prompts you for your master password, which you can leave empty if didn't use one.
1
A common solution for this problem is key encapsulation.
All the shared passwords are encrypted with one randomly-generated key. Then the password manager creates a copy of that key for every user and encrypts each copy with a key derived from that users password.
When a user wants to access the shared password list, they first decrypt their copy of the ...
2
It seems your situation is
You are not allowed to install software on your work computer.
Your work computer does not have a password manager installed.
You are not allowed to store credentials in the cloud.
Your work credentials protect employer (not personal) assets.
Your employer has dictated password policy with elements like mandatory password changes ...
Top 50 recent answers are included
