Ask HN: How do you manage/share passwords as you scale a startup? | Hacker News Reader

Ask HN: How do you manage/share passwords as you scale a startup?

2 pointsgnicholas3 comments

My startup is growing, and I'm getting to the point where multiple people will need to have access the same (external) accounts. What are best practices for managing and appropriately sharing passwords?

View on HN

1Password for Teams works great for us.

Prior to it, we had gpg-encrypted passwords file in our repository, which was a headache.

I think a password manager like 1Password suggested here by someone else would be very useful, however I haven't tried it out with more than 2 people.

A bit off-topic:

What I would love to have is some sort of hardware 2FA that supports multiple TOTP keys (a la Google Authenticator app) like this Protectimus Slim Mini [0]. Unfortunately this works only for 1 key, so I would need to have 1 device for each 2FA-enabled account, which is way too much (I would love one for personal use as well).

Does anyone know of a product that is able to store more than one key?

That would be supper useful I think, in combination with the password manager, to keep your startups' key accounts safe. On the one hand you can manage passwords easily, and on the other your employee's (or your own) phone is not tied to account access, which I believe in general is a frowned-upon practice.

Edit:

I even asked the creator of the SC4-HSM [1] if it would be possible to use it for this purpose, but unfortunately having a real-time clock on board would require a battery, which the device does not have.

The other idea I had was trying to use the computer's RTC via USB somehow. Even asked this on Stack Overflow [2] but apparently it would still require non-trivial code.

So if anyone can think of any solution that would be very neat. I can't believe there's no company doing this. I would guess there are a lot of startups with this same problem, no?

[0] https://www.protectimus.com/protectimus-slim-mini

[1] https://sc4.us/hsm

[2] https://stackoverflow.com/questions/40819579/get-system-date...

Encrypted versioned keychain (preferebly human readable), shared notes/pass via those password managers apps & other than simple password access (OpenID, SSH keys and such).

Reply on news.ycombinator.com