Hacker News Reader

Comment by zbentley | Hacker News Reader

Not GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:

- User account with access to the SaaS password manager was compromised.

- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.

EDIT forgot one:

- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.

View on HN

These examples are very different than your provider being hacked.

Ideally you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

> These examples are very different than your provider being hacked.

I am not GP. GP said:

> I say "no thanks, they're going to get hacked" and then six months later... they get hacked.

I interpreted that to mean "they (the passwords) were compromised" not necessarily "they (the password vault provider) were compromised".

> you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

Correct.

GP here:

(1) The use case I have seen is that a startup or small unit in a big organization has subscriptions to a number of services that are shared by multiple users; if I had to log into one of these things I would log into the password manager and use the username and password that we all share -- these have never been things that I use for my day and day out software development but usually are things the marketing people use that I only have to log into every six months or so if I have to help out with a problem. I've always had individual accounts for bread and butter services such as version control, issue tracking, documentation management and such.

Of course the right thing to do is give members of an organization their own username and password or integrate with the enterprise SSO of that organization... And that's a lot of what I do for work! Many vendors don't support that or jack up prices 10x or more per seat for SSO, so shared username/passwords are widespread.

(2) "they got hacked" means "I read about an incident in the media". Probably some security boundaries were breached and others weren't. I don't think any of these were the worst case scenario of "100% of passwords got leaked". I wasn't personally effected because I didn't take the bait, I either had moved on to another job or somebody else cleaned up any mess so I don't know exactly how my organizations were affected. Still it proved my intuition (gotten from looking at a lot of software and working on user management for numerous web sites, some famous) that these password managers were not paragons of operational excellence.

Reply on news.ycombinator.com