2

I'm not sure if I am unable to word it correctly when doing a Google search, but I cannot find a software / web application which offers the ability to store user credentials of websites and other software packages which I can then share with work collegues.

Essentially I am in need of a software package which has an administrator option who can add new software credentials and possibly an instant login feature. I then need the ability to add staff members to the software which can log into these individual packages (preferabbly without seeing the actual credentials) so that I can remove them if they leave the company or should not have access to specific credentials anymore.

Is there software like this available?

Improve this question
8
  • I imagine you haven't found anything like this because conceptually it is a broken security paradigm. You simple can't do it that way and be secure. If you do find software that works the way you describe, don't use it! It would be the no more protection that a tin foil hat in a fire fight and the shiny reflective surface would make you a target. Using a broken paradigm is worse than doing nothing at all. Commented Apr 2, 2014 at 7:26
  • @Caleb I don't agree in theory anyways - I suspect many implementations could be horrible but I'm sure it is possible; and I'm pretty sure I know one that does (just have to check). Commented Apr 2, 2014 at 7:40
  • 3
    @NickWilde It would be easy to do for anything that you have control over the login system for (this is the main reason why directory authentication services like AD/LDAP exist after all), but I cannot think of a way for a password manager to run locally and log people into third party sites and apps without bleeding credentials in a way that would make secure revocation impossible. Commented Apr 2, 2014 at 8:09
  • 1
    If a password at any point passes through a computer, that computer can catch it unless it's securely encrypted. Getting the server/service you log into to decrypt it could prove challenging unless you're in control of it. Commented Apr 2, 2014 at 8:54
  • 2
    @NickWilde Using a proxy to log people in would mean you can't use SSL (not to mention it kills puppies). Down that road lies madness. Either you control the (web)apps being used and use proper directory based authentication or you rotate credentials yourself to revoke them, their is no other way to do this right. Commented Apr 2, 2014 at 8:59

2 Answers 2

Reset to default
2

I am evaluating, and very much like Thycotic's Secret Server for this purpose.

There's a cloud offering I don't know much about, as well as the editions you can install onsite, and access through a web browser. It's built on SQL [express] and IIS.

Easy to setup, configure and manage, in addition to having a boatload of features.

The on-premises version is expensive, but very good.

Improve this answer
-1

So I'll recommend LastPass. It meets all of your sharing needs. There is also an enterprise edition with more coworker/employee login sharing features (but I've never tried that out at all).

Security note #1: While this is secure from external snooping the person it is shared with can get the password (even if it is hidden with a little bit of work)). So definitely use a unique password (you should do that all the time but many people don't).

Security note #2: Once shared although you can unshare the password you cannot count on it not being known even if set to hidden (due to #1). So to truely unshare you will have to change login credentials. The enterprise edition intropage seems to imply that it is developed to somehow avoid that but if you read the docs closer it does not actually avoid that at all.

As well it is:

  • Cross-platform: (Windows, Mac & Linux) and cross-browser compatible (all 5 common browsers)! Also has an Android and iOS app.
  • Very Secure: Lastpass is very secure; of course generally it is only as secure as your master password. However you can enable multi-factor authentication (might need premium I can't remember - since I don't have cell signal usually I haven't bothered to set that up for anything despite the benefits).
  • Fairly cheap: Free version available. Premium version is well within your price range - $12/year.

Lastpass is also more than just a password app; you can securely (ie encryptedly) store important documents and notes and credit card/address details as well.

Improve this answer
6
  • This does not meet the criteria of the question as it is unable to revoke privileges. Once shared the cat is out of the bag and cannot (securely) be put back in. The only way to securely use this in the scenario described in the question is to change all shared passwords every time an employee is rotated out of the system. This would facilitate the distribution of new passwords to the remaining members of the group but would not itself revoke old credentials. Commented Apr 2, 2014 at 8:14
  • @Caleb: very true and I should have mentioned that. Edited to explicitely state that. Sometimes with technology I just think well that's apparent to me it'll be apparent to everyone (subconsciously) and then forget that not everyone is as technoliterate as I am. Thanks :) Commented Apr 2, 2014 at 8:40
  • The verbiage I found an the Enterprise version feature page has weasel words that would lead you to believe it is capable of something it is not: "Disabling or deleting an employee's account helps ensure they no longer have access to sensitive data, protecting your company from rogue employees." Helps? Seriously? In other words it makes it inconvenient and catches folks that haven't compromised you my retrieving passwords to some other medium (e.g. memorized) before they get canned, but really it does not ensure they no longer have access... Commented Apr 2, 2014 at 8:54
  • Helps? oh that is good. Here can I help you out of this quicksand, here's a rope that I'll just drop here; if you're lucky it will catch on a root and you can pull yourself out. Sure it could work but I sure wouldn't want to depend on that. Commented Apr 2, 2014 at 9:00
  • (what I'd read was: "Manage onboarding, offboarding, and provisioning from a single, easy-to-use portal, with configurable policies that adapt to your security standards.") Commented Apr 2, 2014 at 9:01

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.