<div dir="ltr"><div class="gmail_extra"><div class="gmail_quote">On Sun, Oct 27, 2013 at 2:12 AM, Ed <span dir="ltr"><<a href="mailto:plug@0x1b.com" target="_blank">plug@0x1b.com</a>></span> wrote:<br><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
Hi All,<br>
<br>
1) your compliance officer is having kittens.... they don't call it<br>
the "designated felon" position for nothin'<br>
<br>
2) on non-windows systems, PasswordSafe is called MyPasswordSafe - the<br>
file format is identical and you can send the encrypted store as<br>
needed. That and a phone call and your clients' info is wherever your<br>
team needs it. Oh look, more kittens 8)<br></blockquote><div><br></div><div>The compliance officer does not like cats.....the team members are the ones having kittens. <br></div><div>PasswordSafe is too complicated for them to use. <br>
</div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
3) if you need to control access (AAA), you should think about<br>
federating your back office apps with a SAML server - like OpenAM.<br>
Your team gets their own creds for your SAML server, it federates to<br>
the backend servers with your {still secret} client's creds and gives<br>
your team access.<br></blockquote><div><br></div><div>The credentials I am sharing are not for my servers, but for accounts on servers<br></div><div>that I don't manage. Like Wells Fargo. <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
why not keep things simple?<br></blockquote><div><br></div><div>I am all for that!!!! ;) <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
It sounds like you could get by with a plain Apache httpd install that<br>
only serves https and requires a client side certificate for access,<br>
there really is no reason to put this info on any other systems. Odds<br>
are good you can serve this up from your office cable/DSL service<br>
without too much trouble.<br></blockquote><div><br></div><div>That would work. My biggest concern is that I am not enough of a security expert<br></div><div>to guarantee that what I whip up is secure enough. So, I am looking for recommendations<br>
for third party solutions that are secure.<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
And, NO! none of this is appropriate for real client credentials -<br>
also make your clients pick new random 12 character passwords<br>
(MyPasswordSafe can generate them for you if needed) the odds are good<br>
that the passwords you are sharing with your team are the same<br>
passwords your clients use for personal email and all sorts of other<br>
things too.<br></blockquote><div><br></div><div>Since I pass out the credentials and manage them, I control when the passwords change. <br></div><div>I just need a secure and easy way to communicate the changes to the team members. <br>
Remember, the team members cannot spell "pgp", so it has to be really simple for them, <br>but secure enough to keep a Wells Fargo account login safe.<br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
Mark - this is bad, really bad<br></blockquote><div><br></div><div>What is bad??? My problem or the proposed solutions?<br><br></div><div>Thanks,<br><br>Mark <br></div><blockquote class="gmail_quote" style="margin:0 0 0 .8ex;border-left:1px #ccc solid;padding-left:1ex">
<br>
On Sat, Oct 26, 2013 at 5:11 PM, Mark Phillips<br>
<div class="HOEnZb"><div class="h5"><<a href="mailto:mark@phillipsmarketing.biz">mark@phillipsmarketing.biz</a>> wrote:<br>
> I use keypass2 with dropbox for my personal passwords and love it. But it is<br>
> too complicated for my team...:-(<br>
><br>
> Mark<br>
><br>
> On Oct 26, 2013 2:58 PM, "Michael Butash" <<a href="mailto:michael@butash.net">michael@butash.net</a>> wrote:<br>
>><br>
>> At work we use "password safe" to share common passwords like service<br>
>> accounts, shared vendor accounts, and various other credentials that are not<br>
>> unique to a member. It's kind of a kludge, and of course windoze only, so I<br>
>> have to use vm to access it. quite annoying.<br>
>><br>
>> I've considered pushing to use keepass instead, as I've used this as well<br>
>> for a good 6 years under linux. Only problem is it's only a file db to be<br>
>> accessed, which makes anyone not on a shared network resource accessing it<br>
>> difficult. Also sadly, even the "official" version iterated to keepass2, a<br>
>> really crap c#/mono application that barely works under linux, and not<br>
>> without frustrations, but older 1.x format with keepassx works great.<br>
>><br>
>> I have since migrated to LastPass, even paying for the service because<br>
>> I've found it to be more valuable than the $12 a year personally, and their<br>
>> "enterprise version" can have shared access permissions. Perhaps the<br>
>> consumer version can be coaxed to do this too, but I've not had necessity to<br>
>> try. The android integration with dolphin browser (plugin) makes it easy on<br>
>> any platform, mobile or desktop for consistent access means.<br>
>><br>
>> Secure shared access for me is a random large/complex string that I note<br>
>> as who I've given it to, and only as long as needed before changing it. I<br>
>> don't remember passwords, preferring the ambiguity that if I can remember<br>
>> it, likely others can brute-force it, or torture it out of me.<br>
>><br>
>> Of course any service like lastpass inside the US, the NSA would simply<br>
>> subpoena and force to give unilateral access to my account anyway (much as<br>
>> they can/do anyone, thank your politicians) at that point, so really<br>
>> confidentiality is all a perception regardless as long as anything is shared<br>
>> externally.<br>
>><br>
>> -mb<br>
>><br>
>><br>
>> On 10/26/2013 02:31 PM, Eric Cope wrote:<br>
>><br>
>> I use lastpass, although not to share... I can help demo it if you want...<br>
>><br>
>> Eric<br>
>><br>
>><br>
>> On Sat, Oct 26, 2013 at 2:20 PM, Mark Phillips<br>
>> <<a href="mailto:mark@phillipsmarketing.biz">mark@phillipsmarketing.biz</a>> wrote:<br>
>>><br>
>>> I have a small team, and I am looking for a way to share account info -<br>
>>> user names and password, and password updates. These are login credentials<br>
>>> for financial accounts I manage.<br>
>>><br>
>>> I googled for some ideas, and came up with snail mail, various web<br>
>>> services that encrypt/decrypt emails, Lastpass, and safegmail.<br>
>>><br>
>>> The users are technical noobs, so it has to be easy. No software to<br>
>>> install. Free or inexpensive. They use Windows and Mac, I use Linux. Only I<br>
>>> use Gmail, so safegmail is out.<br>
>>><br>
>>> Does anyone have any recommendations for web service solutions? Anyone<br>
>>> use Lastpass? Other ideas?<br>
>>><br>
>>> Thanks,<br>
>>><br>
>>> Mark<br>
>>><br>
>>><br>
>>> ---------------------------------------------------<br>
>>> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a><br>
>>> To subscribe, unsubscribe, or to change your mail settings:<br>
>>> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br>
>><br>
>><br>
>><br>
>><br>
>> ---------------------------------------------------<br>
>> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a><br>
>> To subscribe, unsubscribe, or to change your mail settings:<br>
>> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br>
>><br>
>><br>
>><br>
>> ---------------------------------------------------<br>
>> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a><br>
>> To subscribe, unsubscribe, or to change your mail settings:<br>
>> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br>
><br>
><br>
> ---------------------------------------------------<br>
> PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a><br>
> To subscribe, unsubscribe, or to change your mail settings:<br>
> <a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br>
---------------------------------------------------<br>
PLUG-discuss mailing list - <a href="mailto:PLUG-discuss@lists.phxlinux.org">PLUG-discuss@lists.phxlinux.org</a><br>
To subscribe, unsubscribe, or to change your mail settings:<br>
<a href="http://lists.phxlinux.org/mailman/listinfo/plug-discuss" target="_blank">http://lists.phxlinux.org/mailman/listinfo/plug-discuss</a><br>
</div></div></blockquote></div><br></div></div>