What Tim said - password managers depend on their correct implementation. Sadly enough, a lot of 'Enterprise password managers' essentially function like a shared Notepad.
If you have a proper implementation with a master key and unique passwords stored etc locally this could be a valid solution, if you have a shared storage solution with employee access to them that becomes a different concern.
/y
-----Original Message-----
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> On Behalf Of Tim Fathers
Sent: 18 March 2021 18:59
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: How to validate passwords without storing them anywhere.
This is not how password managers work though. Any proper password manager encrypts the password database with a master key, which is never sent anywhere. Personally, I use a Yubikey to store a very long and complex master password for my password manager.
________________________________
From: MIDRANGE-L <midrange-l-bounces@xxxxxxxxxxxxxxxxxx> on behalf of James H. H. Lampert <jamesl@xxxxxxxxxxxxxxxxx>
Sent: 18 March 2021 17:48
To: Midrange Systems Technical Discussion <midrange-l@xxxxxxxxxxxxxxxxxx>
Subject: Re: How to validate passwords without storing them anywhere.
On 3/18/21 10:33 AM, Tim Fathers wrote:
...that's what password managers are for 😉
If a password is "managed," than anybody who can gain access to the box on which it is "managed" gains access to whatever the password protects.
(Which is why I'm leery of SSH sessions to cloud Linux servers being secured with a keypair instead of a password. I'd prefer a keypair *and* a password.)
--
JHHL
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
--
This is the Midrange Systems Technical Discussion (MIDRANGE-L) mailing list To post a message email: MIDRANGE-L@xxxxxxxxxxxxxxxxxx To subscribe, unsubscribe, or change list options,
visit:
https://lists.midrange.com/mailman/listinfo/midrange-l
or email: MIDRANGE-L-request@xxxxxxxxxxxxxxxxxx
Before posting, please take a moment to review the archives at
https://archive.midrange.com/midrange-l.
Please contact support@xxxxxxxxxxxxxxxxxxxx for any subscription related questions.
Help support midrange.com by shopping at amazon.com with our affiliate link:
https://amazon.midrange.com
midrange.com
