0

Where I work we have a handful of passwords that should almost never be used, but we need to have available as a fallback.

I'd like to protect these passwords from ordinary use by ensuring that no-one can access the passwords by themselves, and instead they need to consult with one of their colleagues before using them (i.e. secured by multi-party authorization). Ideally, any 2 authorised people would be able to unlock the password manager. (It's tricky to ensure that once unlocked, people can't just exfiltrate the passwords for unilateral use, but let's not worry about that for now.)

Given the requirements, it seems natural for it to be cloud-based or otherwise shared across devices, but we don't anticipate adding new passwords like this very often, so it's OK for it to be clumsy to edit or not support concurrent updates.

1
  • BTW I would like to have the dual of this: a password manager client, r.g. in web browser, that distributes the cloud storage for passwords across N servers/services, and which must connect to k of N how to get a useful password. Distribution to eliminate single point of failure in the cloud services storing their fraction of the password database; K of N for robustness against DOS of some but not all services and/or business failure
    – Krazy Glew
    Commented Jun 28, 2022 at 20:45

1 Answer 1

0

Shamir's Secret Sharing is perhaps the original k-of-N secret storage mechanism.

It sounds like Hashicorp Vault supports this as an unseal mechanism. I haven't yet assessed to what extent it fits my exact needs.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.