Where do the passwords live?

I use Basecamp, off and on. I normally use it really intensely for about 6 months, while working on a project, and then it just sits there. I like Basecamp as a product, but it is a closed, hosted software as a service, and that really bothers me in the downtime, since at that point I am just paying them to store a project archive for me.

As it happens, I’ve largely mitigated all the features of Basecamp:

  • Messaging - Turns out that none of my clients appreciate the ability to search through the message archive, and since I am normally looped into every message, I don't miss anything.
  • Documentation - When I can, I use a wiki to document development stuff. This works for some projects, and not others; for those we defer to email.
  • Files - I use ownCloud, and my clients normally just email me files of a certain size. Annoying, and could use a different way.

There is one thing that I haven’t figured out, where Basecamp excels: passwords. Because I normally work alone, and even when I am heading a team I handle all the accounts and infrastructure myself, I am the only person with all the passwords. I create a document called Credentials in each project, and put all the login and passwords there.

The idea is that if one of my clients needs to, they can check that to get access. I used to warn against them doing that without talking to me, but I decided that it was a better plan to just make sure I always have offsite backups and let my emergency rates reinforce how dangerous playing with those accounts can be.

If I didn’t do this, the only place the passwords would live would be on a sticky note on someone’s monitor, or even worse, a text file on a laptop (in my case that is fine, since I use multiple forms of encryption, but I doubt this is common…).

Ideally I would have a secure website that I could dump this stuff on, that I could share with folks who need it. I don’t use private wikae, and while I think everyone should have an ownCloud account somewhere, that is not the fact of the matter.

Ideally I would host some lightweight project management software, but that is really an oxymorom; it ie either impossible, or humans have no quite figured out the right formula. So, where do I keep the passwords?

I’m struggling with this, too. We sort of tried a shared 1Password but run into problems with sharing (of course. You might not want EVERYBODY on the same account. And if the master password ever gets compromised…). So then we sort of try getting everyone to have their own 1Password accounts and make them manually put all the passwords that they need into their personal account, but inevitably some fall through the cracks and then you have to resort to “call that one person who does have the password” anyway. Apparently LastPass is supposed to have a way to easily send somebody else a password and have it show up in their LastPass account, but I haven’t used it myself, and it didn’t appear to take off so it must have not been 100% easy to use.

I’m still looking for a good solution to this. I guess what I want is for everybody to be on one standard, and I can “send” them a password that is somehow encrypted on their computer (and they don’t have to do anything to ‘accept’ or ‘manually enter’ the password themselves) … ? And I can change (or delete) the password and it’ll change it on their computer too …

Can OwnCloud help with this, or is it like Dropbox — it’ll just be on a file on the computer? We used Dropbox to share a 1Password file for a while….

Yeah, consider an average client of mine. I have the login for:

  • Gandi.net
  • Rackspace panel
  • Whatever software they are using, as an admin
  • Server

Most of these are useless to any of my clients as long as I am around, but if they need to make the change themselves, where do they go? It also doesn’t make much sense to have admin credentials laying around on everyone’s computer/account.

It may be that we just have to handle this stuff manually, for now.