Does anyone have the need for a system that allows you to share your passwords with other people? My company needs to be able to share passwords between staff (website logins, etc). The best I've found so far is SplashID, but it doesn't really work in Linux and it doesn't properly share passwords in the nice atomic way I need. So I've started building a webservice that does this.
No, it doesn't store the passwords in plaintext. Each user has a key (PKI-style). The passwords are stored in a table. That row doesn't have the password itself, just a reference to its existance. Another table has the public-key-encrypted password, one entry per user with such access. Not even the database admin (me) can see these passwords as they're encrypted with the keys. The key is decrypted with the user's private key, which is only accessible by them. When a user shares a password with someone else, the password is decrypted with the private key and then a new entry is created with the password encrypted with the target user's public key. That entry is attached to the controlling row in the other table. This allows for modifications to the password as well as all other meta data. Those modifications will pass through to the other users' entries.
The nice thing about using public/private keys is that you can encrypt items destined for others without being able to decrypt it, properly protecting the data. Even if someone were to get a full database dump of the system, they wouldn't be able to use it.
I'm planning to make a desktop client as well as a Palm client for this.
No, it doesn't store the passwords in plaintext. Each user has a key (PKI-style). The passwords are stored in a table. That row doesn't have the password itself, just a reference to its existance. Another table has the public-key-encrypted password, one entry per user with such access. Not even the database admin (me) can see these passwords as they're encrypted with the keys. The key is decrypted with the user's private key, which is only accessible by them. When a user shares a password with someone else, the password is decrypted with the private key and then a new entry is created with the password encrypted with the target user's public key. That entry is attached to the controlling row in the other table. This allows for modifications to the password as well as all other meta data. Those modifications will pass through to the other users' entries.
The nice thing about using public/private keys is that you can encrypt items destined for others without being able to decrypt it, properly protecting the data. Even if someone were to get a full database dump of the system, they wouldn't be able to use it.
I'm planning to make a desktop client as well as a Palm client for this.
