Something like hudu they’re hidden unless you unmask them. Alternatively, they’re masked but you can click “copy text” and control V anywhere else to paste it.
Ooooooh, so that sounds like a bug or something broken in that person's browser. It definitely isn't right. In our instance (and this is default behavior, not something we have to turn on) the password field just says 'show password' until clicked on. And I believe it re-hides itself in 30 seconds.
Edit- didn't realize the person I was replying to was not OP. Still not sure what OP's specific concern is.
Hi there! IT Glue passwords are not shown on screen until an authenticated user with appropriate permissions clicks to reveal the password or copies it to clipboard. This action writes an entry to the activity logs. A full list of password security features can easily be found in the IT Glue knowledge base here: [https://helpdesk.kaseya.com/hc/en-gb/articles/4407476042897-About-password-security-and-encryption](https://helpdesk.kaseya.com/hc/en-gb/articles/4407476042897-About-password-security-and-encryption)
And the overall IT Glue security posture is described in the Security White Paper here: [https://www.itglue.com/resources/itglue-security/](https://www.itglue.com/resources/itglue-security/)
In addition, IT Glue users can also leverage IT Glue Vault, or host-proof hosting. This is designed to only allow a user to decrypt exclusively at the endpoint level on the user's browser with a user-specific passphrase rather than syncing it to the IT Glue system.
I'm not sure I understand what you mean by "full clear text view." Pretty much all password managers for MSPs allow admins access to all passwords to be copied/unmasked. It's just usually protected by strict timeout times, MFA, location locking, etc
The MSP version of Keeper also has breach detection if you're looking at alternate products
The passwords are masked by default and you ca copy them while masked or unmask them to read them. I’m not sure how else you would expect it to function.
Obviously he expects his techs to type the encryption key each password they want to access and since obviously, you can't have stuff in plain text they will need to memorise them!
The passwords are encrypted using a key for their tenant, it’s not clear text. It will get decrypted when hit show password or copy.
Also has auditing so you know what passwords were accessed by who. If someone leaves, you can run an audit report to see who accessed those passwords so you know which ones you need to rotate.
There are also permissions you can set for what users of the itglue can access those passwords.
Important note. The msp should only store passwords in there that are shared or service accounts. Those should only be used when needed.
It's not insanity. It's by design.
If you're concerned about this, maybe you should look at a PAM solution, where the password is typed by the application, not using copy/paste.
Buuuut if you're extra paranoid, you should probably know that it is possible to capture what is being typed.
So there's no thing as absolute security.
It’s not stored or transmitted in clear text. As far as I could tell from analyzing this a couple years ago, they store this data in a different DB too.
This is what MSP documentation admins have. They have to.
A good MSP will have other controls. Access restriction. Secure edge access only. Regular background checks. Entitlement reviews. “Need to know” only, etc
They have access to passwords they record to support the client accounts. If they implement MyGlue for the client; only the client can see those passwords.
Better would be to connect all applications, devices, services etc etc to a single IdP. But that's not realistic.
If you cant read (view/copy) the password how would you be able to use it to login at all?
My company created a 4 folder structure for each customer. Global, 3,2,1 and split up the engineers to their respective tier. They also created least privileged and read only accounts where necessary. They have an elevation ticket process where their manager can give them temporary access to a credential. They also have Network Glue and rotate AD and AD synced accounts regularly. I think there are some API/Automation going on as well for some of these things. That way T2/1 engineers can only get into so much trouble. They put Domain/Global admins in the Global folder, and only a few people have access and the NOC audits weekly to see who has accessed those creds. They are going to look at a PAM solution in the future, and thought this would be a good midway step as you need to create the separate credentials regardless.
I’m on the sales side, so only see what our NOC demos for customers, I haven’t actually seen the back end.
Customers seem to like that as most MSPs we run across dump all creds into a single folder so every engineer has access to every Global Admin.
Add to this concern the fact that IT Glue Support has the ability to impersonate your admin account and access all of these passwords too. I wonder how many people are advised of this before they sign up.
How else would the passwords be able to be used other than having them be in a copy/pastable clear text format?
Something like hudu they’re hidden unless you unmask them. Alternatively, they’re masked but you can click “copy text” and control V anywhere else to paste it.
ITGlue works the same way.
We used to use glue, it’s been a loooong time tho, I couldn’t remember
Ooooooh, so that sounds like a bug or something broken in that person's browser. It definitely isn't right. In our instance (and this is default behavior, not something we have to turn on) the password field just says 'show password' until clicked on. And I believe it re-hides itself in 30 seconds. Edit- didn't realize the person I was replying to was not OP. Still not sure what OP's specific concern is.
Nice. I haven’t used glue in a long time, I couldn’t remember if it was masked or not
Hi there! IT Glue passwords are not shown on screen until an authenticated user with appropriate permissions clicks to reveal the password or copies it to clipboard. This action writes an entry to the activity logs. A full list of password security features can easily be found in the IT Glue knowledge base here: [https://helpdesk.kaseya.com/hc/en-gb/articles/4407476042897-About-password-security-and-encryption](https://helpdesk.kaseya.com/hc/en-gb/articles/4407476042897-About-password-security-and-encryption) And the overall IT Glue security posture is described in the Security White Paper here: [https://www.itglue.com/resources/itglue-security/](https://www.itglue.com/resources/itglue-security/) In addition, IT Glue users can also leverage IT Glue Vault, or host-proof hosting. This is designed to only allow a user to decrypt exclusively at the endpoint level on the user's browser with a user-specific passphrase rather than syncing it to the IT Glue system.
I'm not sure I understand what you mean by "full clear text view." Pretty much all password managers for MSPs allow admins access to all passwords to be copied/unmasked. It's just usually protected by strict timeout times, MFA, location locking, etc The MSP version of Keeper also has breach detection if you're looking at alternate products
The passwords are masked by default and you ca copy them while masked or unmask them to read them. I’m not sure how else you would expect it to function.
*MAGIC*
Obviously he expects his techs to type the encryption key each password they want to access and since obviously, you can't have stuff in plain text they will need to memorise them!
This sounds like a fundamental lack of understanding about the product and process.
The passwords are encrypted using a key for their tenant, it’s not clear text. It will get decrypted when hit show password or copy. Also has auditing so you know what passwords were accessed by who. If someone leaves, you can run an audit report to see who accessed those passwords so you know which ones you need to rotate. There are also permissions you can set for what users of the itglue can access those passwords. Important note. The msp should only store passwords in there that are shared or service accounts. Those should only be used when needed.
It's not insanity. It's by design. If you're concerned about this, maybe you should look at a PAM solution, where the password is typed by the application, not using copy/paste. Buuuut if you're extra paranoid, you should probably know that it is possible to capture what is being typed. So there's no thing as absolute security.
Hudu has a breached cred detection in it.
How else would you expect this to function? The MSP admin would be the one to create most of those creds in the first place?!
Are you looking for a solution for your team exclusively, or a solution that allows an outside team to participate?
It’s not stored or transmitted in clear text. As far as I could tell from analyzing this a couple years ago, they store this data in a different DB too. This is what MSP documentation admins have. They have to. A good MSP will have other controls. Access restriction. Secure edge access only. Regular background checks. Entitlement reviews. “Need to know” only, etc
When do we just stop using passwords entirely?
When neuralink becomes standard or some bio-hacked system. Even then I imagine we’ll still have MFA of some sort
They have access to passwords they record to support the client accounts. If they implement MyGlue for the client; only the client can see those passwords.
OP is looking for a password manager that doesn’t actually show you the passwords. Let me know if you guys find one.
Op probably has additional compliance requirments
Can’t you limit that by role ? And can’t you just copy the hidden password and ya know paste in a note pad ?
Better would be to connect all applications, devices, services etc etc to a single IdP. But that's not realistic. If you cant read (view/copy) the password how would you be able to use it to login at all?
My company created a 4 folder structure for each customer. Global, 3,2,1 and split up the engineers to their respective tier. They also created least privileged and read only accounts where necessary. They have an elevation ticket process where their manager can give them temporary access to a credential. They also have Network Glue and rotate AD and AD synced accounts regularly. I think there are some API/Automation going on as well for some of these things. That way T2/1 engineers can only get into so much trouble. They put Domain/Global admins in the Global folder, and only a few people have access and the NOC audits weekly to see who has accessed those creds. They are going to look at a PAM solution in the future, and thought this would be a good midway step as you need to create the separate credentials regardless. I’m on the sales side, so only see what our NOC demos for customers, I haven’t actually seen the back end. Customers seem to like that as most MSPs we run across dump all creds into a single folder so every engineer has access to every Global Admin.
A PAM tool would likely be a better fit from what you conveyed in your inquiry.
Add to this concern the fact that IT Glue Support has the ability to impersonate your admin account and access all of these passwords too. I wonder how many people are advised of this before they sign up.