-
-
Notifications
You must be signed in to change notification settings - Fork 2
1Password
The foundation utilizes 1Password for storage and sharing of credentials and secrets. For documentation on how to use 1password and administrate 1Password please visit 1Password support
Requests should generally come from the chair of your working group as part of an on-boarding process, though there may be times where a chair is not available. Chairs and contributors should send an email to [email protected]. If you are a contributor please explain why you are requesting this vs one of the chairs of your working group.
Each working group is entitled to its own vault to manage credentials and other sensitive directly related to the ongoing of said working group.
While, each managing member or contributor that has a foundation 1password account is entitled to a private personal vault by virtue of 1Password, we do not recommend using this for any of your personal needs. Thus, in general we recommend not to use it at all.
We highly recommend using TOTP for login entries where possible, especially for shared accounts. From time to time infrastructure may review entries to audit for login entries which may have TOTP enabled and do not and request the working group to set it up. Please see the one-time-password docs for detailed documentation on setup and usage.
Passwords should generally be rotated every 90 days. Infrastructure may perform audits and contact your working group when stale passwords are identified.
In order to keep costs down infrastructure may audit its 1password account(s) for inactive user accounts. If inactive user accounts are found infrastructure may contact you to determine if your 1password account is needed.
In the event of a leak or breach it is standard policy to rotate all passwords and secrets. Infrastructure is required to give all working groups a heads up prior to rotation. Infrastructure may reach out to working groups to assist in this process as needed.