My company of ~25 people needs to manage access to probably ~100 services our employees use everyday and I assume some kind of password manager which I can centrally manage is the way to go.
I often hear things on here about products that claim to be secure but aren't -- what password manager is considered reliable and secure? Which do you use?
Thank you!
1Password isn't perfect but is by far the best one I've used and it does work well for teams IMO. We just are anal about setting up vaults and permissions to those vaults so it easy to segment users to only see the services they are allowed to etc. Plus it keeps things orderly and clean for maintenance purposes. The browser plug-ins have gotten better and the search is decent so definitely better then others I have seen.
I wish it was possible to share a credential with specific people without a need to create a dedicated vault.
1. If a user fails (or skips) 2FA, they still retain complete access to any passwords/vaults they previously locally synced... they just can't sync new/updated entries. This seems like a really flawed design - a 2FA failure should prevent access. When I asked the 1password team whether they'd consider invalidating local cache on 2FA failure, they did not seem interested.
2. You can't create links to passwords, which would allow management of an entry from a single location. If you want to share a password across multiple teams/vaults, you need to know about and maintain those entries for the same account, which means you also have to have access to all those vaults to manage that entry. This discourages password rotation, and increases the likelihood of orphaned passwords in other vaults.
3. Lack of granular permissions structure. You can't, for example, allow a user to initiate vault resets without giving them full admin access to the entire thing. Again, other password managers allow more fine-grained control.
To me, 1password feels like a small-time solution that tried to bolt on some enterprise features to retain customers. I don't think it should be considered enterprise software.
Dead Comment
For high level corporate account, just have 2-3 office phones with different phone numbers. Each number is for a different department or level of access. Provide the right number given the nature of the access required (AWS Root account versus Xero accounting software, for example) and then use that as the 2FA. You can even use virtual 2FA for this.
Just a thought.
For personal level access for each employee, provide your employees with second hand, cheap Android phones you can buy for mere pennies, keep them in the office at all times, on charge, on wifi-only. This has the benefit of helping to reuse old hardware as opposed to it ending up on some tip.
Password sharing controls are insufficient.
Would you be able to share feedback on where you feel the product falls down around tooling to scale? I'd like to make sure our teams are thinking about any difficulties you are having. There also may be more efficient ways to accomplish things that we can point out. Looking forward to your feedback. Thanks in advance!
Is single sign-on an option, instead? Something like Okta is a much better experience for less technical users (and, well, engineers too) where possible, and also lets you trivially manage credentials access as people on/off board (no need to rotate credentials if you're worried folk may have written them down on paper somewhere with malicious intent). That said, it doesn't help folk with personal credentials management, which can be useful for good security policy in addition.
1password is my favorite to have around for services that don't support SSO. I like it so much I pay for a family account, even.
Otherwise, thanks to many providers like Okta and others, SSO should really be a feature provided to smaller tiers nowadays.
We're a small business (2 founders, 3 contractors), and we'd love to use SSO for everything. But we're too small to afford enterprise tiers for things like Slack, Gitlab, etc.
Hopefully this trickles down eventually.
Update: I'd like to add that we provide a SaaS product as well, and have considered adding SSO to the enterprise tier but after much research we can't really find a good reason to restrict it (apart from "everyone else is doing it", and potential manual config).
But both SAML and OpenID connect have discovery protocols. Again, this CAN technically be self-configured by the right customer. But then, maybe the solution is to have a one-time config fee, rather than require a certain tier.
Lower tiers of SaaS products are more-or-less strictly designed for:
- individuals or very small businesses where everyone is friends
- who don't have exacting requirements/audit/traceability/reporting concerns
- who are willing to accept some pain/inconvenience if they use it outside of its design parameters
Credential-sharing services in the age of SSO are a dirty workaround designed to circumvent SaaS product segmentation (which would otherwise cause established companies to effectively subsidise tiny startups). I'm all for hacker philosophy, and perhaps this applies less to your situation than it does to the OP, but I do think the idea of credential-sharing is a horrible kludge that has only risen to prominence because of the specific issue that I mentioned, and which only leads to more problems with things like non-repudiation.
For everything else, you can put your services behind i.e. traefik and write a middleware, or use something like caddy which has a plugin for sso.
I have built an API to interact with 1password through its CLI: https://github.com/lettdigital/onepassword-api
The repo also includes an example of how to call the API using AWS Lambda.
The logic to interact with the 1password CLI is wrapped in an SDK, that can be used independently: https://github.com/lettdigital/onepassword-python
Not totally relevant to the question, but how well does it scale to enterprise? I found the need to create and manage individual access to vaults to be complicated, even at a few users. I can't imagine how you'd manage 1000s of passwords accessed by combinations of 1000s of users, including third-parties, contractors, etc. Are there any better password management solutions in the enterprise space?
But they did recently introduce a CLI here: https://support.1password.com/command-line-getting-started/#...
That makes me optimistic that you could at least do a fair amount of automation around it. I haven't used it myself yet, so I'm not sure how fully featured the cli is
A password manager isn’t required here because it much better to control access with SSO. The user can have one password, preferably just logging into their workstation, and then SSO will sign them into whatever apps they are allowed to. Much easier than having a password manager keeping 80-100 passwords.
In the past we used a safe credential manager that our NOC could access to get admin or other management credentials for networking devices when problems occurred. You could use the same for DB or server passwords where you need the text and combine it with a password manager if you can auto fill them. Only use these options for systems that don’t have SSO.
I used Okta at a previous employer; it was good too.
Dead Comment
https://tozny.com/tozid
I would never trust my passwords to a closed source project that could be ridden with insecure code and disappear or change considerably on short notice. When the source code is open, chances for survival of the project in one form or another is much higher.
I also like that they take feature requests on their community forum and that their Github repo is active and responsive to issues.
The thing is, everywhere you use your password is probably 'closed source' and probably has 'lots of bugs'.
Ima guess that people re-use a lot of passwords and therefore are going to be at risk due to said 'closed source'.
I think that open v. closed may be only one of many considerations.
Well, that's the argument for a password manager, no? You can't trust any of these services, so you generate transient, strong, one time passwords for each of these, and then use a password manager you trust to manage it all instead. If one gets leaked, then sure it's a pain, but at least it doesn't mean they can log into every other service too!
I've used both in both personal and corporate settings. Great browser support, Keepass2Android makes my mobile experience good.
The reason it's so good for corporate is that the database is just a file, so you can email passwords, or share via one drive or Dropbox or ftp or shared samba drive or ...
I worked with techs from Oracle who used to auto generate the database for particular users and share them around. It worked really well for them. Because it's just a file it works for all sorts of workflows.
My workplace does pay for Cyberark which is a built for purpose Enterprise application, but I don't have rights to it it or whatever, so I just use KeepassXC.
Same in case of a leak.
With solutions using per-user keys, you just have to revoke/remove keys for that single user. GNU pass (FOSS) and Bitwarden (paid, open source) both do this.
https://github.com/keepassxreboot/keepassxc/blob/develop/doc...
BitWarden is my choice, it's cheaper than alternatives, the UI is simple and easy to understand. It's open-source and battle-tested. You may want to self-host as well.
I switched to BitWarden a couple of months back and I'm very happy with it. I have quibbles, but it's a much more solid experience.
Glad I don't have to use it anymore.
So I end up having to give other members of my team step-by-step directions to finding the right file or folder every time I share one. And that's assuming the access permissions haven't got borked, which seems to happen more often than not.
I've been pushing my company to drop it for a while.
Dead Comment
Perhaps it has changed since, or maybe it was just hard to find. Oh well, too late now.
We ended up using 1Password. My only real complaint with it is the need to create a vault for sharing something from one user to another. That means that if any two people in the company want to share, they need to get an admin involved so the admin can create the vault.
The whole point of a password manager is so you only have to remember one passphrase. Suggesting an actual sentence and not having byzantine passphrase requirements will help. My fiance is really bad with this one, I admit that I don't have much empathy here.
Unless you're talking about mass-replacing a single password across a bunch of different entries? Which is certainly not a limitation of any password manager; reusing a password is just horrible.
I used KeePass at a previous company and loved it.
2) The business model of LastPass worries me. Unlike a 1Password (I tried it for a 3 month trial, don't use them or have any skin in the game for them) charges a lot more than LastPass and in addition to having a more smooth, speedy and performant application, they are charging enough money to feasibly be profitable just storing passwords.
LastPass has has more data breaches than the others (google). It's run by a domain register. In my opinion this influences how the password business is run, leading to a marketing-forward rent extraction password manager vs a good one.
- It’s sluggish.
- The password sharing experience sucks.
- The drop down menus often get obfuscated in weird ways.
Deleted Comment
KeepassXC can work fine, but it's not super integrated in terms of alternative clients, CLI, mobile etc. If you go with keepass, make sure to use XC (the most recent community fork AFAIK). Similarly to GNU Pass, you need to sort out syncing yourself and have the additional hassle of maintaining a shared secret, and alternatively a shared keyfile. If one is compromised, you need to make everyone rotate, which in practice leads to lazy teams never rotating keys and even using keys they know probably are compromised already.
LastPass is horrible, in my experience. The web app is incredibly buggy and the only thing that really works somewhat well is the browser extension, which I don't trust much.
1password is a slight step up from LastPass.
I heard great things about BitWarden and it looks compelling but haven't tried it yet.
Hashicorp Vault is great, but IMO not suitable for "manual" credentials and more for provisioning and maintaining secrets that are fetched by your internal services. If you need non-engineers to have access to it for shared web app accounts etc, Vault is probably not a good choice.
I haven't use the 2FA option yet, and it has a Google Authenticator equivalent.
Bug is open already for a year :-(
P.S. 1password has it.
Security wise, we looked at the 1Password CVE history[1] and it seems pretty ok.
https://cve.mitre.org/cgi-bin/cvekey.cgi?keyword=1password