We use Keeper, and I hate the UX. Would much rather use 1Password or BitWarden, but alas, the IT powers that be have spoken. Better than nothing. We do share creds through it, so that’s nice.
Ask HN: Does your org use a password keeper?
11–20 of 74 posts
Re: Ask HN: Does your org use a password keeper?
#12If you're signing up 10k users. I'm sure the pricing for 1Password won't be 7.99.
Alternatively, have your tried SSO'ing everything?
Re: Ask HN: Does your org use a password keeper?
#13We use Passwordstate. It's the slowest password manager I've ever used by a large margin, and one of the slowest websites I've ever used period. I don't know if it's inherent to the application or if it's how it's deployed for us.
I left an organisation that used passwordstate, it's ridiculously slow. Glad I left that behind me. AFAIK it's very profitable for the owner but it's pretty rare to see in the wild so I must ask.
Do you work at TechnologyOne? :-P
Re: Ask HN: Does your org use a password keeper?
#14> The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary
That's your red flag right there. All identities that are tied to individual people should be connected to SSO in some way, then there will be no juggling of passwords at all on the individual-person level. Then you only need some 2FA solution on top in your identity provider, for instance TOTP or FIDO, and you're all set. (Corollary: If at all possible, only pick external services that can plug into your company's own SSO.)
For credentials not tied to individual people, e.g. root passwords on devices, my org uses HashiCorp Vault, and we're mostly satisfied with it. It's a bit of a struggle to configure the policies so that each group of (human/technical) users only has access to the secrets that they actually need, but I won't put the blame for that on Vault.
Re: Ask HN: Does your org use a password keeper?
#15You could possibly host https://www.passbolt.com/ on your own servers and reduce the cost for your org.
I am sure, 1Password will be more than happy to offer you a discounted rate
Re: Ask HN: Does your org use a password keeper?
#16LastPass is great. We can share credentials and secrets through it. There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
We use LastPass and I hate it.
Re: Ask HN: Does your org use a password keeper?
#17LastPass is great. We can share credentials and secrets through it. There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
> There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
Is there anything that stops someone from letting LastPass fill the field, then use the browser tools to change the form field from `password` to `text`?
Re: Ask HN: Does your org use a password keeper?
#18LastPass is great. We can share credentials and secrets through it. There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
Can't really agree with that. For me, LastPass is a huge annoyance (it wants to fill in passwords on pages that these passwords definitely don't belong to, and it prompts you to save passwords over and over again with no "don't save passwords on this page" checkbox), and its UI is not really good either (e.g. the floating "+" icon in the vault - if you want to create a new folder you have to hover over it, for other items, you have to click it. Also, neither of these functions is available in the context menu - huh?!). And don't get me started about the "feature" of letting users use passwords, but not see them - security by obscurity anyone?
Re: Ask HN: Does your org use a password keeper?
#19LastPass is great. We can share credentials and secrets through it. There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
> There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up. Is there anything that stops someone from letting LastPass fill the field, then use the browser tools to change the form field from `password` to `text`?
Even easier: let LastPass fill in the password in Chrome, save it with the browser's function, view it in the browser settings.
Re: Ask HN: Does your org use a password keeper?
#20We use Passwordstate. It's the slowest password manager I've ever used by a large margin, and one of the slowest websites I've ever used period. I don't know if it's inherent to the application or if it's how it's deployed for us.
I left an organisation that used passwordstate, it's ridiculously slow. Glad I left that behind me. AFAIK it's very profitable for the owner but it's pretty rare to see in the wild so I must ask. Do you work at TechnologyOne? :-P
I don't work at TechnologyOne, but I'm somewhat glad to know that it's slow everywhere and not just for us!