You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…
Never pay the "SSO tax" by outsourcing to Okta, etc. There many FOSS IdP solutions that are usable with some customization and integration.
Ask HN: How to store and share passwords in a company?
221–230 of 297 posts
Re: Ask HN: How to store and share passwords in a company?
#222Earlier quoted context omitted.
SSO + 2FA is more secure in practice than letting people create/manage their own accounts at every service. Because: - You can force a password policy centrally (minimum 12 char + uppercase/lowercase + number etc), for every service the company is using that supports SSO. - You can force 2FA, again for every service the company is using that supports SSO. - You can disable an account immediately from the central admi…
Yes good points. I have to argue the second part of this though > minimum 12 char + uppercase/lowercase + number The first minimum char counts rule is great. You increase the entropy exponentially with every added char. But the second part when you make rules about each individual char, then you are actually decreasing entropy. The space of possibilities actually shrinks every time a rule defines what a char must or…
Re: Ask HN: How to store and share passwords in a company?
#223Earlier quoted context omitted.
That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.
> LastPass There was the time they lost customer data in a hack and then lots of customers data was exploited. https://en.m.wikipedia.org/wiki/LastPass
Many sites have forgotten password flows, they’re easy, but many other sites related to municipal services, etc, require hours on calls, often on hold, proving my identity and getting access reinstated.
Re: Ask HN: How to store and share passwords in a company?
#224I've built security programs at 3 companies. This is how I would solve these problems. 1. SSO everywhere. Okta if budget is no concern and Keycloak if it is. 2. Password manager for the entire company. Even if it's possible to go SSO everywhere, there are still secrets employees will need to manage. Give them a solution or they'll solve it on their own and not in a good way. I like 1Password. 3. All services use a se…
Re: Ask HN: How to store and share passwords in a company?
#225Earlier quoted context omitted.
Except the search function of bitwarden is totally broken. Searching for A B shows everything with A or B, not even with A and B at the top.
This could be a good first contribution to Bitwarden for me or anyone really. Do you mean the browser extension search feature? Thanks for pointing it out.
Re: Ask HN: How to store and share passwords in a company?
#226Earlier quoted context omitted.
We have SSO + 2FA in place, and would like to use Bitwarden for the rest of the password management. But for a company around ~50 people, the pricing feels too expensive, considering the only purpose is to manage a few passwords. So for now we are using Keepass which is kind of painful, but free. We would probably be willing to pay ~2$ per user per month, but instead it is 6$ if you want Bitwarden to work integrated…
We went with self-hosted Passbolt. Free, open source, and based on PGP. Only downside is having to explain PGP to the less technical users...
Re: Ask HN: How to store and share passwords in a company?
#227Earlier quoted context omitted.
Pricing is truly annoying with password managers. I know this is an edge case but I volunteered for my kid’s school PTA and discovered to my horror that all the passwords were stored in a single Google Sheet. But the pricing for the number of users we were looking at (a very small core number of staff but a large number of volunteer parents) made pretty much every password manager service unaffordable, even with non…
I know very little about PTAs, but... why would a PTA need to share passwords anyways, instead of having separate logins?
Re: Ask HN: How to store and share passwords in a company?
#228Earlier quoted context omitted.
Pricing is truly annoying with password managers. I know this is an edge case but I volunteered for my kid’s school PTA and discovered to my horror that all the passwords were stored in a single Google Sheet. But the pricing for the number of users we were looking at (a very small core number of staff but a large number of volunteer parents) made pretty much every password manager service unaffordable, even with non…
Hi! could you please explain what is this admin work that is bothering you? Thanks! (working at Dashlane, and happy to forward feedback to product team. I'll already forward your comment on pricing)
It’s a really weird edge case but eye opening for me as someone who is usually in a very well resourced tech environment. Google offers a great free tier for non profits and in the ideal world we’d have a password manager that plugs into our Google organization without a second thought. But that’s a premium tier feature and any money not spent on enriching the kids education has to be justified to the nth degree. We have people who are go-tos for a two factor auth code because their phone numbers are the ones attached to the accounts… people will go to surprising lengths!
There isn’t a good business case for it as such but volunteer organizations (as opposed to well resourced non profits) would make good use of a free tier and it would generate goodwill with people who are sometimes responsible for purchasing decisions in their day jobs.
Re: Ask HN: How to store and share passwords in a company?
#229You generally want to minimize the number of passwords you manage; for instance, you should generally be paying the SSO tax and getting as many services as you can onto OIDC. After that, just do the cloud version of 1Password, which is easy to audit and manage access for, which you'll thank yourself for when it comes time to SOC2. Remember, as you give people access to passwords, that those passwords will need to be…
That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.
For example here some issues I flagged to the team. Note that some of them may possibly have been resolved since then:
– The “incorrect ciphers” error that keeps happening where you have to restart Bitwarden and lose all your changes.
– Basic searches take multiple seconds if you have more than 400 entries.
– Editing items is awkward. Whenever I scroll down an item and want to edit a specific entry, I have to find the edit button and then WOOSH a new panel appears and I don’t know where the field I wanted to edit ended up in the new panel.
– Bitwarden doesn’t automatically categorize login items by type and it's not possible to exclude items from the “All Items” list. So it's a big mess and when you try to search a massive amount of irrelevant auto-generated entries pop up.
– Scrolling is super laggy on Android.
– Android logins don't have icons (they could very easily extract them when Bitwarden automatically creates an entry when logging on an Android app).
– Phone numbers are not formatted. Same for many other data types.
– Credit/debit cards show a generic icon rather than Mastercard, Visa, American Express, etc.
– The whole interface is marked as selectable in CSS and when you try to move the window around it keeps selecting irrelevant text from the UI such as “Search Vault” and “Item Information” instead of moving the window. Likewise, if I try to select actual text the selection isn't constrained to the field I'm selecting from so I often select a bunch of crap I didn't mean to select.
– Clicking on a password field doesn't offer the option to generate a password.
– Password generation settings don't synchronize between Bitwarden instances. Every time you install the app or the browser extension you have to reconfigure the length, symbols, letters, casing, etc. Again. By default it uses Bitwarden's default basic (and pretty insecure) criteria.
– Bitwarden frequently doesn't detect password fields, and frequently doesn't offer to automatically save the password.
– Can’t drag & drop an item from the list to a folder. I have to manually edit the item entry and select the folder from the dropdown. Every time.
– When editing an item, the ‶Attachments″ entry is a tiny line hidden below ‶Master password re-prompt″ so it's incredibly easy to miss and hard to find.
– Attachments don’t have previews and you can't rename them. You have to manually download a given item and open it in order to see what it's about.
– Can't copy attached images to the clipboard. Instead you have to press the download button, pick a folder, find it, copy the file (or possibly open it with an image editor when you need to copy the image itself), and then paste it where you want.
– Automatic entry names are dumb. For example for Android apps it just picks the package name (e.g. com.voyagerx.scanner) instead of the name of the app (in this example the corresponding app's name is vFlat, so not clear from the package name!).
And this is only the tip of the iceberg. I had many more issues than those with Bitwarden. None of these issues happen on 1Password.
Re: Ask HN: How to store and share passwords in a company?
#230Earlier quoted context omitted.
That is the answer. SSO, then password manager. I'd strongly recommend bitwarden, having deployed and managed it. I would warn against lastpass, strongly, due to papercut level issues everywhere. I haven't used 1password in an appropriate scenario to comment on it.
> LastPass There was the time they lost customer data in a hack and then lots of customers data was exploited. https://en.m.wikipedia.org/wiki/LastPass
Just no.