We used Okta (SSO) for a long time which is $2 per users afaik.
What did you move to after Okta?
Ask HN: Does your org use a password keeper?
41–50 of 74 posts
Re: Ask HN: Does your org use a password keeper?
#42> gets very pricey with 10k users With that many users you don't pay the advertised prices. You schedule a call and they make sure you get an affordable offer. > The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary Time for azure, auth0, okta, or some other sso provider to just get rid of the passwords?
I'm really not cut out to work for a big corporation. Even if they charged $0.50/per user, that would be $5k/month. I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days, and offer a support contract for $500/month. It's not even that much of rare skill. I'd guess you can randomly selected /r/selfhosted users and I'd give 10% of odds to find someone who…
> I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days
That's a very simplistic view of how it works in even a medium sized real company. Google SSO is already available for many external services you might use which is a lot easier to integrate than doing and maintaining something yourself. Especially because if there's an issue it's blocking everyone in the company at the same time. It makes sense to outsource that if it's not your core business.
Re: Ask HN: Does your org use a password keeper?
#43> The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary That's your red flag right there. All identities that are tied to individual people should be connected to SSO in some way, then there will be no juggling of passwords at all on the individual-person level. Then you only need some 2FA solution on top in your identity provider, for instance…
Easier said than done.
We rely on all kinds of industry-specific applications that only support username/password (and SMS OTP if we're lucky). After that, there are a bunch of services that do offer SSO but only if you pay stupid money. For example, we spend about $100/month on Twilio but their SSO plan starts at $15k/month.
Re: Ask HN: Does your org use a password keeper?
#44Earlier quoted context omitted.
I'm really not cut out to work for a big corporation. Even if they charged $0.50/per user, that would be $5k/month. I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days, and offer a support contract for $500/month. It's not even that much of rare skill. I'd guess you can randomly selected /r/selfhosted users and I'd give 10% of odds to find someone who…
IMO, 1Password has much much better UX than Vaultwarden has. So you definitely get something for the money.
That's the other part that breaks my lizard brain.
We are talking about $5k/month vs $500. If the UX of the FOSS version is lacking, pay for the closed version BUT throw $1000/month on the direction of the FOSS developers until the issues are mitigated and they satisfy your requirements. I can bet that in less than a year you'd be able to make a switch and the investment would pay itself.
Re: Ask HN: Does your org use a password keeper?
#45Earlier quoted context omitted.
Can't really agree with that. For me, LastPass is a huge annoyance (it wants to fill in passwords on pages that these passwords definitely don't belong to, and it prompts you to save passwords over and over again with no "don't save passwords on this page" checkbox), and its UI is not really good either (e.g. the floating "+" icon in the vault - if you want to create a new folder you have to hover over it , for other…
It's as much as a pain as you make it. For me if I keep it well organized I basically just forget that I have to login to things at work, I just click them and I'm in or I navigate and it's filled. I can see how it might not be the solution you want for home but at work I'm just trying to get things done and that unfortunately involves a large number of passwords that can't easily be federated into an SSO like okta b…
I think the hate mostly comes out of being forced to use a solution and then being annoyed because it tries to force itself onto you. Yes, I confess, when I'm waiting for an important email I sometimes check private emails on my work laptop, and I would love to be able to just tell LastPass to not prompt me to save the credentials for my email provider into my company account, but it's simply not possible, and then the repeated "helpful" save password prompts annoy the hell out of me...
Re: Ask HN: Does your org use a password keeper?
#46LastPass is great. We can share credentials and secrets through it. There's a feature where you can even share the login to a site on it, but they can't view the password - only lastpass can fill it up.
LastPass is terrible if you want to use it for automation. There is no official support for the CLI interface (it's a community project), and it does not work on Windows by default (you'd need to install cygwin on every single server you wish to use the CLI, as opposed to a simple `winget install --name LastPass.CLI`). I cannot recommend that anyone use this product for enterprise use, especially for internal IT use.
Re: Ask HN: Does your org use a password keeper?
#47Earlier quoted context omitted.
I'm really not cut out to work for a big corporation. Even if they charged $0.50/per user, that would be $5k/month. I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days, and offer a support contract for $500/month. It's not even that much of rare skill. I'd guess you can randomly selected /r/selfhosted users and I'd give 10% of odds to find someone who…
> I could go as a consultant and charge half of that to setup vaultwarden integrated with their AD for maybe 2 lazy days That's a very simplistic view of how it works in even a medium sized real company. Google SSO is already available for many external services you might use which is a lot easier to integrate than doing and maintaining something yourself. Especially because if there's an issue it's blocking everyone…
I am talking specifically for the case of OP: a big company with 10k users that already has AD.
You are arguing a strawman.
Re: Ask HN: Does your org use a password keeper?
#48We don't have use a password manager for most users, but for those with access to many and varied accounts (like IT and anyone dealing with social media) we use VaultWarden, which is a FOSS re-implementation of BitWarden. We don't do any browser or AD integration though.
This is great! I didn't know this existed, but it looks like for self-hosting this is a much better solution than BitWarden proper (as it is lighter). This shall go on my synology.
VaultWarden is fantastic! It's super, super light and fast (Rust + sqlite) and happily runs on my Raspberry Pi 4 4GB in docker alongside 8 other containers. And if that wasn't good enough, all the 'premium' BitWarden features are also unlocked (organisations, etc.) in VaultWarden.
Re: Ask HN: Does your org use a password keeper?
#49> The average employee likely has 10-20 (hopefully) different sets of credentials that they must maintain and update as necessary That's your red flag right there. All identities that are tied to individual people should be connected to SSO in some way, then there will be no juggling of passwords at all on the individual-person level. Then you only need some 2FA solution on top in your identity provider, for instance…
Sorry should have clarified - we are a government organization that interacts with a number of other government agencies. It's simply not feasible for us to implement SSO for all of our own internal applications (many different units/teams), let alone the external apps/systems we are consumers of.
Re: Ask HN: Does your org use a password keeper?
#50Yes. BitWarden.