Ask HN: What's the best corporate password manager?

Pretty new to it (~3 months), I've been using it in docker, using https://github.com/dani-garcia/bitwarden_rs

The official docker version looked way too complicated imo -> https://github.com/bitwarden/server/blob/master/scripts/run....

Pretty straightforward, lightweight, no issues so far

While 1Password is fantastic, their CLI is the worst CLI I’ve ever seen. Basically unusable.

You should just be able to say “give me the password for yahoo.com” but you can’t actually do that.

I wanted to use it to get npm 2FA on the command line and just gave up completely.

EDIT: if someone from 1Password reads this, please reach out. I have good CLI UX experience and would love to help fix it.

If you have someone technical to set these up AND keep them up.

Many of those cool things take night or weekend to set up and that’s kind of fun to do. Regular patching and potential troubleshooting is the less fun part you get to do when adopting a new app.

This has not been my experience. Trello is a good example. They have an enterprise tier that they basically starts at 100 users. Their business tier does not include SSO and I have a team of 60 people so the enterprise tier (which is about $250/person, by the way, compared to $12 a person for business) is out. Slack charges nearly double for their enterprise tier with SSO. I would not call not getting getting the tier down from the enterprise tiers a "dirty workaround" for most teams.

I currently have a stack of pem file management using terraform, lambda and this api.

When creating an ec2, we call a module that creates a tls key, a keypair and an object in a bucket.

This object creating triggers a lambda that downloads the objects contents, namely the pem key and calls the api to save it to 1password as a document.

This newly created document is available to every member that has access to the vault without having direct access to the bucket itself.

Another use I had was to create credentials for sonarqube automatically. We have a relatively large team on github and wanted to add sonarqube to the stack. What I did was just read every members name, email and username from github, create the respective users using sonarqube api and register their credentials using the sdk. It was trivial then to send them a copy of their credentials, a lot easier and less error prone than doing it by hand.

Many other use cases can be thought. You could implement iam key rotation using this. You could share support credentials for your team using 1password and have automated tools read from the same source.

It really just make everything easier to replicate, integrate and manage using this api or the python sdk. The last thing you want is to screw someones credentials because of a human error (typo, forgot to save the password etc...)

I've done this in a team in the past and we just put the encrypted keepass database in a private github repo. It mostly works out fine, the only pain in the butt is everyone needs to ensure that they pull down their repo and make sure its all up to date before they add anything to it.

Google drive seems to work fine here. I believe there's also a plugin for it rather than save to the folder and deal with the rare save conflicts.

(This with 2 factor passphrase and key file, btw)

We use Dropbox. We all memorise the master password, then have the Keepass database in a shared Dropbox directory we all have access to.

That last one, the drop down menu getting some auto full garbage which obscures choices and interferes with selection is annoying.

Chrome extension was broken for several days, that was painful, pulling out my phone for long passphrases on various sites.

While I wish the bitwarden UI could stay over the top a little better, been really appreciating it vs lastpass... it's a bit simpler and less confusing overall. Not quite the same feature set, but that's okay..

I do wish the autofill wasn't two menus deep though. (right-click, bitwarden -> autofill -> list) wish it just expanded autofill (if less than say 5 matches) on the right-click menu.

Lastpass has a feature called auto password change [0] that allows you to update a password directly from inside lastpass at the click of the button. It doesn't work for all sites but it's a pretty nice feature.

[0] https://helpdesk.lastpass.com/generating-a-password/auto-pas...

I haven't had that problem with BitWarden in testing, but I can't change to BW until they come up with some solution for having both a work and and personal vault. The ability to link-in your personal LastPass to your work LP without actually giving your employer any access to your personal LP is really beneficial to my staff.

Yeah. While I can understand wanting to be able to reset a user's password as an administrator of other users (eg. an IT department supporting those who forget their master password), it's also a security problem to allow such a feature. Basically, all user accounts under an organization would need to be encrypted with two separate passwords: the user's, as well as the IT/admin/company "master key". Having all users' passwords encrypted with a master key password to allow resets means all users' passwords across the entire organization can be compromised by a single IT employee's master key password.

Personally, I'm ecstatic that there is no recovery process to reset or recover a Bitwarden master password. No security questions. No email reset. No one-time use login codes (which would need to be stored somewhere not encrypted by a user's secret key in order to verify). Again, I can understand why an IT department would want that, but all that does is open up attack vectors that are very easy for an attacker to abuse.

The whole point of the master password is it's the ONE AND ONLY password you cannot forget or lose. One... lousy... password.

I understand what you are saying but part of security is making it easy enough that people will use it, but hard enough it isn't easy to break for bad actors. People are lazy in general, if you tell 25 engineers at a startup they have to use two different tools just too handle credentials, the compliance rate of using 2fa will drop to nil, making accounts easier to hack. Don't get me wrong, it isn't like 2fa is so secure, it has been shown to be hackable for sure, especially when using SMS devices; but if done properly it can add a level of extra effort for a bad guy and if that extra effort is easy for engineers to use they'll do it. 1Password makes it this way.

From a corporate standpoint, I don't want people using their personal devices for SMS OTP (2fa) because then if they leave, are disgruntled or get tragically hit by a bus I am locked out of a potentially important service/account. I had this happen on three accounts in the past year where one took me 3 days to recover the ability to access it, another I never could recover and we had to work around it and a third that was absolutely critical but took close to two weeks all said (lots of waiting). That is insane, and all because people used their own personal devices (or similar) for SMS 2fa.

There are other devices you can use, and some enterprises do use hardware keys in addition to the password which works well and the more sensitive the system the more inconvenience people will tolerate and understand.

For me it boils down to 1Password works good for a reasonable price which helps startups and small companies. I also don't think using 1Password is just a tool and you still need a good password refresh cycle and to stop reuse etc. This way if a backup at 1Password was somehow compromised or stored improperly at your company or at 1Password at least you'd be insulated better.

It definitely does provide a single point of access that if compromised in a way which bypasses all their security a lot of companies will be hurting.

The argument I've seen provided for this is that an attacker would both need your password and physical access to a device with 1password already set up on it.

To use 1password on a new device, you need a "secret key" that is provided to you when you create your account which serves as a basic form of 2FA for your whole account. Not a perfect system, but it is not as simple as just getting your password and having access to everything.

I just stopped called it 2fa, and just otp for “one time password”, the URI standard calls it otp:// as well

see problem solved, no need to debate how single or two factor a thing is and you can just focus on the attack vectors it actually still solves for, objectively

yes the password vault is a single point of failure if someone knows your vault password or key logs it.

If an attacker has gained access to your vault you have much, much more to worry about than if 2FA codes are there or not.

I don't use 1PW for teams, but I do use it personally and use it to store all my OTPs except my OTP credential to access 1Password itself. I use a different authenticator app for that (happens to be Microsoft, but that doesn't matter really).

So, while I think it storing storing your passwords beside your OTP generator isn't great, if both are locked behind another factor of authentication, you have mitigated that risk significantly.

It’s not very trivial to gain access to a 1password account:

1. Attacker needs access to the physical device of the account holder if they know the credentials.

2. Otherwise, they need to know credentials + secret key on a new device.

3. You can set up Google Auth to access the account in the first place, which can have its own separate 2fa (this is what we do)

There are still good reasons:

1password requires more than just a password to access. You need the encryption key. It acts nicely for that purpose.

2fa is unnecessary if you're generating 20 character passwords uniquely for every site.

The best security is like the best camera. There is no better camera than the one you actually use. This is why cell phone cameras are the best. This is why 1password is the best, because it is security you always use and always keep safe.

I am a Bitwarden user (three years paying for premium) and while I like it the desktop app isn't as feature rich or as smooth to use as 1Password imho.

It lacks biometrics support for one which is something I wish they would add but I believe as it is an Electron app they cannot do so, at least not on macOS.

The iOS and Android apps are decent enough though. They support Touch/FaceID and the Android equivalents. With the exception that the iOS app has "Live Sync" (i.e. push notifications to sync the vault when a change is made elsewhere) but they never work. I recently made a post about this on the Bitwarden support reddit [0] but had no response from the developer there or on Twitter which is a shame. Live Sync works fine on Android though so it is clearly an iOS issue only.

If 1Password were cheaper, or if my needs were more complex, I would switch away from Bitwarden but as a home user it is "good enough".

[0] https://old.reddit.com/r/Bitwarden/comments/f1besd/has_live_...