4 ms·
Cool, product. I'm not super excited about the use of WebCrypto, but it isn't any worse than storing passwords in the clear in a database. My biggest question
by helper 11y ago
Cool, product.
I'm not super excited about the use of WebCrypto, but it isn't any worse than storing passwords in the clear in a database.
My biggest question is does it support having an audit log of who accessed what credentials when? If that is supported I could see some our our teams switching over to this.
- jxpx777 11y ago1Password for Teams does have auditing for changes. We will be adjusting and expanding how that is exposed in the admin console over time.
- helper 11y agoAuditing who accesses credentials is just as important as auditing changes for us.
- AGKyle 11y agoHi helper! I've put this in a document I hope to send to the team this evening and I have added your comments on what is important to you. If you have any others please let me know. This is just the initial beta and we fully intend to bring even more great features to 1Password for Teams. Requests can certainly help drive that direction a little bit so let me know what's important and we'll see what comes up on top. Kyle AgileBits
- snuxoll 11y agoAuditing who accesses credentials is pointless, IMO. So you know that Tom, Jane and John have all accessed the domain admin credentials since they were changed last week, what good does that do you? They all have reason to do it, and any one of them could have written them down so it's not like you can audit who pulled them up 15 minutes before some huge security incident and know who was responsible.
- helper 11y agoNot necessarily. If you have an organization with 100 users and most systems are accessed rarely, an audit log can show you things like "Steve accessed ALL the credentials."
- jpgoldberg 11y agoTake a look at the discussion of "Crypto in the Browser" in the draft white paper for a discussion of WebCrypto. [Disclosure: I work for AgileBits]