7 ms·

> The most trusted open source password manager for business I expected a blog article with actual feedbacks from companies and data, but ended up on bitwarden

by vgalin 5y ago

> The most trusted open source password manager for business I expected a blog article with actual feedbacks from companies and data, but ended up on bitwarden.com main page. Baseless claims can be quite common when it comes to marketing, but I'm genuinely curious: which password manager is used in your workplace, if any? I've personally never seen in my (for now short) career anything else than Keepass.

oxfordmale 5y ago
My company uses 1Password, in my previous company we used LastPass.
aniforprez 5y ago
Workplace uses 1Password. I've been using it personally for years and I love it. Completely worth the subscription cost though it has its quirks I like Bitwarden and the work they do and I'm sure they're trustworthy seeing as they've been audited and such but the android app and some of the UI is clunky to say the least. I tried switching from LastPass (which is awful) and ended up going to 1Password
- chiefalchemist 5y ago
  I use BW at home and 1PW at work - both via browser extension. I cringe and/or swear at 1PW far more often than BW.
  - aniforprez 5y ago
    I've not found much reason to swear or cringe at 1Password... maybe ever. I was a bit frustrated once when it gave the wrong popup when filling out my addresses. What is your use case if you don't mind me asking?
    - zwirbl 5y ago
      1Password once "forgot" an autogenerated password for a government webservice, where I had to used a snailmailed one time password. I needed to get another OTP for registration. It never happened to me again, but having a wrong password stored was really annoying. I've switched to Bitwarden recently and, for the most part, am happier than before.
  - rekabis 5y ago
    Same here. Like, literally. 1PW just seems so much clunkier and more difficult to work with. The thing being, 1PW does have a handful of enterprise-level features that seem to be more efficient for managing passwords across the enterprise. That seems to be about the only edge it appears to have, which is why it probably appears more attractive to corporations.
nicoburns 5y ago
We use Bitwarden at work. Bitwarden and Keepass are the two on my "trusted" list. Keepass has higher trust because it's offline only. But Bitwarden has a very good reputation and has open sourced both the clients and the server, so they are a close enough second for me, and it's much more convenient having cloud sync.
gjvc 5y ago
> The most trusted open source password manager for business OP here; this hype bothered me, but to avoid being accused of editorialising the target link, I try to include any strap line in full in the HN link description field.
wirelesspotat 5y ago
My current and previous company both use 1password. I use Bitwarden personally. I like them both - 1password has better UX but I prefer supporting open source for personal use.
- cies 5y ago
  > I prefer supporting open source for personal use. Same here. Opensource also adds to security in this case. Also BitWarden's server has no knowledge of your phrase, and hence cannot, never ever, read your data. Forgetting your phrase means you lose your wallet. 1Pass and competitors do not have such guarantee, and allow one to retrieve access to the wallet by other means.
  - aniforprez 5y ago
    1Password's servers also cannot read your data. They use a client generated secret key in addition to your usual password to encrypt your vaults. It's been detailed pretty well https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
    - cies 5y ago
      Are all clients open source? If I loose all my keys is there no way to recover the data? And how does this work when I share passwords with my colleagues in a vault? They dont have my "client generated secret key", so how can they read my passwords? I know companies write stuff to sell their products, but I dont trust that, I prefer open source and the laws of logic over marketing.
      - jviide 5y ago
        1Password has a pretty good white paper explaining their security design (PDF behind the link): https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p.... The parts "How Vault Items Are Secured" and "How Vaults Are Securely Shared" go into sharing passwords in a vault. For the record, Bitwarden's white paper is a good read as well. Available at https://bitwarden.com/help/article/bitwarden-security-white-paper/ https://bitwarden.com/help/article/bitwarden-security-white-.... (edit: fixed typos)
thisdrunkdane 5y ago
We're using 1Password & I've used it personally many years before
cudder 5y ago
We're on the process of migrating from LastPass to self-hosted Psono[0]. I've not yet used Psono enough to say anything except that it seems better than LastPass, but that's not a hard goal to reach. With LastPass the whole UI/UX seemed awfully complex and cluttered and devoid of many handy QoL features like copying a password straight to clipboard. Their Chrome extension is also a true heavyweight[1]. [0]: https://psono.com/ https://psono.com/ [1]: https://news.ycombinator.com/item?id=21172569 https://news.ycombinator.com/item?id=21172569
19870213 5y ago
PasswordState for us (and we're predominantly a Java/PHP/Linux shop).
- sam_lowry_ 5y ago
  Linux would naturally lean to the pass ecosystem e.g. pass, browserpass gopass, PasswordSafe app, etc. See https://www.passwordstore.org/ https://www.passwordstore.org/
- AyyWS 5y ago
  PasswordState licensing and support was great. I administed it for a small robotics company. PasswordState devs added a requested feature in about 3 weeks from a forum post I made.
zepearl 5y ago
Keepass
- volkanvardar 5y ago
  +1
KronisLV 5y ago
> I've personally never seen in my (for now short) career anything else than Keepass. KeePass (https://keepass.info/ https://keepass.info/) is excellent for personal usage or for infrequently changing credentials in a team setting, which is why i've also had a good run with it! That said, for something a bit more centralized and more easily manageable, i've seen solutions like TeamPass be used: https://teampass.net/ https://teampass.net/ Well, TeamPass in particular has a pretty horrible UI (not respecting what i click with my mouse and janky dragging of items around, as well as weird display rules), but in general i feel like many companies out there might want a web app of sorts, even if only available in the internal network and self hosted.
- Aerroon 5y ago
  The nice thing with keepass is that you manage the password database and key yourself.
  - majewsky 5y ago
    The problem with keepass is that you have to manage the password database and key yourself. (Not for most of us here, but for most people out there.)
    - Aerroon 5y ago
      I'm not sure how big of a problem this really is. Yes, it's definitely more difficult for a non-technical user to manage this, but if they have an idea about how important keeping their passwords safe is then would they trust that to a third-party? I don't think my mom would trust any service with her passwords.
chrysoprace 5y ago
We use Lastpass; I've never been a big fan of the sharing features. I use Bitwarden for personal use.
- belic 5y ago
  I moved to Bitwarden from Lastpass last year. Ironically I remember needing some premium feature, and having issues subscribing to premium. Support was 0/10, and made me move to Bitwarden, but I was really happy with Lastpass. Feature I miss today is security checkup.
  - potency 5y ago
    Glad it wasn't just me. I was trying to get a repeatable issue with a particular site resolved, and support was beyond useless, i.e. unresponsive for up to two weeks, repeating the same scripted BS they had sent me previously, etc. Despite my pleading I was never able to get to a level 2 where someone could actually look at my problem.
  - linsomniac 5y ago
    Support USED to be great, ~2-3 years ago when I first signed up. I noticed around a year ago when I made a support request that it went way downhill. I get the impression that they outsourced it to India.
  - bearbearbear 5y ago
- gwbas1c 5y ago
  I like Lastpass, but I have one major complaint. (This could be a limitation of the browser) When I have to enter my master password into the browser, I'm left with the Lastpass tab focused instead of the site that I'm trying to log into. Although this is annoying for me, it's probably a major obstacle for people who aren't very good at computers.
NikolaNovak 5y ago
Workplace (major consulting company) uses 1password. Keepass is kinda sorta allowed. Note for context - we are in a company that for obvious and less obvious reasons has a detailed list and tiering of allowed open source software for various purposes; while we have more control over our laptop than most companies such size, policies are fairly firm on what we are and aren't actually supposed to install.
quijoteuniv 5y ago
Any experience with Secret server from thycotic?
- ricardbejarano 5y ago
  I've used it before, it sucks. It does the job, but very poorly. Same as LastPass. I use 1Password now. If I didn't want to pay for it I'd use KeePass.
- belic 5y ago
  We have it, and I don't like it. Slow, bad UI, and not very reliable.
ricardbejarano 5y ago
LastPass, everyone hates it including me.
Tier2Capital 5y ago
KeePassXC and Strongbox for (Apple products) personal use
Zababa 5y ago
Lastpass. I didn't know it was possible to make a web page that slow.
IggleSniggle 5y ago
Bitwarden is open source. It is auditable. You can host it wherever you like or you can support the devs. I think it’s great.
edoceo 5y ago
This could be an HN Poll? Also, we use Passbolt.
- wartijn_ 5y ago
  I created a poll for this. It's about personal use instead of use in companies though. https://news.ycombinator.com/item?id=29994703 https://news.ycombinator.com/item?id=29994703
jehb 5y ago
I agree, this is the sort of statement that should be backed up by... something. But we do use Bitwarden where I work (large enterprise software vendor). Adoption is not consistent, but it's the IT supported solution here.
JosieFi 5y ago
We are using bitwarden currently. It seems to work well for our purposes.
Emptysister 5y ago
keepass and vaultwarden (bitwarden-api compatible server)
loceng 5y ago
Someone with good post draw should create a poll.
mkbkn 5y ago
I work for a marketing agency as a contractor and they use Bitwarden. Also, I'm a happy and paying user personally.

by vgalin 5y ago

oxfordmale 5y ago

My company uses 1Password, in my previous company we used LastPass.

aniforprez 5y ago

Workplace uses 1Password. I've been using it personally for years and I love it. Completely worth the subscription cost though it has its quirks I like Bitwarden and the work they do and I'm sure they're trustworthy seeing as they've been audited and such but the android app and some of the UI is clunky to say the least. I tried switching from LastPass (which is awful) and ended up going to 1Password

chiefalchemist 5y ago
I use BW at home and 1PW at work - both via browser extension. I cringe and/or swear at 1PW far more often than BW.
- aniforprez 5y ago
  I've not found much reason to swear or cringe at 1Password... maybe ever. I was a bit frustrated once when it gave the wrong popup when filling out my addresses. What is your use case if you don't mind me asking?
  - zwirbl 5y ago
    1Password once "forgot" an autogenerated password for a government webservice, where I had to used a snailmailed one time password. I needed to get another OTP for registration. It never happened to me again, but having a wrong password stored was really annoying. I've switched to Bitwarden recently and, for the most part, am happier than before.
- rekabis 5y ago
  Same here. Like, literally. 1PW just seems so much clunkier and more difficult to work with. The thing being, 1PW does have a handful of enterprise-level features that seem to be more efficient for managing passwords across the enterprise. That seems to be about the only edge it appears to have, which is why it probably appears more attractive to corporations.

nicoburns 5y ago

We use Bitwarden at work. Bitwarden and Keepass are the two on my "trusted" list. Keepass has higher trust because it's offline only. But Bitwarden has a very good reputation and has open sourced both the clients and the server, so they are a close enough second for me, and it's much more convenient having cloud sync.

gjvc 5y ago

> The most trusted open source password manager for business OP here; this hype bothered me, but to avoid being accused of editorialising the target link, I try to include any strap line in full in the HN link description field.

wirelesspotat 5y ago

My current and previous company both use 1password. I use Bitwarden personally. I like them both - 1password has better UX but I prefer supporting open source for personal use.

cies 5y ago
> I prefer supporting open source for personal use. Same here. Opensource also adds to security in this case. Also BitWarden's server has no knowledge of your phrase, and hence cannot, never ever, read your data. Forgetting your phrase means you lose your wallet. 1Pass and competitors do not have such guarantee, and allow one to retrieve access to the wallet by other means.
- aniforprez 5y ago
  1Password's servers also cannot read your data. They use a client generated secret key in addition to your usual password to encrypt your vaults. It's been detailed pretty well https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
  - cies 5y ago
    Are all clients open source? If I loose all my keys is there no way to recover the data? And how does this work when I share passwords with my colleagues in a vault? They dont have my "client generated secret key", so how can they read my passwords? I know companies write stuff to sell their products, but I dont trust that, I prefer open source and the laws of logic over marketing.
    - jviide 5y ago
      1Password has a pretty good white paper explaining their security design (PDF behind the link): https://1passwordstatic.com/files/security/1password-white-paper.pdf https://1passwordstatic.com/files/security/1password-white-p.... The parts "How Vault Items Are Secured" and "How Vaults Are Securely Shared" go into sharing passwords in a vault. For the record, Bitwarden's white paper is a good read as well. Available at https://bitwarden.com/help/article/bitwarden-security-white-paper/ https://bitwarden.com/help/article/bitwarden-security-white-.... (edit: fixed typos)

thisdrunkdane 5y ago

We're using 1Password & I've used it personally many years before

cudder 5y ago

We're on the process of migrating from LastPass to self-hosted Psono[0]. I've not yet used Psono enough to say anything except that it seems better than LastPass, but that's not a hard goal to reach. With LastPass the whole UI/UX seemed awfully complex and cluttered and devoid of many handy QoL features like copying a password straight to clipboard. Their Chrome extension is also a true heavyweight[1]. [0]: https://psono.com/ https://psono.com/ [1]: https://news.ycombinator.com/item?id=21172569 https://news.ycombinator.com/item?id=21172569

19870213 5y ago

PasswordState for us (and we're predominantly a Java/PHP/Linux shop).

sam_lowry_ 5y ago
Linux would naturally lean to the pass ecosystem e.g. pass, browserpass gopass, PasswordSafe app, etc. See https://www.passwordstore.org/ https://www.passwordstore.org/
AyyWS 5y ago
PasswordState licensing and support was great. I administed it for a small robotics company. PasswordState devs added a requested feature in about 3 weeks from a forum post I made.

zepearl 5y ago

Keepass

volkanvardar 5y ago
+1

KronisLV 5y ago

> I've personally never seen in my (for now short) career anything else than Keepass. KeePass (https://keepass.info/ https://keepass.info/) is excellent for personal usage or for infrequently changing credentials in a team setting, which is why i've also had a good run with it! That said, for something a bit more centralized and more easily manageable, i've seen solutions like TeamPass be used: https://teampass.net/ https://teampass.net/ Well, TeamPass in particular has a pretty horrible UI (not respecting what i click with my mouse and janky dragging of items around, as well as weird display rules), but in general i feel like many companies out there might want a web app of sorts, even if only available in the internal network and self hosted.

Aerroon 5y ago
The nice thing with keepass is that you manage the password database and key yourself.
- majewsky 5y ago
  The problem with keepass is that you have to manage the password database and key yourself. (Not for most of us here, but for most people out there.)
  - Aerroon 5y ago
    I'm not sure how big of a problem this really is. Yes, it's definitely more difficult for a non-technical user to manage this, but if they have an idea about how important keeping their passwords safe is then would they trust that to a third-party? I don't think my mom would trust any service with her passwords.

chrysoprace 5y ago

We use Lastpass; I've never been a big fan of the sharing features. I use Bitwarden for personal use.

belic 5y ago
I moved to Bitwarden from Lastpass last year. Ironically I remember needing some premium feature, and having issues subscribing to premium. Support was 0/10, and made me move to Bitwarden, but I was really happy with Lastpass. Feature I miss today is security checkup.
- potency 5y ago
  Glad it wasn't just me. I was trying to get a repeatable issue with a particular site resolved, and support was beyond useless, i.e. unresponsive for up to two weeks, repeating the same scripted BS they had sent me previously, etc. Despite my pleading I was never able to get to a level 2 where someone could actually look at my problem.
- linsomniac 5y ago
  Support USED to be great, ~2-3 years ago when I first signed up. I noticed around a year ago when I made a support request that it went way downhill. I get the impression that they outsourced it to India.
- bearbearbear 5y ago
gwbas1c 5y ago
I like Lastpass, but I have one major complaint. (This could be a limitation of the browser) When I have to enter my master password into the browser, I'm left with the Lastpass tab focused instead of the site that I'm trying to log into. Although this is annoying for me, it's probably a major obstacle for people who aren't very good at computers.

NikolaNovak 5y ago

Workplace (major consulting company) uses 1password. Keepass is kinda sorta allowed. Note for context - we are in a company that for obvious and less obvious reasons has a detailed list and tiering of allowed open source software for various purposes; while we have more control over our laptop than most companies such size, policies are fairly firm on what we are and aren't actually supposed to install.

quijoteuniv 5y ago

Any experience with Secret server from thycotic?

ricardbejarano 5y ago
I've used it before, it sucks. It does the job, but very poorly. Same as LastPass. I use 1Password now. If I didn't want to pay for it I'd use KeePass.
belic 5y ago
We have it, and I don't like it. Slow, bad UI, and not very reliable.

ricardbejarano 5y ago

LastPass, everyone hates it including me.

Tier2Capital 5y ago

KeePassXC and Strongbox for (Apple products) personal use

Zababa 5y ago

Lastpass. I didn't know it was possible to make a web page that slow.

IggleSniggle 5y ago

Bitwarden is open source. It is auditable. You can host it wherever you like or you can support the devs. I think it’s great.

edoceo 5y ago

This could be an HN Poll? Also, we use Passbolt.

wartijn_ 5y ago
I created a poll for this. It's about personal use instead of use in companies though. https://news.ycombinator.com/item?id=29994703 https://news.ycombinator.com/item?id=29994703

jehb 5y ago

I agree, this is the sort of statement that should be backed up by... something. But we do use Bitwarden where I work (large enterprise software vendor). Adoption is not consistent, but it's the IT supported solution here.

JosieFi 5y ago

We are using bitwarden currently. It seems to work well for our purposes.

Emptysister 5y ago

keepass and vaultwarden (bitwarden-api compatible server)

loceng 5y ago

Someone with good post draw should create a poll.

mkbkn 5y ago

I work for a marketing agency as a contractor and they use Bitwarden. Also, I'm a happy and paying user personally.