4 ms·

I hate KeePass so much at work. But we still have to use it because our security leadership insist on it. It's not a bad tool for a home user with one PC but it

I hate KeePass so much at work. But we still have to use it because our security leadership insist on it. It's not a bad tool for a home user with one PC but it's totally inadequate for an enterprise scenario. But they keep insisting it's safe because it's been audited and the encryption is strong. Sure but what's the point of encryption if you store the password in a text file in the same folder or in some cases in the actual filename :( I've compiled a huge list of issues to convince them. Like no audit logs. No password complexity enforcement. No single password sharing with third parties (you have to give them the entire thing and password or create a new one which they can open forever). No central overview. We have no idea how many passwords are stored, how well they are secured (the master password) and who they are shared with and when. Has anyone found a good argument to convince your leadership? And what did you move to?

janef0421 4y ago
The kdbx format used by KeePass is an open standard, and can be used by a variety of password management applications. Perhaps another app using that format might be a better fit for you and your organisation?
- GekkePrutser 4y ago
  No, our company doesn't allow any of the other apps because they have not been audited. Which also means we don't have a solution for Mac. But most of my concerns are centered around the fact that it's just files not centrally managed.
  - janef0421 4y ago
    I don't think you're going to have much luck convincing your organisation to adopt a centralised service. Simply having files is as close to free as possible, while even a self-hosted centralised service will have a significant cost in terms of service time and administration. That's probably why they're so against change.
benhurmarcel 4y ago
My company also pushes Keepass. The main reason is that it's free and there's no server to run. Getting a budget for something in a large company is a pretty large barrier.

janef0421 4y ago

The kdbx format used by KeePass is an open standard, and can be used by a variety of password management applications. Perhaps another app using that format might be a better fit for you and your organisation?

GekkePrutser 4y ago
No, our company doesn't allow any of the other apps because they have not been audited. Which also means we don't have a solution for Mac. But most of my concerns are centered around the fact that it's just files not centrally managed.
- janef0421 4y ago
  I don't think you're going to have much luck convincing your organisation to adopt a centralised service. Simply having files is as close to free as possible, while even a self-hosted centralised service will have a significant cost in terms of service time and administration. That's probably why they're so against change.

benhurmarcel 4y ago

My company also pushes Keepass. The main reason is that it's free and there's no server to run. Getting a budget for something in a large company is a pretty large barrier.