4 ms·

I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic fea

I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Password policies in Microsoft ADS systems are so broken that they have to change their password every 3 months for no reason whatsoever, effectively making all passwords predictable because the chance of someone using <year/month> or <month> as a password suffix is guaranteed. Let alone the old messed up SAP systems everywhere that are abused as a login database. SAP doesn't even support special characters, and the max password length is 9 characters (10 if you count the # that is used as a hack to implement MFA). They are so crappy that the password always is set by an external rented plugin that updates all passwords in an interval with password#token. And yes, this also kind of nullifies the token's initial purpose as a secondary system. Then there's stupid policies that logout a session every 5 minutes, while people need to use a program for hours on end. While also having a single button to relogin in an external window, in a program that is made in 90s Perl or Java. And then you are wondering why employees reuse passwords if the state of systems is _that_ close to being pwned? Really?

tstrimple 2y ago
> I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. > Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Not really. We likely wouldn't allow a marketing tool that couldn't integrate with auth standards. Which is why we have dozens of systems integrated together with one identity and SSO between everything. It's the companies that make dozens of exceptions from their auth standards that have to deal with this password sharing nonsense and security nightmare. Password sharing is a Bad Idea even if sometimes it's the most expedient.

tstrimple 2y ago

> I don't understand why most password manager software that's being used in Enterprise and even targets that market specifically does not have the most basic features that people need. > Sharing passwords to external company accounts is essential for a marketing department, for example. Yet the proposed solution is to use an Android device for that. Good luck recovering that after an attack. Not really. We likely wouldn't allow a marketing tool that couldn't integrate with auth standards. Which is why we have dozens of systems integrated together with one identity and SSO between everything. It's the companies that make dozens of exceptions from their auth standards that have to deal with this password sharing nonsense and security nightmare. Password sharing is a Bad Idea even if sometimes it's the most expedient.