3 ms·

A password manager is the one thing I'm very skeptical to use SSO for.

by andix 1y ago

vasco 1y ago
So you're going to play IT and duplicate all the groups and all the roles manually that already are maintained and automated for on/off-boarding? And not have them be auto-offboarded when they are let go? That introduces compliance risks and imo more problems than having SSO on your password manager. Yes, keep some master password for a rainy day if you have to, but otherwise, the more "dangerous" the thing the more it should be hooked up to SSO.
wazzaps 1y ago
It's most useful for companies, where the goal is as much SSO as possible.
kriops 1y ago
Separate accounts for work and private. SSO for the work account is perfectly fine for me as a dev and a big advantage for the company. But yes, don't conflate the two use cases.
lucasyvas 1y ago
Difference between work and personal. For personal, you’re right because there is nothing to bootstrap off of. But in corporate it’s provisioned to a user account that exists first. My personal bootstrap is two Yubikeys (for redundancy) that contains the password and 2FA for my Proton Pass. This plays the role of what IT would in a company with a user directory.
jchw 1y ago
From this PR: > A master password is still required and not controlled by the SSO From the Bitwarden documentation[1]: > Locking your vault will maintain vault data on the device, so unlocking your vault can be done offline. You will be required to enter your master password or PIN, or use biometrics, but won't need to use any active two-step login methods. That really ought to quell the majority of the concerns IMO. Though for personal usage I use KeepassXC, because not having any remote authentication at all is even simpler than SSO. [1]: https://bitwarden.com/help/vault-timeout/#vault-timeout-action https://bitwarden.com/help/vault-timeout/#vault-timeout-acti...
forty 1y ago
Well, without SSO, we (people making password managers for business) are in a weird position where we tell people "you won't have to remember passwords" then the first thing we do is to ask to remember a new password (the master password). SSO also has the benefit that admin can impersonate another account, which is generally a good thing in a corporate environment (think of employee turn over, bus factor, etc)

A password manager is the one thing I'm very skeptical to use SSO for.

by andix 1y ago

A password manager is the one thing I'm very skeptical to use SSO for.

So you're going to play IT and duplicate all the groups and all the roles manually that already are maintained and automated for on/off-boarding? And not have them be auto-offboarded when they are let go? That introduces compliance risks and imo more problems than having SSO on your password manager. Yes, keep some master password for a rainy day if you have to, but otherwise, the more "dangerous" the thing the more it should be hooked up to SSO.

wazzaps 1y ago

It's most useful for companies, where the goal is as much SSO as possible.

kriops 1y ago

Separate accounts for work and private. SSO for the work account is perfectly fine for me as a dev and a big advantage for the company. But yes, don't conflate the two use cases.

lucasyvas 1y ago

Difference between work and personal. For personal, you’re right because there is nothing to bootstrap off of. But in corporate it’s provisioned to a user account that exists first. My personal bootstrap is two Yubikeys (for redundancy) that contains the password and 2FA for my Proton Pass. This plays the role of what IT would in a company with a user directory.

jchw 1y ago

From this PR: > A master password is still required and not controlled by the SSO From the Bitwarden documentation[1]: > Locking your vault will maintain vault data on the device, so unlocking your vault can be done offline. You will be required to enter your master password or PIN, or use biometrics, but won't need to use any active two-step login methods. That really ought to quell the majority of the concerns IMO. Though for personal usage I use KeepassXC, because not having any remote authentication at all is even simpler than SSO. [1]: https://bitwarden.com/help/vault-timeout/#vault-timeout-action https://bitwarden.com/help/vault-timeout/#vault-timeout-acti...

forty 1y ago

Well, without SSO, we (people making password managers for business) are in a weird position where we tell people "you won't have to remember passwords" then the first thing we do is to ask to remember a new password (the master password). SSO also has the benefit that admin can impersonate another account, which is generally a good thing in a corporate environment (think of employee turn over, bus factor, etc)