"Password manager you trust..."

Not so easy.

I've worked at places where we use a password manager to manage lots of passwords for random services that we subscribe to. The engineering manager always says "you can put your own passwords in for free" and I say "no thanks, they're going to get hacked" and then six months later... they get hacked.

I use the password manager on my iPhone because it seems pretty secure and it is so miserable to type passwords in on a phone but my other solution for passwords has used cryptographic generation with the database playing only a secondary role and it is fine for passwords but does nothing for passkeys.

▲

jjice 3 hours ago | parent | next [-]

The idea of keeping my passwords in my work-sponsored password manager just sounds absurd. Who thinks that's a good idea? What happens when you leave the job?

▲

zchrykng 2 hours ago | parent | next [-]

My workplace doesn't offer this, but I like the idea of how 1Password does it. If your workplace has a business account with 1Password, each of the business users gets a personal account for free. If you change jobs you can pay for your own account, but it isn't tied to the company account other than getting it for free with the corporate account.

	▲	jjice 44 minutes ago \| parent \| next [-]
		Ah that makes this make way more sense. Thanks for the insight.
	▲	secabeen 2 hours ago \| parent \| prev \| next [-]
		Pretty much all the major vendors offer this now.
	▲	jiveturkey 29 minutes ago \| parent \| prev [-]
		I personally find it to be a disgusting way to get customers. The company pays for the service, yet they also get to be the product.

▲

newsoftheday 2 hours ago | parent | prev | next [-]

What I did was use usernames on those services that included a few chars to remind me which business I'd created it for. I was a software engineer bug changed jobs/contracts on average about once per year (that's a very, very rough average though).

▲

john_strinlai 2 hours ago | parent | prev | next [-]

it's work-owned or work-managed accounts that get stored in a work-sponsored password manager.

most will come with free personal accounts for employees, if they want and choose to set them up. those are separate, and have smooth offboarding for the no-longer-employee.

▲

LewisOrton 2 hours ago | parent | prev | next [-]

exactly, it sounds more like a trap with the facade of benefit than passkey

▲

verdverm 2 hours ago | parent | prev | next [-]

Are you not keeping them separate? Are you using browser profiles?

	▲	undersuit 2 hours ago \| parent [-]
		It should be a default then not a suggestion we pass around in tech forums.

▲

wastewastewaste 2 hours ago | parent | prev [-]

eh the companies account for that. for example 1password basically gives you a "free" extra personal account if you enroll into a work account. and when you leave, you just keep the personal account.

"free" because im not sure if your employer pays for it or if its like a free benefit to a bussiness licence

	▲	mentalpiracy 2 hours ago \| parent [-]
		I deployed it for our company, I can confirm for you that as of this post, the personal account is a free benefit to the business license.

▲

blackcatsec 3 hours ago | parent | prev | next [-]

What you describe is a different attack surface than the much more problematic on that password managers solve well: password re-use across websites where the blast radius is super high.

If I had to trade off the risk of a password manager being hacked versus password re-use, I'm going to strongly recommend to people generally to use a password manager. Yeah there's a lots of "if this, if that"--but that's almost a universally better risk for most people.

▲

qbane 2 hours ago | parent | prev | next [-]

I think this part is where TOTP's 2FA/MFA model is "safer": you do not need to trust the TOTP manager. Even if the app sends all your TOTP secret keys to the server, they cannot hack your account because your password is stored elsewhere, and TOTP code alone is useless.

▲

wastewastewaste 3 hours ago | parent | prev | next [-]

which password manager were you using that it got hacked?

▲

zbentley 2 hours ago | parent | next [-]

Not GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:

- User account with access to the SaaS password manager was compromised.

- Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.

EDIT forgot one:

- Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.

▲

mentalpiracy 2 hours ago | parent [-]

These examples are very different than your provider being hacked.

Ideally you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

▲

zbentley 2 hours ago | parent [-]

> These examples are very different than your provider being hacked.

I am not GP. GP said:

> I say "no thanks, they're going to get hacked" and then six months later... they get hacked.

I interpreted that to mean "they (the passwords) were compromised" not necessarily "they (the password vault provider) were compromised".

> you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

Correct.

	▲	PaulHoule 28 minutes ago \| parent [-]
		GP here: (1) The use case I have seen is that a startup or small unit in a big organization has subscriptions to a number of services that are shared by multiple users; if I had to log into one of these things I would log into the password manager and use the username and password that we all share -- these have never been things that I use for my day and day out software development but usually are things the marketing people use that I only have to log into every six months or so if I have to help out with a problem. I've always had individual accounts for bread and butter services such as version control, issue tracking, documentation management and such. Of course the right thing to do is give members of an organization their own username and password or integrate with the enterprise SSO of that organization... And that's a lot of what I do for work! Many vendors don't support that or jack up prices 10x or more per seat for SSO, so shared username/passwords are widespread. (2) "they got hacked" means "I read about an incident in the media". Probably some security boundaries were breached and others weren't. I don't think any of these were the worst case scenario of "100% of passwords got leaked". I wasn't personally effected because I didn't take the bait, I either had moved on to another job or somebody else cleaned up any mess so I don't know exactly how my organizations were affected. Still it proved my intuition (gotten from looking at a lot of software and working on user management for numerous web sites, some famous) that these password managers were not paragons of operational excellence.

▲

TheSkyHasEyes 2 hours ago | parent | prev | next [-]

They also didn't specify whether this is on-prem or cloud. Big dif why a 'hack' can occur...

▲

Kevcmk 2 hours ago | parent | prev | next [-]

Probably LastPass

	▲	PaulHoule 28 minutes ago \| parent [-]
		Yes!

▲

loloquwowndueo 2 hours ago | parent | prev [-]

Last pass. Twice iirc.

▲

rjzzleep 2 hours ago | parent | prev | next [-]

KeepassXC now supports passkeys as well.

▲

Capricorn2481 an hour ago | parent | prev | next [-]

Aren't password managers like Bitwarden essentially zero trust? Even if they hacked the entire database, what would they do with that?

▲

jasonmp85 3 hours ago | parent | prev [-]

[dead]