Password Manager

[mundlim]

I've been asked to look into a password manager for the teachers to use (to stop them leaving password post-its on the wall). Anyone got any thoughts on if this is a good idea, a worthwhile expense? Is anyone using a password manager (Lastpass has been mentioned) or got any recommendations for or against?

thanks!

[RLR]

Interested in this also. We currently use Thycotic Secret Server for the IT department but thinking about getting more staff using password managers. I've heard bit warden is a nice free one?

 

Would like to know if anyone else is using any password managers for staff and what the experience is like.

[Sydders01]

We use keepass for the IT department. We discourage staffs from writing their password down on any platform. We have told them the implications of doing so. I believe the key thing here is educating them about the do's and don'ts . installing a password manager on their laptop won't stop Teaching staffs from their old ways . Educating ...educating and more educating!!!

[Norphy]

In my experience, the likes of Lastpass and Dashlane are fantastic at managing your own password collection for websites and suchlike (I use and paid for Dashlane myself) but they’re not so good as a corporate password storage and retrieval where you need to share passwords. Lastpass is a bit better than Dashlane in that respect but it’s still not ideal.

 

In my experience, PasswordState from Click Studios knocks the spots off both of them in this context. It’s free for up to five users and pretty reasonably priced once you go above that

[jmak]

My experience is that it's nigh on impossible to persuade non-technical staff to use a password manager. I can't even get it implemented in my own house [emoji2959]

 

I've used lastpass for personal use for the best part of 10 years - when I reset password I always say "you should try a password manager". Most people just smile and you know they'll be back next week. A few people ask what it is and then say it's too complicated.

 

Lastpass for organisations can get quite expensive. It may have improved, but I found keepass clunky to use across multiple devices - although that may not be an issue if it's only for school use.

[mavhc]

Problem is the mobile apps, lastpass made mobile free a few years ago, so I stuck with it. I'd deploy lastpass and have training where everyone sets up their accounts, passwords, 2fa, etc, for staff and pupils, it's a requirement for modern internet use until oauth and getting rid of passwords for things like sqrl becoming ubiquitous.

[Scan099]

1Password for teams is what I would suggest it allows you to have groups and only share certain passwords etc plus if you update a password it is sync'd to everyone. I use 1password at home and have no complaints, we also use Lastpass in school but i would much more prefer 1password.

[mavhc]

What makes you prefer 1password?

[Scan099]

I think the interface is better and easier to use than lastpass but that is just my preference, not used lastpass in a team environment so can't comment - i think they both do free trials so worth trying both to see what you prefer

[DrCheese]

Yea I didn't really like lastpass when I used it last - It's heavily focused around browser based logins & the Windows desktop app is hot garbage. I found it a bit of a mess design wise.

 

1password is miles better, but buying it in the UK for a company without using a credit card is a faff.

[Arthur]

I think the interface is better and easier to use than lastpass

I also switched from LastPass to 1Password (for Business) at school. The latter is much better designed and has more features like WatchTower and native support for U2F security keys (without having to use a third-party like Duo).

 

LastPass's interface feels very dated to me and they don't seem to be putting much effort into developing the product further.

[mavhc]

Auto-Change Password: These passwords are at risk because of known data breaches elsewhere on the web. LastPass can change passwords for you. Select the sites to update and click 'Update Now'.

 

No U2F, true, but TOTP is free.

 

How much are people paying for Educational/Enterprise versions?

[MatthewL]

I use LastPass at home suites me fine, we use KeyPass at work for the few of us that need to, got a file we share with them in.

[Arthur]

Auto-Change Password

When I last tried this feature it didn't work with my Google account.

 

How much are people paying for Educational/Enterprise versions?

For 4 users, 1Password Business costs us €251.64 per year (reduced from €335.52). The Teams plan is even cheaper if you don't need the extra features or home use licenses.

 

We went with the business version since it has additional security features, more control over permissions and an audit trail.

 

To get a 25% EDU discount applied to your account, sign up via their European website and then email [email protected] to request it.

 

1Password are also currently offering a six month free trial for their Teams and Business plans. No credit card required either.

 

 

Edited May 20, 2020 by Arthur

[mavhc]

hmm, not going to scale to having it for every user then, probably just stick with teaching people how to use the free version properly

[jthompson]

We deploy KeePass to all staff machines, with an undeletable shortcut sat on their desktop. There's an MSI if you scroll all the way to the bottom of KeePass downloads page. Quite a few people have taken to using it, and I don't need to worry about people storing details of their private accounts in there. If they leave the school, they can take their db file(s) with them.

 

No experience of cloud-based password managers, but I'd wonder whether people filling up their enterprise password manager with personal account details would create problems for them down the road.

 

Edit: We have widespread Drive File Stream usage amongst the staff, which provides a good storage location for a KeePass db.

Edited May 21, 2020 by jthompson

[mrstrong]

I was going to try the one from google built into chrome, I think you need to sign in to chrome

but apart from that nothing else to install.

 

Is there any reason to prefer 3rd party solutions, or not to use the google one ?

[jthompson]

The Google one only saves usernames and passwords for website. Password managers allow you to store more general account information for things other than websites, along with things like OTP seeds, file attatchments, answers to security questions, etc.

[lcafearo]

Hi There,

 

Not sure if already mentioned but Bitwarden is also an excellent password manager, it's open source and I believe you can self host. https://bitwarden.com/.

 

The thing to be cautious about with browser password managers is that you can easily extract them with firefox and see them in plain text. If going for a password manager I would definitely recommend a third party one.

Edited May 22, 2020 by lcafearo

[mavhc]

Interesting, do the bitwarden mobile apps work with the self hosted version?

[HPlum78]

Azure Key Vault it's points of pence to store secrets and is secured with your account password and MFA as well if your on that journey. Can be accessed programmatically and the PS team are working on PowerShell module to allow scripts to call the secrets.

[Jonah]

Interesting, do the bitwarden mobile apps work with the self hosted version?

 

They do, we’ve moved from LastPass to on-premises BitWarden for our IT team and the mobile apps work without issue.

[mavhc]

Cool, are you planning to roll it out to teachers and pupils? Do you allow off site usage? 2FA?

[lcafearo]

Sorry for the late reply. The good thing about bitwarden is that all its documentation is online: https://bitwarden.com/help/hosting/

[Arthur]

@lcafearo. Are you using the official Docker containers or the Rust implementation (bitwarden_rs) due to its lower system requirements?

 

I use BitWarden Premium at home and can confirm it's an excellent password manager. The only reason I didn't use the hosted 'Enterprise' version at school was because it wasn't possible to require 2FA until very recently...

 

https://bitwarden.com/blog/post/enterprise-policies

Edited May 26, 2020 by Arthur