Hacker News new | ask | show | jobs
by kalleboo 2345 days ago
I evaluated a bunch of team password managers last year.

Lastpass was really buggy and had a confusing UI. Dashlane also had odd limitations.

1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive.

I ended up recommending Bitwarden. Surprisingly the open source option had a great UI and great clients, with the bonus of being open source on both ends.

4 comments

> 1password had a good UI but the "master key" system is difficult for users to use. It was also more expensive.

Unsurprising, and at the same time it makes 1password's security scheme much more bullet proof.

You need that piece of information to identify the client, and even 1password doesn't have it, which means that when inevitably one of these cloud services gets attacked with success, it will less likely be them. Plus they can't see your stuff, that's a plus.

Security is not free.

It’s surprising to me that the “master key” system on 1Password proved difficult for your users. For me, this is one of the simplest things about it: you remember one password that unlocks everything else.

Am I talking about the same thing as you when I call this password the “master key”? I feel like I must be as this is flat-out the thing that makes 1Password easy to use.

There are four bits of information you need with 1Password teams

1. The team address <team>.1password.com

2. Your login name (email usually)

3. Your 'secret key'

4. Your 'master password'

I suspect GP is talking about item #3 being the point of confusion.

Ah, that might be it - I was talking as an individual user rather than imagining a team deployment.
They are talking about the "Secret Key" that is used in addition to your "Master Password." It was previously called an "Account Key."

https://support.1password.com/secret-key-security/

I think I may have read your review (did you make an article online?) and I'm now happily using Bitwarden. I just signed up for premium, not because I want the features, but because I want to support what they're doing.
Which enterprise password managers did you evaluate? Did you get a chance to take a look at SAASPASS? Is there a link to it? And what were your evaluation criteria?