Show HN: Passbolt – open-source password manager for teams

Obviously. Real men and women know CLI apps are binary executables, and should be written in C, C++, or, perhaps, Go.

If you want a CLI password manager with a sysadmin mindset get pass.

https://www.passwordstore.org/

It's a bash script.

Fair play! We will propose something with less dependencies and more native support.

Thanks for the suggestions. We'll definitely come up with a feature/roadmap page shortly. As for the demo account it is a bit more complicated, but we'll look into it.

I've recently experimented with Dashlane for Teams and been using 1Password Teams. 1PW has much more functionality around teams from my experience. The team sharing within Dashline leaves much to be desired, even sharing of multiple items at a time is a bit rough, and I couldn't find a way to create vaults/groups.

1PW has a notion of vaults for grouping data, but anyone with access to the vault can see all of the credentials. This makes it really cumbersome with overlapping groups that results in vault explosion. Eg, Marketing & Finance vaults have overlapping users, so you create a Marketing/Finance vault, and so on. You can see several questions about this issue in the forums.

Looks like the pricing is going to be $5/user/month for 1PW. I'm waiting for them to add individual item permissions and the ability to create custom groups. No 2FA either, which they have their reasons for. Auditing and reports would be nice.

I might end up going with LastPass for the more granular permissions. I really wish I could find a decently priced company credential/identity manager that can assist with things like automatically rotating passwords/access so I can more easily prevent staff from copying passwords into an unencrypted file, and get an audit log of who's accessing what. Dashlane has some notion of password resets but there's no control to script it for your own or client websites.

There's Thycotic but I don't think their Cloud version supports password changing (and I'm not interested in running a Windows server). There's also Manage Engine's PMP... but that interface also left much to be desired.

Any suggestions or advice?

Thanks

1Password is competing there now with their cloud offering. Unless you need Linux...

The main knock against KeePass for teams is that it's all or nothing. We've had to create multiple databases for different job functions, which becomes a pain to maintain. Not to mention that anyone with access to the database could make edits and you wouldn't know who.

EDIT: Just want to point out that it appears that this software allows you to define access for different members of a team, but I haven't had a chance to try it.

Because KeePass is built for individuals, not teams?

Using KeePass is great as an individual, but it's been a huge pain for my team. I work with mostly non-tech people who are immediately scared-off by the unfriendly interface. I've had to silo credentials across several databases to keep sensitive things away from those who shouldn't have access (e.g., interns don't need banking logins). Lots of my colleagues just refuse to use it, preferring sticky notes on the monitor. I'm thrilled to see something like this which might solve lots of our current pain points.

I think the FAQ does a good job of explaining it, basically it is for teams:

https://www.passbolt.com/faq

Things like KeePass and 1Password don't scale well for teams/businesses. There are things like admin passwords that teams need to share (as bad as it is to share passwords, there are a lot of cases where there isn't another option). You can do something like store KeePass or 1Password in Dropbox, but it has issues. The vaults have a password, everyone using it needs to know the password, and everyone gets access to everything. You can't do something like share a billing password with someone in accounting, without also giving them all the root passwords. It becomes a pain to create a bunch of individual vaults for every sharing case, and keep track of and share the individual vault master passwords.

Enterprise password managers also have audit systems. You can see every password someone had access to, every password someone accessed, and who accessed a specific password.

I don't know if Passbolt is any good, it seems like it is off to a decent start. I've looked into enterprise/team password managers at every company I've worked for in the past 10 years; I've never found an open source one I trusted -- they all drop the ball in at least one critical area. And I don't trust the closed source ones either. It is a sad state of affairs, so I welcome new entrants into the space.

> Is passbolt able to pull gpg keys of a user from some external source automatically.

Not yet, same as key signing and manual keyring management. But hopefully we'll get there. Thanks for the positive feedback!

The authentication token follows a very specific pattern to prevent this type of attacks. For example an authentication token would look like this: gpgauthv1.3.0|36|8661be60-23df-11e5-b16c-0002a5d5c51b|gpgauthv1.3.0. Both the server and client check for the consistency of that format.