> Service passwords are still stored in clear text in the corporate wiki.
I know this painfully well :(. Can you recommend some good solution? Ideally open source and self hosted, instead of cloud password manager.
I know this painfully well :(. Can you recommend some good solution? Ideally open source and self hosted, instead of cloud password manager.
Crossplatform, git versioning, gpg security (allows you to integrate with smartcards and tokens that you might already have in place for your employees).
Decent UX too, works with clipboard, supports totp.
Because: in this scenario you need to drive adoption first,if it is any complicated the humans will not use it. so you need the easiest tool possible.
when everybody is using it, THEN go for the real security move.
(you can try to find a non-cloud one that is super easy, but...)
Be careful: that sort of behaviour can get you fired and potentially land your company in hot water from a legal and/or compliance standpoint, as well as lose them customers.
Compliance is often as much, or more, about having and following documented processes, as it is about having good processes. This can include an approved list of software and services. If you step outside this you are likely breaching your compliance regime.
In the specific case of passwords you may have policies and procedures around secret management that would be violated by storing this information in the cloud, even with a service specifically designed for this. As stupid as it is, the quality (or lack thereof) of your current solution is not the key point here.
If you decide to get all subversive and start using a cloud service then, at the very least, if discovered you're going to get into trouble. At worst, if customers become aware they might leave, and as I've already said, the company might find themselves in legal difficulties.
The developer refuses to acknowledge it as a security risk, and actually caps the max iterations you can configure, both on the client and the server.
https://github.com/bitwarden/jslib/issues/52
https://github.com/bitwarden/server/issues/589
“It was audited” is meaningless if the audit missed this, or reported this and the dev dismissed it. Either way, it is unsafe.
https://crypto.stackexchange.com/a/61306
Django, uses PBKDF2-SHA256 with 216000 iterations, for example https://github.com/django/django/blob/master/django/contrib/...
Given Bitwarden allows almost 10x that, not sure I see the issue.
PBKDF-SHA256 is far too fast, even with the HMAC step.
I'd rather they use Argon2id to be as safe as can be.
However, I've not yet seen a fully cross-platform javascript-only implementation of Argon2 at all, which is problematic for an extension.. :-/
UPDATE: There actually exist an Argon2 implementation that's used by another vault, https://www.npmjs.com/package/argon2-browser
The point of PBKDF-SHA256 is to protect the secrecy of passwords if the server is compromised and its password hash db is dumped.
This is not some random webapp. It is a password manager.
Think about it.