Hacker News Reader

Comment by wiether | Hacker News Reader

When they were acquired by LogMeIn a few years ago, the thread on HN about it was recommending switching to Bitwarden. Which I did. In a few weeks, I'll have to pay $10 to renew it. Meanwhile, since December we have those kind of worrying news from LastPass which is almost 4 times more expensive than Bitwarden.

View on HN

I wanted to use BW. Even had a talk with their lead engineer and CEO about switching my company over. Seems like a good product but at least two years ago their commercial offering was abysmal, basically no way to run a managed system with user accounts for their personal things and work entires that I could control or deploy.

Lastpass Enterprise has issues, but it does allow the above.

As an employee I would definitely not like to mix my personal things in my work password manager :)

However for those who are so inclined I can see the value.

No, that was the point. I want accounts for personal that I can access or reset, and I want a work account I can.

Lastpass does this and allows you to link them for your visibility, not mine. So users get a single log in the morning or whatever and they can do whatever they like. It’s a convenience that helps our less security minded users still have good habits.

2 of my colleagues lost their personal accounts (which they had linked to the corpo account) when they disabled/deleted the trial corpo account.

They were the only 2 of us who were trialling the linked account approach so I cannot say what the chance of losing your personal account is/was under this scenario.

This was a couple of years ago but understandably prompted a mass migration way from LastPass.

The way it’s worked ever since I’ve seen is the account is entirely separate. It’s just linked in. But they would have lost the features until they paid the normal rate themselves.

I understand, we've also been talking to LastPass in the past and they offered us something like this (not sure if it's a similar deal). Basically giving employees full access to the paid features personally as well.

But a single login is something I wouldn't even want. If my corporate account got blocked for some reason (e.g. the company folding), would that also lock the personal one? I don't know if we asked them this question as I wasn't directly involved in the discussion. In the end the whole deal was shelved anyway.

For me it's just a matter of account hygiene. And for personal stuff I prefer to host my password manager myself anyway. I was into mixing work/private in the past but with the increasing sophistication of attackers I avoid it now.

I can see the benefit though, promoting the use of a password manager to users who might not have thought of this in their personal life. I know many people who have never even heard of the phenomenon and still use the same password everywhere. I wonder what's in it for LastPass though.

> basically no way to run a managed system with user accounts for their personal things and work entires that I could control or deploy.

Could you elaborate on this?

I'm not an enterprise user, however, as a happy commercial Bitwarden user, I was annoyed that the company I worked for moved to LastPass relatively recently. I'd love to know what may have made them choose LP over Bitwarden.

Lastpass lets you (possibly with a large enough enterprise account?) give free personal accounts to your employees, seperate to their business accounts, that the employees can link with the business accounts. This gives the employees a single interface to access their business and personal passwords, while giving the company a business account it can see stats (but not passwords) of, and terminate to cut off access to without locking a user out of their personal passwords (the personal account gets downgraded to a free account).

Personally I don't use that as I have bitwarden set up for my personal accounts and would rather trust that.

See the post above this one. Lastpass allows me to deploy enterprise then link you can link personal that I can’t access. The user gets a single sign on to work and personal. It’s nice.

There was something else that BW wasn’t interested in doing for enterprise. I think that came down to recovery. They weren’t willing to trade some security feature on commercial accounts for a required IT feature. I wish it would have worked out with them, I’d switch from LP in a second if they solved those issues.

They were very upfront to me that their focus was consumer first.

What about 1Password?

I don’t want the hate for it, but I really hated my demo with it. I wish I could remember why! All I remember is that I couldn’t do basic enterprise level things I expected. It may have come down to linking personal accounts or recovery or cloud. Sorry, don’t really remember. I think it just rubbed me the wrong way.

The only thing important about a password manager is the amount of the bug bounty. In economic theory, it should be higher than the assets you protect with the password manager.

Reply on news.ycombinator.com