All of these look like fine solutions for technical users. Similar kinds of features for users, teams, organizations, etc.ĭesktop capability for Windows and Mac, and mobile capability for Android and iOS.īrowser extensions for Chrome and Firefox, for automatic form fill in, etc.īitwarden has two advantages over the others:īitwarden is open source, which means the security can be peer reviewed and also the company is widely-appreciated by security-oriented developers.Īnecdotes by software workers describe a significant preference for Bitwarden over the others. Low-tech ad-hoc approaches, such as remembering, writing a note, or relying on each user to figure out their own approach.īitwarden, LastPass, 1Password, and Dashlane all are commerical off-the-shelf products. Sharing-oriented approaches: using a shared Google document, or shared Slack channel, or shared network folder, etc. System-oriented COTS password managers: AWS KMS, Vault by HashiCorp, EnvKy, Secret Server by Thycotic, Devolutions Password Server, Confidant by Lyft. User-oriented off-the-self password managers: LastPass, 1Password, Bitwarden, Dashlane, KeePass, pass, GPG, etc. no need to write code, no need to install servers, no need to make a major commitment, no need to standardize everyone. Right now we want something that is easy i.e. Our security model for this purpose is fine with using well-respected COTS vendors, such as SaaS password management tools. We do not want ad-hoc approachs such as "remember it" or "write it on a note" or "figure out your own way to store it". We are not trying to solve for single-provider, such as storing all secrets exclusively on Amazon or Azure or Google. We want to be able to share some secrets among selected people, such as a team. We want to ensure fast easy access on the go, such as for a developer doing on-call system reliability engineering. Details Assumptionsįor this purpose, and our current state, we value user-oriented convenience, such as usable mobile apps. We are open to new alternatives as they arise. Vault by HashiCorp for system-oriented secrets.
For example, our continuous delivery pipeline needs to be able to look up the credentials for our cloud hosting. For example, our developer wants to be able to use their mobile phone to look up a password to a service. We need to store secrets, such as passwords, private keys, authentication tokens, etc.
0 kommentar(er)
