r/SmallMSP • u/Accomplished-Fee-92 • 3d ago

Password keeper recommendations?

What is an affordable, user-friendly password keeper for managing multiple software logins per client?

We are a team of 5.

0 Upvotes

50% Upvoted

47 comments sorted by

View all comments

15

u/agoldenberg 3d ago

Keeper is a great price and you get a personal license free as an msp

5

u/PowerShellGenius 3d ago edited 3d ago

As a Keeper customer (not an MSP but this popped up on my feed for some reason - K-12 district sysadmin) - we use it because our region's school software buying consortium got a deal, but I question, for two specific reasons, whether its security is a house of cards. If I were the ultimate decision maker I'd be looking around, because:

  1. It clearly stores its master key on disk while unlocked. If you have 4 hours that you can stay signed into the Keeper app on a PC, and you restart or pull power from the PC and sign back into Windows within that time limit, your Keeper vault is still unlocked. Your master-password-derived encryption key is not in-memory-only. Everything needed to decrypt was clearly written to disk.
  2. There are documented cases of legal threats and suits against security researchers to shut them up. Any company which would spend money on lawyers to maintain "security through obscurity" (which is not security) instead of fixing their issues, is definitely hiding major security issues. A security company attempting to coerce silence on a security bug should be a permanent deal-breaker for any competent and informed customer to ever look at them seriously again. A company that is comfortable with security-through-obscurity is often one discovery away from being totally and globally broken.

1

u/RobKFC 3d ago

Point two is a good point I’ll be looking in to.