Hacker News Reader

Comment by helper | Hacker News Reader

Cool, product.

I'm not super excited about the use of WebCrypto, but it isn't any worse than storing passwords in the clear in a database.

My biggest question is does it support having an audit log of who accessed what credentials when? If that is supported I could see some our our teams switching over to this.

View on HN

1Password for Teams does have auditing for changes. We will be adjusting and expanding how that is exposed in the admin console over time.

Auditing who accesses credentials is just as important as auditing changes for us.

Auditing who accesses credentials is pointless, IMO. So you know that Tom, Jane and John have all accessed the domain admin credentials since they were changed last week, what good does that do you? They all have reason to do it, and any one of them could have written them down so it's not like you can audit who pulled them up 15 minutes before some huge security incident and know who was responsible.

Not necessarily. If you have an organization with 100 users and most systems are accessed rarely, an audit log can show you things like "Steve accessed ALL the credentials."

Hi helper!

I've put this in a document I hope to send to the team this evening and I have added your comments on what is important to you. If you have any others please let me know.

This is just the initial beta and we fully intend to bring even more great features to 1Password for Teams. Requests can certainly help drive that direction a little bit so let me know what's important and we'll see what comes up on top.

Kyle

AgileBits

Take a look at the discussion of "Crypto in the Browser" in the draft white paper for a discussion of WebCrypto.

[Disclosure: I work for AgileBits]

Reply on news.ycombinator.com