Has anyone else been successfully using Bitwarden in a team setting? If so, how do you work around the limitation I mentioned and other such things?
If a user forgets his/her password, then you can always create a new account. All the collections belonging to the organizations will be there. The personal stuff is lost, but you can argue that the personal items don't belong to the organization.
Also the same user account can belong to multiple organizations. The model is different from say 1Password, where the app can login into multiple accounts.
Secrets are only stored encrypted, and the key is derived from the master password, not known to any admins. Cracking the admin account or the entire server gives the intruder very little.
So, it's a feature. You may not want this feature, though.
You can though. If you lose your private SSH key, you regenerate it, and the server admin resets your public key. Zero data loss.
I think the better analogy would have have been a disk encryption key. But note that consumer facing encryption tech (Mac, Windows) generally doesn't stick to "user forgot key = user lost data".
> So, it's a feature. You may not want this feature, though.
Yeah, I must agree I do not want this.
I understand it is more secure but it is also more user hostile.
I'll take the risk of a compromised admin (assuming strong password and TFA of course) over "sorry you lost all your data."
Data integrity is just as much a part of security as data privacy.
This is exactly the same data loss as when you lose your master password.
Just like you store multiple passwords in your password vault, your SSH key can give you access to multiple servers.
If you lose it, you have to "reset" your public key on _every_ server, just like you have to reset _every_ password that you stored in your password vault.
Though of the purposes of having password manager is managing with large numbers of disparate systems.
Whereas an SSH is simply the authentication mechanism, and may or may not be shared across large numbers of systems.
Usually.
HN passwords are not always recoverable. (Only if you have entered an email address).
By the same token, if the admin did not have access to all the sites and your passwords, the admin can set a new master password, but cannot restore the access to the sites.
The rationale for it not being a privacy violation, which was a concern that came up a couple of times, was that the machines were company property anyway.
Our company has to be very careful about that kind of stuff. Because once you have it you own it and you're responsible for it. Our ATP system, for example, scans for credit cards and SSNs in user and shared directories, sends us an alert and we ask the employee to remove it.