Hello World,
Password manager software solution are kind of trendy nowadays and there are a necessity since you need to use different passwords to access different web sites and/or applications. This proliferation makes it difficult to remember all these passwords. This is why we can see a proliferation of password manager solution on the market. Password manager can be used for personal use but can also be useful in corporate environment where a team needs to store and/or share certain passwords to access corporate infrastructure IT systems.
The trend is definitely about cloud based solution. There is plethora of online solutions that can be used to store and protect your passwords. You can use LastPassword, Bitwarden, 1Password, DashLane,… Online password manager can be a good solution for personal use. However, corporate usage will be more problematic as security officers would be reluctant to rely on cloud based Password manager solutions. Companies are usually looking for in house password manager solution.
This post will explore quickly some free password manager solution that would fit any personal usage but can also be used in corporate environment if there is a need to implement a quick and easy password manager solution and keep the solution in house.
Let’s move one…. !
Overview
Recently, we were working in a small corporate infrastructure where no password manager solution was implemented. Passwords in clear text was the norm or only certain individual would know password to application x or application z. Given the current situation, no budget or funding would be made available to buy and implement a professional password manager software solution. Moreover, it was required to have the password manager solution to be kept in-house (i.e. strict corporate policy not to use online password manager services !!!) .
To overcome this situation, we decided to look for a open source and free to use solution that would fit the initial needs and requirements of this customer. We have looked at three software which are
- KeePass
- KeePassXC
- KeeWeb
This post is not really about how to use the tool and provide detailed instructions on how to install and customize the tool. This post is simply listing possible candidates for a simple to use, effective and still secure password management solution….
Keepass
When looking for a password manager solution, which is free and open source, one of the most popular solution that shows up is the Keepass solution. Keepass allows you to store all your password into a single encrypted database. To access the database, you will need to remember a single password which will then grant you access your list of password. Keepass is cross platform and can be installed on Windows, Linux, MacOS and on mobile OS (Android, iphone).
Keepass has problably not the most beautiful user interface and look a little bit outdated but Keepass has proven to be a secure and relatively simple to use. Keepass comes with a lot of options that a user might need to learn to take full advantage of the software solution. However, Keepass is simple enough to implement a first password manager solution.
Click on picture for better Resolution
It would be possible with Keepass to create a centralized password manager solution meaning that the database file can be located on a centralized location. Keepass offers you the possibility to open a database from a local computer (where the Keepass software is installed), from a network share or from an URL.
Click on picture for better Resolution
Using file permissions, it’s possible to control who can read or write information into the database. If the database is located on a file share, multiple users can have access to the file and make changes. However, Keepass is smart enough to detect changes and prompt users to either sync the changes, overwrite the changes or simply discard the changes made.
Keepass also come with a lot of plugins that can customize your experience. Some plugins exists to integrate Keepass into some browsers. These plugins does not provide you a web interface where you can access manager your Keepass database but help you fill in password forms when browsing web sites
All in all, this is great piece of software with a lot of options and generally trusted by security organizations. The weak point of the tool is an obsolete and not sexy user interface.
KeepassXC
KeepassXC is a fork of Keepass. Initially, it was targeting Linux machines but nowadays you can use it on Windows, Linux and MacOS. KeepassXC is probably not providing all the features provided by Keepass but the interface looks more appealing and more modern. As you can see, it’s possible to set out-of-the-box dark theme with KeepassXC.
Click on picture for better Resolution
Click on picture for better Resolution
KeepassXC does not seems to provide plugins. However, like Keepass, it’s possible to install plugins in Chrome and firefox browser to have KeepassXC integrated within your favorite browser. Again, we didn’t test it as we do not think this would be used within most common scenarios.
KeepassXC has a limited set of features compared to the original Keepass but provide a more modern interface and this tool could be the perfect solution for small organization looking for basic password manager software solution
Keeweb
While looking around for a free and open source Password management software solution, we came across the Keeweb software solution. The software is all what we are looking for when hunting for a software. The interface is really cool and modern. The software is also using modern technology (Electron/web based technology).
Again, Keeweb relies on Keepass technology. Keeweb is really a simple web interface that allows you to open Keepass databases and retrieve your passwords. Keeweb comes with different themes and plugins.
Click on picture for better Resolution
Click on picture for better Resolution
Again, the Keeweb software might not have all the features available within KeePass but the fact that the tool is based on web technologies provide a real added value. Actually, it’s possible to install the keeweb software solution on your own web server and have a centralized and web based password management software solution. We think that this is really a great feature…. The on premise web hosting part can be a really great selling point…..
Click on picture for better Resolution
Click on picture for better Resolution
Final Notes
There are tons of password management software solution. They can be beneficial for personal use or for corporate use. They can available as cloud based solution or on premise solution.
When looking for free and open source solution, the most popular solutions for personal use are either KeePass software or Keepass forked solution.
Keepass is a great solution but has an outdated interface and that’s a real pity. Plus Keepass seems not to be written natively for Linux. KeepassXC seems to be an improved version in term of interface and usability as the software comes with less features and options than Keepass. Keeweb seems to be a really great solution. Neat interface, modern technology and possibility to build a Password Manager Web server that can be centrally accessed and kept up to date.
We should mention that Keepass and Keepass based solution does not come up with role based features. This means that a single password (master key) is shared between individuals which will have access to all passwords stored in the database. In corporate environment, there are some requirements to limit or restrict access to passwords within the database. Keepass solution will probably not be the best option if you need such feature. You will need to look for a different solution…
In our scenario, we have initially recommended Keepass software to our customer. The solution was good enough for the customer and helped get more pragmatic approach regarding password management. Since then, as we have demonstrated the Keeweb capabilities, the customer was really keen on getting this software deployed on their network…. :). This post is probably just the starting point of a new serie…..
Stay tuned for more information and setup guide for Keeweb…
Till next time
See ya