5

In this section Hashicorp compares Vault with other solutions. How does Hashicorp's Vault compare to Lastpass?

Attempt to answer the question

It is possible to login to LastPass from a web browser, create secrets and share these with other users. There does not seem to be an audit log. Imagine that a password of one of the users is retrieved one could retrieve a password from a database without knowing it.

5

I don't have enough rep to comment but I'm going to expand on what RuBiCK said.

In the first case, if you have a password for JIRA that I'm going to use to log in to the website with and fiddle with some tasks, then this goes in LastPass. You can store it there and use the extension or the vault to help me remember a complex password. You can also use LastPass to send credentials to my team members and then they can use LastPass to log in with.

In the second case, if you have made a script which asks AWS for what instances you have running right now then that script is going to need some credentials to log in with. You could put them in LastPass if you wanted but every time you went to run the script it would mean you have to go and get them from LastPass, enter them into the script somehow and get my list of instances.

Vault however presents an API which your script can use to ask for credentials when it runs. The credentials are stored in a secure way by Vault and you can now store much more in there as well.

The above is also why Vault wouldn't be useful for most people to do what they want to do. You don't want to have to write something to talk to Vault and create browser extensions etc when LastPass is, kind of, affordable and good at what it does.

I hope this helps!

  • LastPass does have a CLI too, so I imagine getting passwords out of it could be automated. But I do agree, it's probably not the best tool for the job. – Tim Malone May 12 '18 at 5:02
2

Lastpass is for your personal (or team) passwords. I would not use Lastpass for storing credentials of service accounts.

Use HashiCorp's Vault or any other solution like Amazon KMS for infrastructure secrets.

  • Could you give an example of what you consider as a team password? Why not use Hashicorp's vault for personal accounts? – 030 Aug 11 '17 at 9:24
  • Team or personal passwords are the ones to access to web services for example for log in the IDM/backup/monitoring solution as user. On the other hand, if you need password for monitoring agent for example that should be saved in a vault, that is a service account – RuBiCK Aug 11 '17 at 9:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.