7

In this section Hashicorp compares Vault with other solutions. How does Hashicorp's Vault compare to Lastpass?

Attempt to answer the question

It is possible to login to LastPass from a web browser, create secrets and share these with other users. There does not seem to be an audit log. Imagine that a password of one of the users is retrieved one could retrieve a password from a database without knowing it.

Improve this question

3 Answers 3

Reset to default
6

I don't have enough rep to comment but I'm going to expand on what RuBiCK said.

In the first case, if you have a password for JIRA that I'm going to use to log in to the website with and fiddle with some tasks, then this goes in LastPass. You can store it there and use the extension or the vault to help me remember a complex password. You can also use LastPass to send credentials to my team members and then they can use LastPass to log in with.

In the second case, if you have made a script which asks AWS for what instances you have running right now then that script is going to need some credentials to log in with. You could put them in LastPass if you wanted but every time you went to run the script it would mean you have to go and get them from LastPass, enter them into the script somehow and get my list of instances.

Vault however presents an API which your script can use to ask for credentials when it runs. The credentials are stored in a secure way by Vault and you can now store much more in there as well.

The above is also why Vault wouldn't be useful for most people to do what they want to do. You don't want to have to write something to talk to Vault and create browser extensions etc when LastPass is, kind of, affordable and good at what it does.

I hope this helps!

Improve this answer
1
  • LastPass does have a CLI too, so I imagine getting passwords out of it could be automated. But I do agree, it's probably not the best tool for the job.
    – Tim Malone
    Commented May 12, 2018 at 5:02
2

Lastpass is for your personal (or team) passwords. I would not use Lastpass for storing credentials of service accounts.

Use HashiCorp's Vault or any other solution like Amazon KMS for infrastructure secrets.

Improve this answer
2
  • Could you give an example of what you consider as a team password? Why not use Hashicorp's vault for personal accounts?
    – 030
    Commented Aug 11, 2017 at 9:24
  • Team or personal passwords are the ones to access to web services for example for log in the IDM/backup/monitoring solution as user. On the other hand, if you need password for monitoring agent for example that should be saved in a vault, that is a service account
    – RuBiCK
    Commented Aug 11, 2017 at 9:25
0

While this is a very old question, I’ll add a bit to it to anyone landing here.

I’m not familiar with Laspass specifically but assuming its internals are similar to others such as Bitwarden: server has no access to your secrets. They are decrypted client-side with your master password.
For organization/shared secrets, a separate key is used to encrypt them and then stored as a personal secret of each user (encrypted by their master password).

In vault, every secret is encrypted by a single master key. That key is split into 3 partial keys which should be kept by different people.
Not sure about the details but 2 out of those 3 keys are required to “unlock” vault for anyone to use.
Secrets are then decrypted server side and delivered in plaintext to the clients. Policies and ACLs prevent accessing secrets that you shouldn’t but anyone able to create/modify policies can read any secret.

In short, IMO, vault is nice for “organization” secrets but I would never put my personal ones there.

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.