My boss wants to have access to my password manager master password

Question

Our company has recently implemented an enterprise-wide password manager. This password manager allows us to store all our passwords that we use on a daily basis.

A few days later, I was surprised to see a notification in this tool that asks us that the administrator has access to the private key of the tool in order to help us in case of loss of the master password to recover our passwords.

Having some knowledge of computer security, I know that we should never share our passwords with anyone and especially the master password of our password manager. For me, there are two conditions, either I do not share my master password (private key) of my password manager. Or I don't register any personal access in this password manager that is linked to my email address. I can gladly share accesses whose account is global, like [email protected], but I don't want to share my accesses whose account is [email protected]

Even though all these accounts are related to my work, I don't feel comfortable letting the administrator have access to all my accounts. If one day one of my accounts were accessed or abused because my boss let a password leak, or if he used it himself, I wouldn't be able to defend myself against abusing one of my accounts.

I'll gladly give you more context if needed.

Is this a security risk ?

Answer 1

Having access to the master password does not necessarily mean he has the ability to read your password, only to authorize a change without knowing the previous password.

Depending on how the system is written, perhaps he could change it to something he knows and access your password storage. But anything on the company's machines belongs to the company, not to the employees, so while that could be a security issue it isn't one that you have any control over unless you're in the security group. Presumably they considered his trustworthiness when they gave him that access. Or there may be other precautions, such as 2FA, that would keep him from logging in as you even if he does have the password.

For more details, contact your own company's security folks and ask them what the real protections are.

BUT: The company is entitled to access any files on its hardware. If your concern is protecting your personal passwords, don't put them in the company's password manager, and take whatever other precautions you deem fit.

Answer 2

Your risk is that the administrator abuses his access and tries to blame you for it. One solution is that you get in writing from the administrator that he asked you for the password, that this was was a rightful request (and not a test whether you are stupid enough to hand over your password), and that he received the password. Co-signed by someone as high as possible in your company.

So if one of the protected passwords is abused, it is clear that both you and the administrator had access.

Answer 3

Of course it's a security risk.

The vast majority of companies will tell you that no one in the company will ever ask you for your password. In this case, they're basically asking you for ALL your passwords. There is not a good reason for this.

Admins can reset accounts and create new passwords without having your old password.

All that said, your company is well within its rights to have bad password security. Everything about the systems is owned by the company, including your passwords. It's bad practice, but voice your disagreement and give them the master. Don't make it a big deal unless you don't mind being "that guy."

Answer 4

Is this a security risk ?

It certainly is, but it's not your risk to make a decision on. Generally you just trust that your superiors know what they're doing and keep anything non-work-related off company hardware.