Our company has recently implemented an enterprise-wide password manager. This password manager allows us to store all our passwords that we use on a daily basis.
A few days later, I was surprised to see a notification in this tool that asks us that the administrator has access to the private key of the tool in order to help us in case of loss of the master password to recover our passwords.
Having some knowledge of computer security, I know that we should never share our passwords with anyone and especially the master password of our password manager. For me, there are two conditions, either I do not share my master password (private key) of my password manager. Or I don't register any personal access in this password manager that is linked to my email address. I can gladly share accesses whose account is global, like [email protected], but I don't want to share my accesses whose account is [email protected]
Even though all these accounts are related to my work, I don't feel comfortable letting the administrator have access to all my accounts. If one day one of my accounts were accessed or abused because my boss let a password leak, or if he used it himself, I wouldn't be able to defend myself against abusing one of my accounts.
I'll gladly give you more context if needed.
Is this a security risk ?