Is it safe to share a LastPass master account?

Question

I just found out my company started using LastPass Enterprise for service accounts. (databases and web applications that our whole team needs access to) I immediately switched my team over to it because it seemed safer than the method we were previously using - storing all the passwords in an encrypted file and passing it by encrypted email or share folders. We quickly found out our company has disabled the password sharing feature of LastPass, which I thought was the whole reason to use it. Instead they created a single team account (with associated email address) and told us all the password use for logging into LastPass. OK, I guess that works but it makes me uneasy for some reason - at the very least it feels nonsensical doing this when LastPass can restrict sharing to within an organization or team.

Is our team sharing a single account and master password any less secure than using individual accounts?

Also kind of curious why a company might disable the sharing feature, but perhaps that's something only they can answer.

Answer 1

It is a lot less secure. You have the equivalent of a password-protected file filled with passwords.

Everyone with access to this resource:

• has all the passwords contained within it, whether they have a legitimate need or not
• can change any stored password maliciously or mistakenly and confuse (delay) all other users

Moreover, when someone on your team leaves, then the master password needs to be changed and all remaining users need to be updated with the new credentials. If a user is skipped or misses the update, they are locked out.

Per-user control solves all these issues. You can:

• share the appropriate passwords with the approved people
• provide read-only access to passwords
• revoke the single user's access to the password repository without affecting the rest of the users