I am considering putting a forward a proposal to use a password database/manager instead of a flat (PGP) encrypted file for managed passwords for our team to access. I would like to hear some suggestions for the pros and cons of doing this. I am personally for using a password database due to the extra user processes involved in using a flat file. For this discussion I would not like to focus on choice of encryption itself as any password manager can match PGP in robustness/speed. To get us started here are some of mine below:
PROS of password database
- Does not require decryption, amending and re-encryption of data upon changing or adding a password.
- No risk of unencrypted data being written to disk (users could pipe to text-editor). Shredding of file may not be conclusive based on file system used.
- Adding/removing of staff requires decryption and re-encryption of data with new split key.
CONS of password database
- Perceived or actual lack of compatibility on some platforms.
- Potential for no CLI to be supported.