مراجعة Passbolt: الملخص السريع للخبراء
The Passbolt password manager is definitely for those who have experience with computers and software. It’s not a manager for newbies to get involved with, though it doesn’t market itself as one. Instead, this is a piece of software for startups and big enterprises to share information with one another.
There are tons of password managers out there. To help you find the best one, I’ve taken a look at over 70 of them to see which features are worth your hard-earned money. Passbolt is different than most other managers, so read on to see if it’s something you’re looking for.
Passbolt is a little different from other password managers like RoboForm in that it is focused on team usage rather than individuals, though it can be used for personal reasons as well. However, it doesn’t have a ton of features to take advantage of, though it’s open source so anyone can create and use plug-ins that add extra things to do.
While many password managers like Password Boss include password sharing as one of their additional features, Passbolt’s services revolve entirely around such a thing. For example, every password that you document within Passbolt can be easily shared with the rest of your organization in a feature similar to Google Docs.
When you’ve selected a password that you’d like to share, you simply select the “share” tab, choose who should see it via their e-mail address, and then decide their level of power. You can give someone ownership, allow them to update it, or simply let the user read the password.
The Passbolt browser extension is simple but effective. While you can’t edit entries or view all of your settings from it like in 1Password’s, you can create new entries, copy and paste specific parts of an entry like the username or password, or simply click “use on this page.”
Unfortunately, Passbolt’s browser extension doesn’t automatically ask you to add in a new password upon account creation. This is odd, considering many competitors like 1Password or RoboForm will do so. Instead, a new password must be manually added via the extension. It does do some of the work for you, however.
When you click to create a new password, the extension will automatically fill in the name of the website and its URL. From there, it’s up to you to put in a username and password. You can also choose to generate a password here. This isn’t as useful as say, LastPass, which automatically asks you to enter in a new password, but’s better than nothing.
Finally, you have the administration tab. This section allows the owner of the plan to go in and adjust who has control of what, on top of additional options like if users need a Yubikey third-party authenticator before logging in, or if they can use a Duo provider.
This space is a great way to manage your different users, especially if your group is made up of ten or more. Here, you can also control the user directory. Essentially, this means that you’re breaking up users into different groups, such as admins or supervisors, to easily pick and choose their permission set.
Passbolt Plans and Pricing
Passbolt contains a variety of different plans, broken up into Community, Startup, Business, and Enterprise. Let’s start with the Community plan.
The Community plan is actually free to use and contains features like user management, password sharing, and browser integration. That said, it’s missing some essentials like the administration section, two-factor authentication, and users on this plan won’t be able to use the mobile application coming out in late 2019.
One should also note that the Community plan is meant for installing on a server so that your community members can take advantage of the password management services to up their security.
The other plans are much more traditional, though again, they aren’t really catered towards individual users. Instead, only those involved in a tech startup or bigger organization should consider these.
The Startup plan, for example, contains the aforementioned administration panel, two-factor authentication, and an activity log. That and it will support integration with the Slack workspace alongside the mobile application once it releases.
In fact, the Startup, Business, and Enterprise plans are all almost exactly the same. The few differences include the Startup plan allowing ten users, while the Business plan is 50 and Enterprise is unlimited. Also, Enterprise plan users get support via phone and Slack should they so need it.
These are self-hosted plans, mind you. You can also apply the Startup, Business, and Enterprise plans to the Cloud-Hosted section, which ensures the Passbolt company will host everything instead of you having to. Both plans are allowed some more users here, and there’s obviously less work on your end regarding setup.
Also, these plans are definitely on the expensive side when compared to other business plans like LastPass, though you’re paying for the open-source capabilities here. That and Passbolt allows anyone to test out a plan for free via its live demo option – a nice touch.
Passbolt Password Manager Ease of Use and Setup
Thanks to its lack of features, Passbolt is pretty easy to use regardless of your experience with password managers. The user interface is laid out similar to Trend Micro’s in that there are a few different tabs to switch between.
To start, you must create an account and a master password. This password is used to log into your Passbolt account from any device, so keep it secure!
Then, we have the passwords screen. This, of course, houses your many passwords in a list format that you can sort by custom tags, favorites, items that are shared with you, and more. From here, you can customize each password entry, filling out its description, notes, or who it’s shared with.
Unfortunately, unlike many competitors like 1Password, RoboForm, SplashID, or others, Passbolt doesn’t support identity or card entries, only passwords. That and there’s no security center that showcases overall password strength nor is there support for attachments. However, it’s a little difficult to be mad at this lack of features considering most of those cater more towards singular users. Passbolt is catering to businesses that have to share passwords, and it does that just fine.
Then you have the users page. In this section, you can view everyone who has access to the information within this password manager, on top of categorizing them within customizable groups. Not only does the page show who is part of what group, but it also details when a user has last logged in and when their group has last been modified.
Finally, you have the help tab. This section houses an extensive FAQ that answers questions regarding server hosting, how to share passwords, and much more. It’s nice that this section is so easily accessible, considering other password managers have these things a little more buried. We’ll go over the help page more in the support section.
Passbolt’s security is a little different from the industry standard AES-256. Instead, this password manager takes advantage of something called OpenGPG, a “standard which provides a combination of strong public-key and symmetric cryptography,” reads the website.
While all of the information is stored on servers, Passbolt can never see your passwords in plaintext. Instead, everything is encrypted at all times. However, one should note that usernames, comments, lists, and more remain stored in plaintext. This is likely due to the fact that you’re constantly sharing this information with others in your business.
Unfortunately, if your master password is ever compromised, you’re going to have to start the entire manager all over again. This is a shame, considering many competitors like 1Password have extensive emergency kits in case of this happening. All is not lost, however.
If somehow a bad actor gains access to your master password, you can invoke something called a revocation certificate that is created once you make an account. If your account has been compromised, you can use the certificate to let the other users know that your key is now invalid. However, this certificate must be uploaded via a third-party service as of this writing. There is no built-in way to do so at this time.
Put simply, Passbolt’s encryption methods aren’t necessarily lacking, but the fact that there are no recovery options, and that only your passwords are encrypted, may make some users unhappy.
Passbolt Customer Support
Passbolt’s customer support is lacking for most unless they pay for the Enterprise plan. While this plan offers great features like phone and Slack support, most users won’t have access to this as the lower plans are much more affordable. Other platforms like F-Secure’s key provide live chat, email support, phone support, and more. Fortunately for those who can’t afford the Enterprise plan, there is e-mail and forum support on top of an extensive FAQ.
Accessible via the “help” tab within the password manager, Passbolt’s FAQ page is broken into server hosting, getting started, configuration methods, and much more. Not only that, but there’s even a space to check out how to contribute to the platform, or to find out what features are coming in the near future.
There’s also a Medium page with blog posts and other long-form pieces of support content for you to access as well, on top of an active forum full of dedicated users.
When contacting the forum representatives about a refund, I waited two days before bumping the thread to ask again. From there, a representative said you can refund the software within 15 days of paying for it, and that the money will take around 5 to 10 days to appear in my account once again. Of course, he made sure to note the free trial available before buying – a nice touch.