Keeper

So we're looking for a password manager for our business and with all the LastPass issues I saw Keeper Security mentioned who aren't one I had really heard of until now.

Their website has some pretty good info on it around their security model and how secure they are but of course "they would say that wouldn't they" seems to apply.

I have a few people who've been using LastPass now asking me what I'd recommend and usually I say to look at Bitwarden or 1Password but this looks quite good.

Is anyone using them please and if so what's your feedback on the product both for enterprise and individual use?

I have refrained from posting about this here until more information was gathered, especially with how well-revered Keeper is here, but everyone here should be made aware of massive security issues my company and my team have experienced with using Keeper Security's password manager. We are partnered with Keeper through their MSP program.

Anyway, onto the important-but-scary stuff:

Several months ago, one of my technicians reported that they had access to a passkey that I setup for a personal Google account. This passkey was not shared with anyone else, at all, and at any point in time. It confused both of us as to how they could possibly see (and even use!) this Passkey as it was not shared with anyone, and was not within any folder that was shared with anyone.

As time went on, we saw this with more records, and it was the same case: They were not shared with anyone, but they were now showing up in search for other members of my team.

Separately, my business partner was trying to remove records from our Keeper tenant that were actually transferred from our founder's Keeper account as he ended up retiring. This business partner of mine has amazing attention to detail and is incredibly careful getting all the details sorted out and treads very carefully with the work she does. When she selected a bunch of records from the folder our founder's records were transferred into and went ahead to delete them, what she discovered was that for some reason multiple shared folders with records we share with our team mysteriously also got deleted, along with a ton of records that I don't even share out to anyone and are in my own Keeper account.

We all have our own Keeper accounts, of course.

She was in her account, and for some reason, deleting these records from our founder resulted in my own records that are not shared with anyone else at all being deleted. She was somehow able to delete these records, and could see them in the deleted items, but Keeper would not allow her to restore them, so I had to restore my own records.

We purchase Keeper through Pax8, so I reached out to Pax8 support to investigate all of these oddities.

I had to go through a very lengthy process of sending Keeper and Pax8 the private record URLs for each record that we were seeing shared out that shouldn't be shared, along with the same for shared folders I had to recover. There were also records that were scattered into other random shared folders, and now I even had additional records of mine that were showing up for other members of my team.

Working with support for several weeks and not getting any solid answers as to why this all happened, it was finally revealed from Keeper that the cause of this was actually version 16 of the Keeper desktop app, which has a known bug where records may be shared with team members who aren't listed as having shared access, meaning your records can randomly be shared out to other people in your tenant. They confirmed that there was no indication that my business partner deleted the records I own, and that this was also likely because of a known bug with Keeper.

I have plenty of records that are still in places where they do not belong, and as confirmed by support, it's at no fault of our own.

We are now moving away from Keeper. It's one thing for our tiny team to experience this issue, but it shakes me to my core to consider a possible scenario where we resell this to a client and then that client has records shared out with employees who end up using those records maliciously. If that came back to us, maybe we'd be sued into the ground, or at the very least we'd lose that client. I'd rather not take that risk!

I apologize if I have not worded this well, or if it's tough to follow. This has been an investigation that took a long time to complete, only for it to ultimately be revealed that yeah, there's a bug in Keeper that can cause this to happen.

If you use or are interested in using Keeper, my personal advice as a stranger on the internet is to avoid using it, avoid reselling it, and absolutely go elsewhere.

I'm using paid Keeper for 4 years now and I satisfy with it. But when people comparing password manager, I barely can see Keeper in their comparison. The typical comparison usually KeePass, Bitwarden and now Proton Pass been in their list. Still no Keeper in their list.

Something must be wrong somewhere. Or Keeper team put more focus on Enterprise?