There have been many similar questions, but I have not found recommendations with the following, common requirements:
- Multi-user. We have a high fluctuation of devs, so all or nothing is not good enough (Keepass). If you split it up into several keepass db files, then you would still need to handle passphrases and key files for all those separate dbs. Also, we need a means to block access to a leaving dev, without disturbing all the other devs.
- simple, reliable and conflict-free distribution of changes and versioning. Our current problem: you opened that keepass file from dropbox in the morning and saved a changed version in the afternoon - overwriting the change somebody else did at noon.
- Usability - it should be installable in an easy way and should be usable with a GUI. keepass is good here, pass & hashicorp vault aren't.
- Secure - lastpass & co most end up being fed into their browser extensions at some point. They aren't trustworthy and the browser isn't the place to store your credentials. Maybe a web crypto / subtlecrypto based password-manager could be, since it doesn't reveal keys to js or the DOM?
- Opensource - why should you trust any commercial company? They say it's end-to-end-encrypted? Well, even if they don't just lie, it's trivial just grab the plaintext password when it's decrypted. We all know there is enough economical/political interest in this kind of data.
- Cross-plattform - we have devs on win, mac and linux - they all should be able to work with it.
So, my favorite solution is pass - it's just git + gpg-encrypted text-files. It's not as powerful as hashicorp vault - but it's enough and it's simple to grasp for everybody. Unfortunately: none of the available GUIs/clients is satisfactory: in none of them could I setup remote git repos and the ones relevant to me were just very unreliable to install and use. If it's not useable for the less techy devs, then that is a dealbreaker.
I thought to just use FileManager and context-menues of Git- and GPG-integrations (e.g. Win-Explorer + TurtoiseGit + GPG4win), but then a dev would need to decrypt the password file, open it, copy things - and forget to delete the decrypted plaintext file. So it's a lousy workflow and unsafe by design. So I started scripting something to be included as a context-menu, that would decrypt in memory and copy the right line. However, there are some things to be resolved that I don't have time to do myself atm: for example, to be crossplattform it could not be written in bash, but something like python. For entering the passphrase it needs already a GUI library.
I'm thinking: the heck, my use case isn't special at all - how comes that after so much searching, I couldn't find a single good solution yet?
So, my only question is: what do you guys use / recommend?