A Password Manager for Four People

Why rollouts fail

Almost never because anybody objects to the idea.

They fail because for the first fortnight the manager is slower than what people did before, and there is no moment at which the old habit is switched off.

So two people adopt it, two carry on with the notebook and the shared password, and the business ends up maintaining both systems, which is worse than either.

The rollout is therefore an operations problem rather than a persuasion one, and it is worth planning as a small project with a sequence.

Start with shared accounts, not personal ones

The sequencing decision that determines whether this works.

The instinct is to have everybody install it and start saving their own logins, which is diffuse, produces no visible benefit, and is easy to abandon.

Start instead with the accounts several people use: the domain registrar, hosting, the business email admin, the accounting system, the booking tool, social accounts, and the bank where multiple access exists.

Those are the ones currently on a note, in a group message, or in one person's head.

Putting them in a shared vault produces an immediate benefit everybody notices: nobody has to ask anybody for a password.

Once people are opening it daily for that reason, personal use follows without being mandated.

The vault structure

• One shared vault for accounts everybody needs.
• One restricted vault for financial and administrative accounts.
• Personal vaults for individual logins.
• At least two people with access to the restricted vault.
• Recovery arrangements set up and tested.

Keep it to two or three shared vaults. Elaborate structures with a vault per system produce confusion about where something lives, which sends people back to asking a colleague.

The migration afternoon

Do it in one sitting rather than gradually, because a partial migration is what leaves both systems running.

List every shared account first: what it is, who uses it, and what it controls.

Enter each into the vault, and change the password as you go, since a good proportion will be old, reused, or known to somebody who has left.

Enable two-factor while you are in each account, because you are already logged in and it is the natural moment.

Then destroy the old record: delete the note, clear the group message, shred the card by the till.

That last step is what makes it real. Leaving the old list in place means it stays in use.

A worked example

A four-person firm had passwords in three places: a notebook by the till, a spreadsheet on the office machine, and the memory of whoever set the account up.

They booked one afternoon and worked through twenty-three shared accounts.

Nine had passwords more than five years old, four were the same password, and two had been set up by somebody who had left and had to be recovered through support processes.

They changed every password, enabled two-factor on the eleven that supported it, and put everything in two vaults.

The notebook was destroyed at the end of the afternoon.

Personal adoption happened over the following month with no pressure, because people were already opening the application several times a day.

The owner's assessment was that discovering two accounts nobody could access had justified the afternoon on its own.

Remove the friction

The practical measures that decide adoption.

Install the browser extension on every machine during the rollout, not afterwards, because typing passwords manually from the vault is the experience that makes people give up.

Install the phone application too, since a manager that only works at a desk fails for anybody working from a van.

Turn on biometric unlock where the device supports it, which removes the daily cost almost entirely.

And make sure the master password is one people can actually remember, since a forgotten master password on day three ends the rollout.

The person who resists

There is usually one, and the objection is rarely the stated one.

Stated as not trusting one place with everything, or preferring their own system, and usually meaning that their current method works and change is an imposition.

Arguing about the security merits does not move this. Making it easier than what they do now does.

Sit with them once, migrate their most-used logins, install the extension, and let them experience not typing a password.

Where somebody genuinely will not adopt it for personal logins, the shared vault still works, and the business accounts are the ones that matter. Partial adoption of the shared vault is a success rather than a failure.

What to do after the first afternoon

Three follow-ups that keep it working.

Add new accounts to the vault when they are created, which requires saying so once and occasionally repeating it.

Review the shared vault when somebody leaves, changing anything they knew rather than only removing their access.

And check the recovery arrangements every so often, since a manager where only one person can recover the vault has moved the single point of failure rather than removed it.

None of that is onerous and all of it is skipped, which is why vaults drift back toward being one person's system.

The counter-case

A manager introduces a concentration of risk and it is worth naming honestly.

Everything is behind one master password, and a compromised master or a weak recovery arrangement exposes more than any individual password would.

The mitigations are ordinary: a strong unique master password, two-factor on the manager itself, and recovery that more than one person can perform.

There is also a size below which this is disproportionate. A sole trader with eight accounts and a good memory is not obviously worse off than with a subscription, though the browser's own manager is usually a better answer than a notebook.

For any business where more than one person needs the same login, the shared vault solves an operational problem as much as a security one, which is the argument that actually persuades people.

The rollout

1. List every shared account and who uses it.
2. Book one afternoon and do it in one sitting.
3. Change each password as you enter it.
4. Enable two-factor while you are in each account.
5. Install extensions and phone apps on everything.
6. Destroy the old notebook or spreadsheet.
7. Set recovery so two people can get in.

Step six is what stops the old system quietly continuing, and it is the step people postpone.

The accounts worth protecting first are covered in turning on two-factor everywhere that matters.

Frequently asked questions

West Coast Media Solutions Inc. provides web design, web development, hosting, digital marketing, and business consulting to organisations across Canada, drawing on more than twenty-five years in the field.