Zoho Vault - a couple of questions

Hey there,

Happy to see that you’re testing Zoho Vault for your team. I hope it goes well for you. If not, please feel free to DM me. I work for Zoho and I’ll be happy to help you out.

I would like to share some details about the issues you’re currently facing and some solutions or workarounds to help you out.

Regarding the extension timing out often, it’s because we do not store your master password on our server and all the encryption and decryption happens at the client side. The moment you close your browser, your master password will be cleared and you will have to re-authenticate. The only workaround at the moment would be to leave your browser open as user djasonpenney has suggested below. However, if you’re getting timed out even when your browser is open, you can verify your extension’s settings and set your extension to only be locked after a week (For now, that’s the max session validity.)

We are currently exploring integration options with Windows Hello and Zoho OneAuth (Zoho’s multifactor authentication app).

Regarding your second point, if you’re comfortable with letting your teams save their personal passwords in Zoho Vault, you can let them do so. They will no longer have to save their passwords in the browser for personal use (as it’s not recommended). Your users will just have to select ‘Mark as personal’ when adding new personal passwords to their accounts. They can also export saved passwords from their browsers and import them to Vault. We support readymade templates for all popular browsers.

When users leave your organization, they will have the option to transfer all the business credentials they own to an admin or a different user in the org. Once done, they will then be able to export their personal passwords. They can then import this file to a newly created personal Vault in the future. Vault has been and will forever be free for personal use.

Alternatively, a super admin can also acquire such users’ business passwords before the users leave the org.

I hope this helps. Feel free to hit me up if you have follow up questions.

The browser extension requires authentication (master password) every time the browser is closed,

Every browser extension does that. The only solution is to change user behavior and have them MINIMIZE the browser when not in use instead of closing it.

Added bonus, the user gets a swifter browser experience. The way the browser shows all your old windows when you start it up is a slight cheat, anyway.

If the extension is active, none of the credentials stored by the user in the browser are available any more.

If I understand your concern, the user has two sets of credentials, both personal and shared with the team?

First, you should definitely turn off password storage and autofill features in the browser and let the extension do it all. This is a security feature as well as that the two can end up is a nasty tug of war.

Second, I don't know the specifics of Zoho, but most password managers have specific features for this kind of sharing. Bitwarden, which I know more about, has the notion of an Organization that each user can belong to in addition to their own private vault entries. The browser extension sees a unified view with all of the passwords, and the user has a seamless experience.

You will have to do a bit of research to find out how Zoho does this. Sorry I can't help more there.

Sorry to ask a non relevant question here. I am a beginner user setting up an account for the first time. My question is the email address along with the email password requirement is for authentication, right? I am worry now that my email account might be exposed. Am I too paranoid? Why couldn’t Zoho send an authentication code to my email instead?

Did you test Bitwarden? Bitwarden do not require master password at browser reboot.