Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#171

Post by ahupp »

FussyZeus wrote: post #129
kennu wrote: post #93

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…

I love 1Password but haven't upgraded specifically because of the cloud service. All my stuff is already in Dropbox, and 1Password essentially came to it's old users touting a subscription fee to a functionally identical service. Why am I paying them every month to store my passwords when I'm already storing them myself? I'm sure I'll have to cave at some point what with the ongoing march of progress, but it leaves a…

They make it very non-obvious, but you can buy a standalone license for 1p v7 after downloading here: https://1password.com/downloads/

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#173

Post by mdaniel »

benhurmarcel wrote: post #164
kennu wrote: post #93

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…

The main issue of 1Password is the subpart Linux support (there only are browser extensions).

It becomes hard to discuss "1Password for Linux" without knowing if you mean 1Password.com or the old 1Password, with .opvault locally and/or synced to Dropbox-esque

However, if it's the latter, KeePassXC now knows how to read the .opvault format: https://github.com/keepassxreboot/keepassxc/issues/1462 I could imagine teaching it to write their opvault file format, too, but at the time it wasn't a use-case that I needed

I would actually suspect teaching KeePassXC to read the 1Password.com cached vault would be even easier, since they now use sqlite3 for storage, but it would still -- afaik -- be confined to your local machine since their web API is undocumented

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#174

Post by geofft »

0. If the FBI/Mossad/etc. want my passwords, they can threaten to cut my toes off one by one and I'll just give them the passwords. So they're outside of my threat model.

1. All my important stuff has two-factor auth, so a malicious password manager company couldn't get in anyway.

2. If you're using one of the major vendors with a reputation and a paid service, that produces a fairly strong incentive for them to not be intentionally malicious - if they were caught distributing an update that made it possible for the companies to see your passwords, nobody would ever use them.

(All the major password managers do client-side encryption; they don't store plaintext passwords themselves. They do distribute the client that lets you decrypt passwords, but that's it.)

So that leaves accidental risk (bad crypto, hijacked update chain, client-side vulnerabilities). Out of the options, I'm comfortable with the track record of 1Password in particular.

I'm very interested in open-source options, but the major ones are all proprietary and the open-source ones are all volunteer-driven and I think the risk tradeoff is wrong. It's not a decision I feel 100% comfortable about but between the options of proprietary-but-professionally-maintained and open-source-but-hobbyist-maintained the former seems vaguely preferable for security-sensitive software, especially given that one of my requirements is I want to use a password manager extension.

Shameless plug, I have a personal digital security podcast and we took a look at various password managers and their security track records recently: https://looseleafsecurity.com/episodes/password-manager-secu...

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#175

Post by geofft »

wglb wrote: post #127
derpherpsson wrote: post #3

Answer: Its okay to store the encrypted passwords there. Since they are encrypted.

But does the server have the ability to decrypt?

No, for all the major / well-respected password managers (and probably for all the minor ones too), all the crypto is done client-side.

1Password, for instance, has a pretty good security doc about it: https://1password.com/files/1Password%20for%20Teams%20White%...

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#176

Post by audente »

I'm using EnPass https://www.enpass.io/ They claim to use "open source and peer reviewed cryptography libraries"and that "all your data is with you only and nothing is stored on our servers". They sync data among devices using Dropbox or iCloud.

I trust them.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#177

Post by tdurden »

I am not comfortable at all using a cloud-based password manager. That said, one of the best options (1Password) does not force you to use their cloud -- they do seem to go out of their way to make this a less than obvious option though, which is disappointing.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#178

Post by valleyjo »

zmix wrote: post #160
selfup wrote: post #97

Earlier quoted context omitted.

I read up on their blogs and as much technical explanation as I could find, and by far 1Password seems to be the best with a cloud offering. Also Apple buying into using 1Password company wide helps gain some trust (I am sure there was some serious auditing): https://medium.com/enrique-dans/apple-and-1passwords-deal-sh...

> Also Apple buying into using 1Password company wide Huh! One would assume, they use Keychain with iCloud?

The biggest problem with keychain for me is that it's only _your_ passwords. If you need to share things, then it's useless. 1Password is great for keeping logins for services that are in either mine or my wife's name. (Health care, 401k etc).

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#179

Post by lukasm »

kilroy123 wrote: post #95
lukasm wrote: post #43

I use a hybrid approach with Lastpass used as a password entropy storage. For important services like Github I only store half of the password in LastPass. Then I add a nonce and a generic short password. The final password is 12-16 random characters for LastPass + 3 chars Nonce that I generate from the service name (in my head) and a short 5 character password. If LastPass leaks the secrets no one is able to take ov…

This is a great idea, but doesn't it involve a lot of manual work? Or is there some kind of automated way to do this?

It requires no extra work. Lastpass automatically fills out the creds, I have to type a few extra characters in password input and press login. Only tiny annoyance is pressing No in Lastpass "Do you want to update your password?".

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#180

Post by m-p-3 »

I use KeePass stored in a cloud storage provider. As long as I control the encryption ke, it doesn't concern me too much if someone manage to grab the KDBX file, as I know the password is quite secure (over 32 characters, with symbols) and has never been used anywhere else.
Post reply on HN