Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

181–190 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#181
post #93

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…

I'm a cloud 1pass customer, but the UX leaves something to be desired, especially for a cloud app.

When adding an account to 1pass, it's important to click [save] before closing the tab, otherwise it's lost. (Having to pull passwords out of the PW generator history is a hack.) (It does support my belief/their claim that the pw decryption is done locally though.) To be fair, it used to be that you could accidentally click on the left pane and lose the unsaved account - they've fixed that in the latest of the 1PasswordX extension.

I haven't moved my entire life to 1password, so I don't have, eg, my passport or SSN or any outdoor license's in the system, and the inclusion of such things degrades my user experience - imo the new button should make a new login, with a button on that panel/page to change type, rather than making me pick which type of secret I'd like to create when I hit the [+].

I have, however, added my credit cards, but as far as UX, in the main UI, I click on the credit card category, then click on the search and try to search for a website login, only to have 0 results. Not surprising, I don't have an ycombinator credit card, but search results pane could surface hits in other categories if there are zero hits in the selected category - most (all?) of the data in 1 password is text, so I'm doubtful that full-text search is that expensive.

1PasswordX (the obvious chrome extension to install) doesn't work with TouchID without some extra configuring. (I set that for less technical people in my life, and that only came up after asking them why they stopped using 1pass.)

I'll give them a bit of pass on the difficulty of adding accounts on ios, but where many/most websites use email as username these days, maybe that could be autofilled when adding/creating logins manually?

And for my gripe about cloudification - I'm reasonably happy to pay a subscription (I currently pay for one, and am hopeful they're working on ^ UX issues), but every time I add something to 1pass, I question if adding secrets to a cloud/SaaS app, is going to royally fuck me over if AgileBits ever shuts down. Being able to save file-based backups to various places was reassuring. (Yes, this is a UX issue - it's not great if a customer questions if they want your product, each time they make the product more useful for themselves.) (See also: Trying to choose a Netflix title to watch, and giving up in disgust.)

TBC, I'm a (reasonably) happy customer, but I wouldn't hold up their UX as "well polished". I don't use it as a selling point when trying to convert people, certainly. At least I don't have to interact with it for the most part - I click into a password field, authenticate, and click autofill.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#182
post #175
post #127

Earlier quoted context omitted.

But does the server have the ability to decrypt?

No, for all the major / well-respected password managers (and probably for all the minor ones too), all the crypto is done client-side. 1Password, for instance, has a pretty good security doc about it: https://1password.com/files/1Password%20for%20Teams%20White%...

It is unclear if LastPass is well-respected, and if I recall correctly, at least at one point, the master key was accessible by the server.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#183
post #40

Earlier quoted context omitted.

I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps bu…

> Pass on my iPad is quite literally just a pull to refresh. I would have thought it'd be much more painful with all the GPG nonsense in play! FWIW, the pull to refresh effectively just runs `git pull`. GPG isn't involved.

Ah yup yup, that is true. For some reason, I always have this idea that it's pulling and decrypting everything. Gotta remind myself that computers are actually fast and decryption can happen on the fly :)

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#184
post #61
post #40

Earlier quoted context omitted.

I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps bu…

For Windows there is Gpg4win, which includes a port of Kleopatra.

Thanks! I'm actually moving to a Windows environment for development shortly so this is handy to know. I'll likely just use pass via WSL2 but I might give gpg4win a shot too

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#186
post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

3. Copying passwords to clipboard is awfully insecure. Not that I am aware of. What would make it insecure?

All processes running on your computer can read the clipboard at any time. Many have plugin systems that expose clipboard contents to plugins.

Normally when you use a password manager you have to trust the password manager, the browser and the OS. By copying to clipboard you have to trust every piece of software you ever installed and every update they later got.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#187
I won't trust any cloud-based password storage, especially not a proprietary one - even audits do not change my opinion about that - as the main attack vector isn't form the hacking side, but from 3 letter agencies and governments instead.

Plus it is a huge registry of metadata - any site that i store a password for gives them knowledge that i do use that site.

I tried few local solutions - sadly for my use case they both need to work in a shared way(some passwords are used by multiple colleagues at work for example, as they are company wide accounts for external sites that do not support individual accounts), and they do need to work on windows in a non cumbersome way.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#188
post #22
post #16

I'm not a big fan of putting my password (encrypted or not) somewhere where I don't have control. Therefore, I am using Passbolt[0] at work, since that gets me a browser addon plus web ui, while it also allows me to host it myself, i.e. where I can physically check what ends up written where in the database. Passbolt is open-source, encryption and sharing is GnuPG-based, and they have paid plans available. [0]: https…

Too bad that Passbolt doesn't use native GnuPG for decryption. This is technically possible as evidenced by Mailvelope.

Passbolt team was actually part of the Mailvelope project that did this. Integration setup is not easy / very user friendly, that's why it's not the default on Mailvelope.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#189

Earlier quoted context omitted.

> and I haven’t been able to upgrade to any of the newer releases Why not, i use iCloud to store my 1Password data, and i still use the latest macOS 1Password version (7 i believe). It's a standalone app without a subscription (i would never pay for a subscription just because they tacked on a cloud service I don't need, to justify the subscription model...)

Maybe it’s different for iCloud users, because 1Password doesn’t let me upgrade to version 7 without paying for a cloud subscription (by the way, I use Dropbox for my data).

If i remember correct, 1PW7 from the App Store is subscription only, and if you want a single licence you have to get 1PW direct from AgileBits.

https://1password.com/downloads/

Post reply on HN