Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#21

Post by Boulth »

spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

Not to mention pass, due to its connection to GnuPG, can protect secrets using Yubikey that require 6 digit PIN (will lock after 3 tries) and touching the blinking dot.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#22

Post by Boulth »

rmk2 wrote: post #16

I'm not a big fan of putting my password (encrypted or not) somewhere where I don't have control. Therefore, I am using Passbolt[0] at work, since that gets me a browser addon plus web ui, while it also allows me to host it myself, i.e. where I can physically check what ends up written where in the database. Passbolt is open-source, encryption and sharing is GnuPG-based, and they have paid plans available. [0]: https…

Too bad that Passbolt doesn't use native GnuPG for decryption. This is technically possible as evidenced by Mailvelope.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#23

Post by posix_me_less »

jen729w wrote: post #5

Same way I feel about security domains at work: you either have to trust encryption, or never use any network. It’s that binary. At work I’ll see people — the security team, usually — taking some already-encrypted thing and re-hardening it to the nth degree. I think that’s stupid. If you don’t trust your encryption, don’t bother using it. If you do trust it, stop there. It’s maths. It’s proven. I feel the same about…

Lots of truth there, but there is an argument to be made about layers of security. If the second level of encryption is of very different kind than the first (different encryption library made by different people), sometimes the hassle with it may be worth it.

For example, some backup providers will encrypt your data for transport to their machines and then reencrypt them for storage. Would you trust TLS implementations in the path and provider's application to protect your data? Or would you rather encrypt yourself and only then let the provider handle it?

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#24

Post by cygned »

Not so comfortable. However, I trust the 1Password guys, I had some contact with the founders a couple of years ago, they even gifted me the iOS and Mac version, and found them competent and trustworthy.

The reason I went with the cloud sync is that I have to share secrets over multiple companies with all kinds of people and 1Password is simply the best compromise of convenience and security I found.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#25

Post by dancek »

spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#26

Post by kapep »

I also never felt comfortable using cloud password managers. I used to have a KeePass file on Dropbox (with an offline key file) to stay a little more in control. Synchronization worked quite well but some month ago I switched to following setup to avoid Dropbox or similar services:

I have a KeePass file and use Syncthing to share it across all my devices. The keyfile is not synced and I manually send to any new device. Syncthing works well and most KeePass clients can nicely merge two KeePass databases in case of conflicts. Firefox integration with Kee.pm is really convenient.

For me this works really well. It was easy to setup and in my opinion it is very much worth it if you want to avoid third-party hosting.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#27

Post by tejado »

I would trust them but I don't take the risk of "trust". There could be always issues which are out of your or the Password Managers control, e.g. crypto issues and also long term issues like quantum computing.

Due to this, I keep all of my passwords offline, as far as possible. For mobility and comfort reasons, I developed Authorizer (https://github.com/tejado/Authorizer):

"A Password Manager for Android with Auto-Type over USB and Bluetooth, OTP and much more.

The idea behind Authorizer is, to use old smartphones as a hardware password manager only. To avoid manual typing of long and complex passwords everytime you need them, Authorizer provides Auto-Type features over USB and Bluetooth. It pretends to be a keyboard (e.g. over an USB On-The-Go adapter) and with a button press inside the app, it will automatically type the password for you on your pc, laptop, tablet or other smartphone."

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#30

Post by juangacovas »

kapep wrote: post #26

I also never felt comfortable using cloud password managers. I used to have a KeePass file on Dropbox (with an offline key file) to stay a little more in control. Synchronization worked quite well but some month ago I switched to following setup to avoid Dropbox or similar services: I have a KeePass file and use Syncthing to share it across all my devices. The keyfile is not synced and I manually send to any new devi…

+1 for the sync/conflicts resolution of Keepass. Also I think that putting a shared database (file) on a shared folder at the office if needed is an overlooked feature..
Post reply on HN