Keeweb has been my favourite so far. I have the client installed everywhere and in worst case I can fallback to google drive and the keeweb website. The compatibility with keepass is a plus for my corporate environment.
Ask HN: How comfortable do you feel using cloud-based password managers?
31–40 of 199 posts
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#32I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…
Bitwarden has also had an external audit.
With regards to Bitwarden, it has a wordphrase on the account which only you know. You can verify this when you connect to the cloud. You can run the server within your own cloud.
With the cloud, you can assume that the government has access to the encrypted database. If you have a strong password, it will take them longer to brute-force your database. We are talking about two governments here: the US government (most password managers are from US companies and are hosted in US clouds) and your own (who can attempt to ask for the data), this is no issue, but I believe you should by default not trust them. This is important because it should be part of your risk assessment.
It would probably be easier to attempt a MITM (with help of the password manager sysadmin). I've once seen a fake Lastpass login page (back when I used Lastpass).
Almost all password managers can import/export their database to CSV. This allows you to avoid a vendor lock-in.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#33Very uncomfortable. I'm using bitwarden and afraid that my data may disappear at any moment so there will be no local backup to restore from.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#34Not at all. First of all, it's unnecessary, but the idea itself is not very sound in the first place.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#35The only thing that (hopefully) is stored in the cloud with respect to password managers is the encrypted vault containing your passwords. Securing your vault with a strong master password in addition to a U2F like YubiKey seems to me a pretty safe way to store your important data.
Additionally, using an open-source password manager that you can audit alleviates any further paranoid concerns you may have. If you also worry about the cloud provider suffering a severe outage then you can always keep offline backups. Assuming that you have the expertise and time you can implement a solution yourself but it always depends on your threat model and your level of paranoia.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#36Same way I feel about security domains at work: you either have to trust encryption, or never use any network. It’s that binary. At work I’ll see people — the security team, usually — taking some already-encrypted thing and re-hardening it to the nth degree. I think that’s stupid. If you don’t trust your encryption, don’t bother using it. If you do trust it, stop there. It’s maths. It’s proven. I feel the same about…
>maths. It’s proven. No they are not. That’s one of the things that makes designing correct crypto systems difficult. Going the wrong way through most cryptographic trap doors is conjectured to be difficult but I’m unaware of a single one that’s proven.
The one-time pad has been proven to have perfect secrecy.
Given a ciphertext, the only information available is its length.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#37I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…
I'm guessing "regular ol' pass" is "pass
the standard unix password manager" https://www.passwordstore.org/ ?
Just thought I'd stick that here to save others the googling.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#38Fine with Lastpass. It's not like I've got nuclear launch codes in there anyway & the stuff that matters has 2FA.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#39Plenty comfortable with LastPass here.
I use LastPass. I think a case of “The best is the enemy of the good.” It's probably not perfectly secure but good enough and the time you might spend trying to do something better might be more productively spent on something else.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#40I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…
I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?
I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets
Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS
Phew, that's a lotta apps but you can just pick and choose whatever you prefer. I have no idea about Windows myself. Once I imported my keys (public + private) into each application, I never really had to touch them again.
As I mentioned, I use my GPG key for signing my commits. I think I saved my password to my laptops keychain so it automatically signs my commits without my interaction.
Similarly, Pass automatically encrypts and decrypts everything without my interaction. Whether that's a good idea security wise aside, it works fairly seamlessly. Pass on my iPad is quite literally just a pull to refresh. I would have thought it'd be much more painful with all the GPG nonsense in play!
So, back to your questions:
> Does your setup require copying the same key to each device?
Yes but only once. It may also require entering your password anywhere from everytime to never depending on your settings. For my android device, I have to do it once every restart but after that, a process keeps my "store" open for example.
> What would happen if someone got your gpg key?
Presumably they could take all of my passwords and sign my Git commits as if they were me.
Personally, I have no strong investment in my GPG key, nor am I someone well known so this would have little to no effect beyond being a big annoyance. I would still own my email account so I'd still be able to reset the majority of my passwords.
Actually, I don't know my email password (since it's randomly generated) so I'd have to cross my fingers and hope the attacker hasn't revoked any of my sessions. Once again, no different than any other password manager. At least losing the key would be my fault, and not that of a third party I suppose.
> What would happen if you lost the key?
Presumably I'd lose all of my passwords but once again, that's no different than the single master password setup of those cloud based password managers.
I didn't realize until I looked it up just now but you can apparently generate a revocation certificate, separate from your key. From what it says on the tin, I imagine you can keep that safe and if you did lose your key, use it to tell any of the popular key servers that it's gone.
That wouldn't do anything to get your password back though, it would just signal to anyone looking up your key, that they shouldn't trust it.
Anyway, that was a bit of a tangent but the best way to learn is to just play around with GPG keys. The only reason I know the little I do is purely through making mistake :) I went through heaps of keys myself (I forget why) before I finally settled on my current one. You can even see some revoked ones here http://keys.gnupg.net/pks/lookup?search=marcus%40thingsima.d...
[1] https://www.openkeychain.org/ [2] https://www.openpgp.org/software/kleopatra/ and https://kde.org/applications/utilities/org.kde.kleopatra [3] https://gpgtools.org/ [4] https://github.com/mssun/passforios