Been using KeePassXC for the last five years.
Ask HN: LastPass Alternatives
51–60 of 83 posts
Re: Ask HN: LastPass Alternatives
#52I use KeePass and just save the encrypted file in iCloud. Easy, end to end encrypted, always up to date, free. https://open.substack.com/pub/magoop/p/how-to-manage-500-pas...
Does KeePass supports OTP? That's one of the reasons I have stuck with 1Password.
Depends on which type you mean. In its security settings you can have a password, a key file and then a challenge response via a YubiKey or OnlyKey for HMAC-SHA1 Challenge-Response which is sort of OTP but potentially not the type you are considering? It doesn't do a fallback to email or mobile for a second factor but it can use the hardware keys.
Re: Ask HN: LastPass Alternatives
#53Throughout the years I've tried most of the more popular ones on the market, some times forced via work and other times because I was curious. - KeePassXC: tried this when I was looking for a self-hosted, open-source alternative to LastPass years ago. Was surprised at how well it worked, but syncing was too much of a hassle so I gave up fairly quickly. - 1Password: my favorite of the bunch so far, great UI and UX, wo…
> 1Password: my favorite of the bunch so far, great UI and UX
Weird, I can't stand the 1Password UI/UX. I've used it at work for two years now, so I can get around ok at this point, but for a long time I struggled to find even basic functionality. Also the keyboard navigability is garbage.
> BitWarden: played around with this for a while, but didn't switch from 1Pass mostly because I am not willing to host something like this myself and it costs the same as 1Pass with less features and polish.
The SaaS Bitwarden offering is less expensive than 1Password at all tiers, plus there's a (functional) free tier.
I will say, 1Password does seem to be the most secure of the SaaS options. But this is just my vague impression -- I haven't looked into it closely, nor am I qualified to.
Re: Ask HN: LastPass Alternatives
#54I use and generally recommend 1password. I've used it on every major mobile and desktop OS browser. (I've had some issues on Android, but it was not a standard Android OS.) The UX is generally nice.
First, they encrypt with the secret key AND the master password. This is the most important thing, and I was shocked to learn Lastpass doesn't do it.
Second, the master password runs through PBKDF2 with 100000 rounds, but a precursory Google search suggests the very earliest versions used around 10000. Lastpass's problem was a low 5000 rounds, and did not update the number of rounds. I don't know if 1password updates the number of rounds.
Third, they use a zero-knowledge proof protocol called "secure remote password". When I was sharp in cryptography, this is what made me choose 1password over the others. I don't understand all the details anymore, and I don't know if it is "post-quantum secure."
Fourth, the UX is nice and I can recommend it to anybody who is literate. (This is not a cynical take-- I don't know how good the UX is for someone who is not fluent in a language 1password uses.) (Also, 1password recently released "1password 8", a new UI. I have not tried it and cannot speak to it.)
Fifth, 1password's biggest (only?) controversy was moving to a subscription model. I actually prefer this. (I want devs to be paid in perpetuity to keep this secure! I assume 1password has security holes somewhere, and I want 1password to pay their folks to find them first.)
Unfortunately, the monthly price "billed annually" is $3/month, but it seems the true monthly price is hidden behind a signup wall. I feel comfortable assuming the price is less than $10 per month.
Sixth, and most importantly: If your payment lapses, you can still access all your passwords, but you no longer get sync. (But I have not tried this in practice.)
---
1password security whitepaper: https://1passwordstatic.com/files/security/1password-white-p...
1password security overview: https://support.1password.com/1password-security/
Secure Remote Password (SRP) overview: https://blog.1password.com/developers-how-we-use-srp-and-you...
Re: Ask HN: LastPass Alternatives
#55I've been very happy with the built-in Chrome/Google password manager.
Re: Ask HN: LastPass Alternatives
#56Throughout the years I've tried most of the more popular ones on the market, some times forced via work and other times because I was curious. - KeePassXC: tried this when I was looking for a self-hosted, open-source alternative to LastPass years ago. Was surprised at how well it worked, but syncing was too much of a hassle so I gave up fairly quickly. - 1Password: my favorite of the bunch so far, great UI and UX, wo…
I sync KeyPassXC with Google drive across all my devices no problem.
Re: Ask HN: LastPass Alternatives
#57Throughout the years I've tried most of the more popular ones on the market, some times forced via work and other times because I was curious. - KeePassXC: tried this when I was looking for a self-hosted, open-source alternative to LastPass years ago. Was surprised at how well it worked, but syncing was too much of a hassle so I gave up fairly quickly. - 1Password: my favorite of the bunch so far, great UI and UX, wo…
> syncing was too much of a hassle so I gave up fairly quickly. Why can't you use Dropbox or Google Drive to sync? Seems fairly easy.
You can, and it's trivial. I've never had a problem after a decade of constant use. My KeePassXC DB is synced between my phone, tablet, desktop, and laptop, and they all stay perfectly in sync. I've been scratching my head for this whole decade about why people want some SaaS for this.
Re: Ask HN: LastPass Alternatives
#58Throughout the years I've tried most of the more popular ones on the market, some times forced via work and other times because I was curious. - KeePassXC: tried this when I was looking for a self-hosted, open-source alternative to LastPass years ago. Was surprised at how well it worked, but syncing was too much of a hassle so I gave up fairly quickly. - 1Password: my favorite of the bunch so far, great UI and UX, wo…
I sync KeyPassXC with Google drive across all my devices no problem.
Same (well, different file sync but same idea). Love this approach. 4 devices and counting. Zero problems.
Re: Ask HN: LastPass Alternatives
#59Earlier quoted context omitted.
I use Keepass(XC) across all my devices, windows, Linux and android. I sync the DB with Nextcloud and encrypt with a combination of password and keyfile. The keyfile is a few KB of /dev/random and I only transfer it "offline" between devices (mostly over USB to/from my phone).
I could suggest a small improvement: a diceware password instead of directly taking the output of /dev/urandom. That would allow you to easily and securely exchange the symmetric key by typing it. Also, /dev/urandom instead of /dev/random (as seed to diceware).
Oooh smart. Yeah moving my keyfile when I get a new phone or device every few years via a USB cable hasn't been much of a hassle, but your plan is even better.
Re: Ask HN: LastPass Alternatives
#60I use a locally saved version of supergenpass https://chriszarate.github.io/supergenpass/mobile/ It combines an easily recalled password with domain to generate a longer password. I feel quite safe using this as no data is stored anywhere.
Doesn’t this mean that you can never change your password for a given site? E.g. if some retailer leaks a bunch of data and is storing passwords in plain text or something, I want to be able to rotate my password for that website.