Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#61

Post by jarfil »

spondyl wrote: post #40
dancek wrote: post #25

Earlier quoted context omitted.

I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?

I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps bu…

For Windows there is Gpg4win, which includes a port of Kleopatra.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#63

Post by octosphere »

Fnoord wrote: post #32
spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

Bitwarden has also had an external audit. With regards to Bitwarden, it has a wordphrase on the account which only you know. You can verify this when you connect to the cloud. You can run the server within your own cloud. With the cloud, you can assume that the government has access to the encrypted database. If you have a strong password, it will take them longer to brute-force your database. We are talking about tw…

> You can run the server within your own cloud

For me there is a tradeoff. On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. If their server goes offline, you can't access your passwords (And servers do go down). On the other hand you can repair your own instance if it goes down and have full control over it. The only caveat with self-hosting being the overhead. Regular non-techie people just don't have the time or intellectual curiosity to experiment with self-hosting. For me personally I just sync a Keepass database with Dropbox and call it a day.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#64

Post by msravi »

I use pass and use a free Google instance to run git to which it's synced. I sync using git to all devices. The git database is also synced to Amazon drive periodically.

So the passwords in pass itself are protected by gpg. The Google instance is protected using ssh. Amazon drive is protected using 2-factor auth.

No single cloud provider can get at the passwords, but the password database is backed up at multiple locations.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#65

Post by katzeilla »

I will never use any cloud based PM.

The biggest issue for me is transparency and complexity, most of them are just as "blackbox" as any other service.

I am using KeePassX with git + gpg on my own server for extra encryption and sync, this solution is simple and future-proof.

and I might switch to my own script in future, dir + txt + git + gpg should be enough.

Need a random password? cat /dev/urandom | base64 | cut 1-64

Grouping? Just different directories.

Please also remember, there is no cloud, just other people's computer.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#67

Post by LocalMan »

I've been using Lastpass for years now. It's good but not perfect. Occasionally I have to fiddle with it. There are a few web sites that Lastpass can't deal with. I opt for big passwords so I'm sure it's more secure than trying to use my memory and/or some ad hoc scheme.

I haven't done an organized comparison of password managers.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#68

Post by Fnoord »

octosphere wrote: post #63
Fnoord wrote: post #32

Earlier quoted context omitted.

Bitwarden has also had an external audit. With regards to Bitwarden, it has a wordphrase on the account which only you know. You can verify this when you connect to the cloud. You can run the server within your own cloud. With the cloud, you can assume that the government has access to the encrypted database. If you have a strong password, it will take them longer to brute-force your database. We are talking about tw…

> You can run the server within your own cloud For me there is a tradeoff. On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. If their server goes offline, you can't access your passwords (And servers do go down). On the other hand you can repair your own instance if it goes down and have full control over it. The only caveat with self-hosti…

Agreed w/your post in general.

> On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure.

Put your network connectivity off, and try to relogin to Bitwarden. It will work. I just tried it. The only downside is that the database might not be synced (which, I admit, can be a problem).

> The only caveat with self-hosting being the overhead. Regular non-techie people just don't have the time or intellectual curiosity to experiment with self-hosting.

I don't know the password to connect to my (hypothetical) self-hosted Bitwarden instance. Because of the above though, that would not be an issue.

Hence I am going to switch to self-hosting. There's a Rust implementation with Docker image.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#69

Post by moeffju »

I don't use them because I couldn't trust them. I'm currently using KeePass synced with Dropbox. Works fine on Android, Mac and Windows. IPhone is a bit annoying, so I store some stuff in iCloud Keychain. I've tried pass and I want to try Bitwarden, but this setup works for me. KeePassXC even supports TOTP.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#70

Post by dancek »

spondyl wrote: post #40
dancek wrote: post #25

Earlier quoted context omitted.

I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?

I think GPG keys get a lot of flack for not being the most user friendly thing and probably fair enough. The nature of them having to remain secret, makes managing them a bit confusing. I don't use mine for anything more than signing commits and (rarely) encrypting secrets Personally, I use OpenKeychain[1] on Android, Kleopatra[2] on Linux, GPG Suite[3] on macOS and Pass[4] for iOS/iPadOS Phew, that's a lotta apps bu…

Thanks for taking the time to answer! It's great to hear the system has good usability on multiple platforms once set up.

I guess my problem has been trying to make things perfect at once, and learning about subkeys and revocation certificates and how they apply to pass (they don't, I think) is a lot of work.

Maybe I'll just try it out, keeping my email and money-related passwords out of the equation for now.

Post reply on HN