Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

Post reply on HN
Print view View original

91–100 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#91

Post by 333c »

bagacrap wrote: post #82
sdan wrote: post #4

Never. I moved from Lastpass to pass( https://www.passwordstore.org/ ). It's by far the best decision I've made in a long time (I've moved a lot of services over to my servers and self host pretty much everything) I use Mac, but it works on any machine to my knowledge and the great thing is: 1. Use your keys, so ONLY YOU can only decrypt it (gpg keys) 2. Has Chrome/Firefox extensions that automatically fill out passw…

What support does it have for mobile?

There are iOS and android apps. I can't speak for the android apps, but I use an open-source client on iOS.

https://itunes.apple.com/us/app/pass-password-store/id120582...

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#93

Post by kennu »

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to eliminate as much hassle as possible.

I realize all this requires a great deal of trust in the maker of 1Password having done things right and currently I have that trust. This may change in the future of course.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#94

Post by eropple »

Boulth wrote: post #21
spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

Not to mention pass, due to its connection to GnuPG, can protect secrets using Yubikey that require 6 digit PIN (will lock after 3 tries) and touching the blinking dot.

Interesting. I've never used pass, but this thread is making it sound interesting. Does it support fallbacks (multiple keys, other forms of credentials) simultaneously?

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#95

Post by kilroy123 »

lukasm wrote: post #43

I use a hybrid approach with Lastpass used as a password entropy storage. For important services like Github I only store half of the password in LastPass. Then I add a nonce and a generic short password. The final password is 12-16 random characters for LastPass + 3 chars Nonce that I generate from the service name (in my head) and a short 5 character password. If LastPass leaks the secrets no one is able to take ov…

This is a great idea, but doesn't it involve a lot of manual work? Or is there some kind of automated way to do this?

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#96

Post by zrobotics »

mongol wrote: post #10

Not very. I use pass together with a self-hosted git repo. Passwords are too important to evaluate a manager on convenience primarily. I think it is a little strange that banks do not work to get in this area. You trust your bank or else you would not keep your money there. I know too little about the main password manager companies to know if they are trustworthy. I guess this is too small domain for banks but I thi…

Considering that my bank (Wells Fargo) has the crappiest password policy of any site I use, I wouldn't trust them to handle my passwords. Passwords will be accepted case-insensitive, so they're losing entropy and likely have the password stored plaintext somewhere.

That being said, I do have a safe deposit box with backups of important documents and a KeePass DB. The KeePass DB isn't synced as often as my local copies, but does get synced whenever I change passwords on any crucial site. I do have a copy on onedrive, but if I lose access to my password manager I won't be able to login to onedrive to access it. It's a little bit of work, but there are certain things that are definitely worth backing up in a secure location. Plus, there's a printed copy of my KeePass credentials and access information for relatives in case I'm gone.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#97

Post by selfup »

kennu wrote: post #93

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…

I read up on their blogs and as much technical explanation as I could find, and by far 1Password seems to be the best with a cloud offering.

Also Apple buying into using 1Password company wide helps gain some trust (I am sure there was some serious auditing): https://medium.com/enrique-dans/apple-and-1passwords-deal-sh...

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#98

Post by mplanchard »

kennu wrote: post #93

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…

I also use 1Pasword. A while back there was a bit of a hullabaloo regarding the ability to extract passwords stored in 1P (and other password managers) from a memory dump[1].

I sent an email to the support team at the time asking some technical questions that the security report raised for me, and wondering how the team was planning to evolve the product going forward. They sent back a very in depth, detailed answer that included info about some of the experiments they were doing to decrease the amount of time passwords were decrypted in memory, along with looking into Rust for better direct memory management than they could get with C# or Swift. All in all, the care and quality of the response gave me a great impression of the team and of their approach to user interactions.

[1]: https://www.securityevaluators.com/casestudies/password-mana...

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#100

Post by faitswulff »

Fnoord wrote: post #68
octosphere wrote: post #63

Earlier quoted context omitted.

> You can run the server within your own cloud For me there is a tradeoff. On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. If their server goes offline, you can't access your passwords (And servers do go down). On the other hand you can repair your own instance if it goes down and have full control over it. The only caveat with self-hosti…

Agreed w/your post in general. > On one hand, Bitwarden's online offering where you trust them with your data is convenient, but also a single point of failure. Put your network connectivity off, and try to relogin to Bitwarden. It will work. I just tried it. The only downside is that the database might not be synced (which, I admit, can be a problem). > The only caveat with self-hosting being the overhead. Regular n…

What operational security risks do you have to be aware of when self hosting passwords?
Post reply on HN