Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

1–10 of 347 posts

Re: On Password Managers

#2

Post by bsilvereagle »

Encryption Wizard [1] solves issues 1-4, but is severely lacking on #5 (device syncing). It also has no mobile support.

I've performed a cursory search to see if any OSS password manager comes close to EW on features, but didn't find anything:

* Supports CAC encryption/decryption

* Allows you to store contacts public certs

* Allows keys to decrypt

* Generates passphrases

* Allows multiple keychains to be opened at once

If anyone is looking for a (probably not profitable) OSS project/business, I would pay probably upwards of $100 for a perpetual/source available license for an Encryption Wizard clone with a mobile client & some built-in support for syncing.

[1] https://www.spi.dod.mil/ewizard.htm

Re: On Password Managers

#3

Post by deedubaya »

I thought 1Password confirmed that the cloud based storage is the default for new users -- existing and more security conscious users can still use whatever data store they choose?

Re: On Password Managers

#4

Post by tedmiston »

Just to be clear, it's still 100% possible to keep your 1Password vault in Dropbox etc and not use the SaaS version [1]. I felt like this fact was buried in the article.

Edit: Here's the link to buy the standalone license [2] which is hard to find on the site now.

In a post from the founder one week ago [3] he said, "We know that not everyone is ready to make the jump yet, and as such, we will continue to support customers who are managing their own standalone vaults. 1Password 6 and even 1Password 7 will continue to support standalone vaults."

[1]: https://support.1password.com/sync-with-dropbox/

[2]: https://agilebits.com/store

[3]: https://blog.agilebits.com/2017/07/13/why-we-love-1password-...

Re: On Password Managers

#5

Post by tptacek »

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so).

There are four issues that I'm currently aware of with 1Password:

1. They've converted from flat to subscription pricing.

2. They're pushing people to a 1Password-managed cloud sync system instead of the a la carte sync they were doing before.

3. They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults.

4. Now that they have 1Password.com, first-time enrollment in 1Password requires you to interact, once, with 1Password.com.

Of these, only (4) is a serious security concern. Their last release further eliminated the native app's dependency on 1Password.com. I'm confident they'll get all the way towards decoupling them, but I'm not them, so grain of salt.

I have no relationship with 1Password other than as a happy customer and as someone who does research in the field they work in. Having said that: I strongly recommend that you be very careful about what password manager you choose to use. The wrong password manager can be drastically less secure than no password manager. I recommend 1Password, and there's currently no other commercial password manager that I recommend. I'm sorry I can't go into more detail than that. :(

Re: On Password Managers

#7

Post by LordHeini »

At our company we use keepass2 with a db file synced by dropbox. Works nicely. Keepass can save all sorts of stuff alongside passwords (like credentials, api-tokens...) and there is an app too (for android at least). Might get a bit clunky if lots of people change a lot of stuff all the time but for us it is not a problem.

Re: On Password Managers

#8

Post by netrap »

bsilvereagle wrote: post #2

Encryption Wizard [1] solves issues 1-4, but is severely lacking on #5 (device syncing). It also has no mobile support. I've performed a cursory search to see if any OSS password manager comes close to EW on features, but didn't find anything: * Supports CAC encryption/decryption * Allows you to store contacts public certs * Allows keys to decrypt * Generates passphrases * Allows multiple keychains to be opened at on…

Lol. Their site has an invalid certificate, according to Chrome.
Post reply on HN