Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

21–30 of 347 posts

Re: On Password Managers

#21

Post by jackbravo »

netrap wrote: post #13
LordHeini wrote: post #7

At our company we use keepass2 with a db file synced by dropbox. Works nicely. Keepass can save all sorts of stuff alongside passwords (like credentials, api-tokens...) and there is an app too (for android at least). Might get a bit clunky if lots of people change a lot of stuff all the time but for us it is not a problem.

That's what I use as well. Only thing missing I guess is a mobile workflow, though there are some options.

We use https://www.pwsafe.org/. It has clients for android, iOS and windows. In Mac and Linux you can use password-gorilla with the same files. And sync with dropbox.

Re: On Password Managers

#22

Post by wepple »

tedmiston wrote: post #4

Just to be clear, it's still 100% possible to keep your 1Password vault in Dropbox etc and not use the SaaS version [1]. I felt like this fact was buried in the article. Edit: Here's the link to buy the standalone license [2] which is hard to find on the site now. In a post from the founder one week ago [3] he said, "We know that not everyone is ready to make the jump yet, and as such, we will continue to support cus…

Given the change to their business model I am concerned they can push an update, where the next time I unlock my vault it syncs my master password and/or decrypted vault to their cloud.

Maybe time for an open source password manager?

Re: On Password Managers

#23

Post by greggyb »

LordHeini wrote: post #7

At our company we use keepass2 with a db file synced by dropbox. Works nicely. Keepass can save all sorts of stuff alongside passwords (like credentials, api-tokens...) and there is an app too (for android at least). Might get a bit clunky if lots of people change a lot of stuff all the time but for us it is not a problem.

Can Keepass2 have different passwords for different users?

Or are you sharing one master password among multiple employees?

Re: On Password Managers

#24

Post by kebolio »

peterkshultz wrote: post #9

Any password manager recommendations such that people don't need to deal with 1Password's cloud-based storage?

https://www.passwordstore.org/

command-line, encrypts passwords with gpg, synchronises using git and by default only copies the password to the clipboard and automatically wipes the clipboard after a minute

Re: On Password Managers

#25

Post by danirod »

peterkshultz wrote: post #9

Any password manager recommendations such that people don't need to deal with 1Password's cloud-based storage?

I use KeePass to store my passwords plus other sensible data. It's multiplatform and I can have access to my passwords file on macOS using MacPass, on Linux and Windows using KeePassX, and on Android using KeePass2Android.

I use Dropbox to sync the file through multiple computers including my Android phone. I don't fully trust Dropbox for sensible stuff, but since the passwords file is encrypted by KeePass, I consider that if Dropbox ever gets compromised, they won't be able to access the contents of the file right away without a lot of work.

The passwords file uses a long password, one of the few passwords I still have to remember, plus I use a keyfile for encrypting the file. That file is not allowed to be uploaded to the cloud. I have a copy of the keyfile in my laptop, another one on my Android phone, and another one on a Veracrypt partition in my thumb drive.

It is not a perfect setup, because I still have a few issues that I haven't considered, such as how should I proceed if my phone or laptop bag ever get lost or stolen; but it's convenient for me at this moment.

Re: On Password Managers

#26

Post by irrational »

LordHeini wrote: post #7

At our company we use keepass2 with a db file synced by dropbox. Works nicely. Keepass can save all sorts of stuff alongside passwords (like credentials, api-tokens...) and there is an app too (for android at least). Might get a bit clunky if lots of people change a lot of stuff all the time but for us it is not a problem.

Does anyone at your company use iOS? If so, how are they doing it?

Re: On Password Managers

#27

Post by KSS42 »

malchow wrote: post #15
tedmiston wrote: post #4

Just to be clear, it's still 100% possible to keep your 1Password vault in Dropbox etc and not use the SaaS version [1]. I felt like this fact was buried in the article. Edit: Here's the link to buy the standalone license [2] which is hard to find on the site now. In a post from the founder one week ago [3] he said, "We know that not everyone is ready to make the jump yet, and as such, we will continue to support cus…

Is it possible to use the 1Password "family" or "team" accounts with Dropbox or iCloud storage?

Yes. (iCloud sync is limited to Mac/iOS devices)

https://support.1password.com/sync-options/

Re: On Password Managers

#28

Post by trjordan »

If I understand correctly, the main problem here is that if a password manager at some point asks you for a password in an online environment, they're subject to coercion. This is especially dangerous if you're using auto-updating code like Javascript in a browser or code on a remote service, because it could get backdoored at any time and you wouldn't notice.

Isn't the real problem auto-updating code with access to a network? 1password.com is certainly another vector that fits this description, but if you don't trust AgileBits to manage 1password.com securely, why would you trust them to manage the app on your machine securely? Or the auto-updating Chrome plugin?

I'm not denying that there's more surface area by creating a login, but I think it's a false dichotomy to say that the app is "offline" and the website is "online". They both have network access, and if AgileBits or a random hacker can change the app's code, they'll do that. That change will be mindlessly delivered to your computer, and the bad guys will have all your passwords.

Re: On Password Managers

#29

Post by Jwarder »

netrap wrote: post #8
bsilvereagle wrote: post #2

Encryption Wizard [1] solves issues 1-4, but is severely lacking on #5 (device syncing). It also has no mobile support. I've performed a cursory search to see if any OSS password manager comes close to EW on features, but didn't find anything: * Supports CAC encryption/decryption * Allows you to store contacts public certs * Allows keys to decrypt * Generates passphrases * Allows multiple keychains to be opened at on…

Lol. Their site has an invalid certificate, according to Chrome.

That's because they use a government cert as the root. The US Government's PKI isn't always setup as trusted because they don't go through all of the audits that other Certificate Authorities do.

Re: On Password Managers

#30

Post by danirod »

I've been using password managers (KeePass, in my case) for about a year and all I can think is, why I didn't start using them earlier. It is cheaper to generate a long, random password using alphanumerical and special characters than trying to think a clever yet memorable unique password by myself, and probably more secure.

Plus, it's true that you end up storing other sensible things that are not passwords, such as API or recovery keys, because it's acts like a vault.

Post reply on HN