Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

111–120 of 347 posts

Re: On Password Managers

#111

Post by ptomato »

moskie wrote: post #52

The one place that 1Password doesn't meet my needs is in ChromeOS. The browser plugin requires the machine you're on to have the 1Password app running in the background, which is how it gets its data from the local (and synced) vault. But there is no 1Password ChromeOS app (and I don't think it's really even possible for there to be something like that in ChromeOS), so the browser plugin does not work in Chrome on Ch…

They have a standalone Chrome extension currently in beta, https://discussions.agilebits.com/discussion/79940/a-present... for details. Only works with their synced service however, not local vaults.

Re: On Password Managers

#112

Post by [deleted] »

moskie wrote: post #52

The one place that 1Password doesn't meet my needs is in ChromeOS. The browser plugin requires the machine you're on to have the 1Password app running in the background, which is how it gets its data from the local (and synced) vault. But there is no 1Password ChromeOS app (and I don't think it's really even possible for there to be something like that in ChromeOS), so the browser plugin does not work in Chrome on Ch…

[deleted]

Re: On Password Managers

#113

Post by corybrown »

nameequalsmain wrote: post #110
corybrown wrote: post #101

I've moved from LastPass to KeePass, but the biggest thing I miss from LastPass (other than the better browser integration) is a good CLI client. Lastpass-cli is great, and kpcli just isn't. Anyone have a recommendation for a good CLI client that isn't `pass`? (I don't want to deal with GPG)

Ironclad[1]. Haven't tried it, but it looks nice. [1] https://github.com/dmulholland/ironclad

Oooh, that's pretty interesting. Shame there is no mobile client.

Re: On Password Managers

#114

Post by mnm1 »

pixelmonkey wrote: post #72

I use Enpass on Linux, Windows, OS X, Android, and iOS. I also use the Chrome extension. It has a similar user experience to 1Password, but is actually serverless (you sync your encrypted blob to a cloud service of your choice, or not at all). I wish Enpass were open source, but I can understand their decision not to make it so -- its desktop application is free and its mobile apps include a small perpetual license f…

Yes, me too. It took some missteps with shitty Lastpass before I finally found it. I sync directly from my computer to my phone and from my computer to my NAS. I've thought about syncing to Google Drive or some other service like that and it is an option, but so far hasn't been necessary. I don't see why my password data should ever have to leave my machines if I don't want it to. And it doesn't.

Re: On Password Managers

#115

Post by dbg31415 »

BugsJustFindMe wrote: post #85
jrowley wrote: post #18

Earlier quoted context omitted.

Lastpass doesn't necessarily have the best track record, and you said you couldn't go into detail, but I'm curious so will ask - if you feel comfortable sharing, what securities issues do you see with lastpass besides storing secrets in some companies cloud?

By default the browser plugin is configured in such a way that 2FA is completely bypassed for a second when logging in. This is officially documented, so we can likely assume that it will never be fixed. https://lastpass.com/support.php?cmd=showfaq&id=2775

This "second" became very noticeable to me once I moved to Sydney. I was actually able to log in to my Gmail before my 2FA kicked in. Right then I decided that, despite being a loyal LastPass user for the last 10+ years, it was time to try something else.

I would prefer a tool that works for teams if anyone has suggestions. I care about how my team manages and shares their passwords. Looking for something that works across devices, and where I can share access but not necessarily share the actual passwords if I can avoid it. I really like LastPass, it's a shame about some of their issues.

Re: On Password Managers

#116

Post by WillPostForFood »

eridius wrote: post #75
KSS42 wrote: post #27

Earlier quoted context omitted.

Yes. (iCloud sync is limited to Mac/iOS devices) https://support.1password.com/sync-options/

No. The alternative sync options are for "If you don’t want the benefits of a 1Password membership", and a "team" or "family" account is by definition a 1Password membership.

Is 1Password membership not inclusive of advanced sync options?

edit: I thought it was, but not sure.

Re: On Password Managers

#118

Post by zokier »

danirod wrote: post #30

I've been using password managers (KeePass, in my case) for about a year and all I can think is, why I didn't start using them earlier. It is cheaper to generate a long, random password using alphanumerical and special characters than trying to think a clever yet memorable unique password by myself, and probably more secure. Plus, it's true that you end up storing other sensible things that are not passwords, such as…

> Plus, it's true that you end up storing other sensible things that are not passwords, such as API or recovery keys, because it's acts like a vault.

I think this is one aspect that gets often overlooked. Keepass especially is pretty flexible for storing all sorts of small things that you feel like needing extra security and want to carry with you. Any entry in Keepass can have arbitrary key-value pairs in addition to the common fields, and if that is not enough you can also embed/attach files into the entry. For Windows especially Keepass also can store ssh-keys and function as half-decent ssh-agent.

Re: On Password Managers

#119

Post by bmurphy1976 »

kronos29296 wrote: post #55
sprice wrote: post #33

Earlier quoted context omitted.

> I recommend 1Password, and there's currently no other commercial password manager that I recommend. Are there any open source password manager products that you would recommend?

Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained). I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.

If you can stomach an electron app Keeweb is a nice keepass compatible alternative.

Re: On Password Managers

#120

Post by seanp2k2 »

BugsJustFindMe wrote: post #85
jrowley wrote: post #18

Earlier quoted context omitted.

Lastpass doesn't necessarily have the best track record, and you said you couldn't go into detail, but I'm curious so will ask - if you feel comfortable sharing, what securities issues do you see with lastpass besides storing secrets in some companies cloud?

By default the browser plugin is configured in such a way that 2FA is completely bypassed for a second when logging in. This is officially documented, so we can likely assume that it will never be fixed. https://lastpass.com/support.php?cmd=showfaq&id=2775

Writing good security software is difficult, but that doesn't stop places who really shouldn't be doing it from trying and succeeding in a business sense. https://thycotic.com/products/secret-server/ passes JSON in URLs, and we're not even talking base64 here. Also, it's called "thycotic" like you're holding your tongue and saying "psychotic". There are more problems that I won't go into.
Post reply on HN