Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

161–170 of 347 posts

Re: On Password Managers

#161

Post by jolux »

Johnny555 wrote: post #139
eridius wrote: post #81

Earlier quoted context omitted.

> Looking into my configuration, it would appear that AgileBits has silently moved my data from iCloud to the AgileBits cloud How could that possibly happen? Local vaults can't just silently turn into cloud vaults, and you need a subscription license to use cloud vaults anyway.

How could that possibly happen? Local vaults can't just silently turn into cloud vaults, Why not, all they'd have to do is copy the local vault to their cloud service and you'd never notice until you discover that the local file you're syncing somewhere else no longer contains your new passwords. I'm not saying they've done this, but they could.

You have to explicitly sign up for their subscription service, so no, it can't currently be done silently.

Re: On Password Managers

#162

Post by heartbreak »

Spooky23 wrote: post #127
eridius wrote: post #76

Earlier quoted context omitted.

I think they're doing it for 2 reasons: 1. Money, and 2. Significantly reducing complexity and maintenance burden. Supporting cloud-only vaults is a lot simpler than also supporting local vaults plus multiple different third-party sync mechanisms.

Generally speaking, when a vendor want more money to do less, it's time to get a new vendor.

In what way are they doing less?

Re: On Password Managers

#163

Post by canes123456 »

chipotle_coyote wrote: post #137

I'm a 1Password user, and have synced my vault between devices through both Dropbox and iCloud at various points. I can't help but feel like either there's something I'm missing or something everyone else is missing, which statistically means that it's most likely me. But: When I sync with iCloud, Apple can't read my vault--even though it's on their servers, it's strongly encrypted with my passphrase, and the encrypt…

I think there are two concerns:

1. Accessing 1password.com's from a browser is less secure than using an app. You can choose never to log in but it makes it harder to recommend 1Password to journalists, political dissenters, etc. The most paranoid people need a local vault option.

2. The 1password.com can change to work differently from Dropbox at any time. 1Password for teams already allows recovery without your master password. They can add this to the normal subscription at any time.

Re: On Password Managers

#164

Post by heartbreak »

jaclaz wrote: post #78
tedmiston wrote: post #56

Earlier quoted context omitted.

The new model is better for you if you want the company to make enough money to be able to support the product and put out new releases to fix bugs and vulnerabilities.

Maybe, then they should say so, indirectly better for me. But bugs and vulnerabilities? On a years old, widely tested and used "static" (or almost "static" ) product? How many possible ones they are introducing by completely changing the tool to be on the "cloud"?

1Password had vulnerabilities disclosed by Tavis Ormandy within the last year regarding the communication between the application and the browser extension. Those vulnerabilities were part of the so-called "static" product, and were not related to the new cloud functionality.

[0] https://bugs.chromium.org/p/project-zero/issues/detail?id=88...

Re: On Password Managers

#165

Post by corybrown »

zokier wrote: post #125
[deleted] wrote: post #117

Earlier quoted context omitted.

[deleted]

Just curious, is there a reason why you decided to design your own storage format instead of reusing kdbx4?

I really wish folks would just use kdbx4 as a standard. Or any other format, I just want portability.

Re: On Password Managers

#166

Post by grimborg »

Why is the 1password login the same as the encryption password for all my other passwords? There is absolutely no reason why I should ever send them my encryption password. If they would make these two passwords separate and handle all encryption/decryption locally, I think that would solve the issue for me.

Re: On Password Managers

#167

Post by hayleox »

> And anyhow I'm obviously a lame-ass hypocrite because I use the 1Pass­word Chrome plu­g­in to fill in forms for me, and this means I type the master password into a browser.

Actually, you don't. When you click the 1Password button in your browser, it sends a request to the 1Password app on your computer via localhost, which then opens a pop-up for you to enter your password. You're entering it in the 1Password app, not in Chrome.

Re: On Password Managers

#168

Post by tedmiston »

robin_reala wrote: post #158
tedmiston wrote: post #71

Earlier quoted context omitted.

Did you see the links included in my parent post? The founder specifically said that standalone vaults will continue to be supported. You don't have to sync your standalone vault to any service if you don't want to. Though of course it'd be difficult to use both the desktop and mobile apps if you don't sync somehow.

Will continue to be supported for 6 and 7. Nothing beyond that.

To be fair 7 is not even out yet. I don't know many companies that talk about product releases more than one version in the future before release.

Re: On Password Managers

#169

Post by zokier »

conradk wrote: post #148
zokier wrote: post #125

Earlier quoted context omitted.

Just curious, is there a reason why you decided to design your own storage format instead of reusing kdbx4?

Thanks for the question. Frankly, at the time, I was under the impression that Keypass what a quite powerful and thus complex beast. I wanted something simple with just the data I needed saved (ie app name, username and password, nothing more) so I went ahead and created the new format. It was actually interesting to work on a new file format. The version 1 was not formally versioned. I realised that for the version…

I can definitely understand the simplicity argument; it is much lower barrier to just throw something together than to start reading some spec that has lot more stuff than what you need.

Designing things yourself is enjoyable and educational, so that is also a good reason.

The flipside here is that keepass format has passed quite a lot of scruitny over time, so the design should be pretty decent at this point (especially from security perspective). All that complexity that might feel overwhelming at the beginning also gives you room to grow over time.

As long as your code is well architected and your featureset somewhat conservative, switching out the storage layer shouldn't be too difficult if you ever change your mind. So from that perspective it makes sense to keep going with your own format as long as you feel like it, and focus on more important things.

Re: On Password Managers

#170

Post by lowbloodsugar »

grimborg wrote: post #166

Why is the 1password login the same as the encryption password for all my other passwords? There is absolutely no reason why I should ever send them my encryption password. If they would make these two passwords separate and handle all encryption/decryption locally, I think that would solve the issue for me.

Indeed. This is so obvious that the fact that its not the case raises concern.
Post reply on HN