231–240 of 347 posts
The browser can verify who am I, likely in a more rigorous way than a password.
The browser can already handle interaction with the server on behalf of the user.
Sure, the user flow would need to be sorted out (e.g., to confirm the user's intent), but it seems much better than the current system we've been using since the days of .htaccess.
Earlier quoted context omitted.
"You can do that, but those local vaults aren't part of the team/family." Yes, this is correct. So if you want to share items or share a vault with a family member, you are obligated to store and sync with 1Password servers.
Well, you can use third-party syncing with local vaults to sync with family members, e.g. using Dropbox sync with a Dropbox shared folder to share your vault with a family member. This just doesn't fall under the heading of "team" or "family" syncing.
Earlier quoted context omitted.
> I recommend 1Password, and there's currently no other commercial password manager that I recommend. Are there any open source password manager products that you would recommend?
Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained). I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.
It is absolutely rock solid.
I'm not sure that KeepassXC can be considered unmaintained - their last release was in June, this year - https://keepassxc.org/blog/ . Also note the monthly tone of the updates - even the koolist of kool dev kids kant complain that is slow 8)
Why is the 1password login the same as the encryption password for all my other passwords? There is absolutely no reason why I should ever send them my encryption password. If they would make these two passwords separate and handle all encryption/decryption locally, I think that would solve the issue for me.
Indeed. This is so obvious that the fact that its not the case raises concern.
If you have gone through the process of being charitable-first, instead of dismissive-first, then you would notice that they have explicitly spent engineering hours on this exact problem by using an SRP-based session key exchange for mutual authentication (and additional session encryption, in addition to TLS). [1] [2]
It's not easy to engineer for both security and usability, so I especially appreciate it when someone spends the time to accomplish both.
[1] https://blog.agilebits.com/2015/11/11/how-1password-for-team... [2] https://1password.com/files/1Password%20for%20Teams%20White%...
I use Enpass on Linux, Windows, OS X, Android, and iOS. I also use the Chrome extension. It has a similar user experience to 1Password, but is actually serverless (you sync your encrypted blob to a cloud service of your choice, or not at all). I wish Enpass were open source, but I can understand their decision not to make it so -- its desktop application is free and its mobile apps include a small perpetual license f…
I've used it but there are two major issues they still haven't fixed. On windows there's some bug with a qt library they're using that, of all things, messes up network connectivity. It does polling of the network interfaces every 30 seconds (I believe) which causes traffic to completely stop for a couple of seconds. On Android at least, it is EXTREMELY slow. Search works about 10% of the time, and the other 90% of t…
I work on a Qt powered project and we had the same bug
Earlier quoted context omitted.
In what way are they doing less?
They are deprecating local vaults. Given that vaults contain secrets, and data shared with third parties is not secret in any legally compelling way, that effectively neuters the product.
The data isn't shared with AgileBits. They only have the encrypted vaults, they don't have the keys to open them. So it's no more shared with a third party than using Dropbox to sync a local vault is shared with a third party.
The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…
Why couldn't they offer the native app with local vaults and subscription pricing? I don't mind a recurring fee, its just that I want a native (cloud-free) password manager.
Earlier quoted context omitted.
In what way are they doing less?
They are deprecating local vaults. Given that vaults contain secrets, and data shared with third parties is not secret in any legally compelling way, that effectively neuters the product.
I'm a 1Password user, and have synced my vault between devices through both Dropbox and iCloud at various points. I can't help but feel like either there's something I'm missing or something everyone else is missing, which statistically means that it's most likely me. But: When I sync with iCloud, Apple can't read my vault--even though it's on their servers, it's strongly encrypted with my passphrase, and the encrypt…
It's more that in-browser JS changes all the time and is basically never audited, nor can it be pinned and prevented from changing. It'd be downright trivial and unnoticeable to change it to capture your password rather than to behave as advertised. Compare that with the app. Sure it has an updater, but you can use it offline. Don't trust it in day-to-day affairs? Block network access. You can reliably not trust it,…
Earlier quoted context omitted.
In what way are they doing less?
They are deprecating local vaults. Given that vaults contain secrets, and data shared with third parties is not secret in any legally compelling way, that effectively neuters the product.