Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

241–250 of 347 posts

Re: On Password Managers

#241

Post by Murrawhip »

gerdesj wrote: post #233
kronos29296 wrote: post #55

Earlier quoted context omitted.

Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained). I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.

I use KeePass on Linux via Mono (Arch and Gentoo). The UI is no worse than on Windows if you sort out your fonts. We have about 20 concurrent users of the same several DBs (one at least of which has many hundreds of entries) on a network share. It is absolutely rock solid. I'm not sure that KeepassXC can be considered unmaintained - their last release was in June, this year - https://keepassxc.org/blog/ . Also note t…

I think he's saying that KeepassXC is a fork of KeepassX, which is unmaintained.

Re: On Password Managers

#242

Post by FabioFleitas »

Are there any good password managers that don't have enforce going to the cloud, but work nicely with larger teams? A few people in the comments are recommending using keepass with a shared Dropbox file, but that doesn't work as well when you want different people having access to different passwords on teams.

Anyone know of a good alternative to 1Password or LastPass for teams?

Re: On Password Managers

#243

Post by e12e »

tptacek wrote: post #41
AlexandrB wrote: post #38

Earlier quoted context omitted.

> They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults. 1Password 4 for Windows uses local vaults just fine - I'm using it right now. The new 1Password 6 for Windows does not support local vaults.

Right! Sorry. I don't use Windows. Honestly? My recommendation about password managers probably shouldn't extend to Windows; there might be no password manager I confidently recommend on that platform. That's not a statement about 1Password; it's about the fact that the security models are different on the two platforms, and I'm very familiar with how 1Password works on macOS and less so on Windows.

It would appear making a password store on Windows would be rather simple, wrapping DPAPI:

https://msdn.microsoft.com/en-us/library/ms995355.aspx

At that point you should probably be about as (in)secure as access to the platform is. I don't know how you could improve much on that (assuming secureboot and bitlocker encrypted disk).

Is there some magic going on the MacOS side that somehow improves on this?

Re: On Password Managers

#244

Post by bokglobule »

Frankly I think people are insane to use any of these password manager products, whether SaaS or local. You're trusting a 3rd party to exercise control over your most sensitive digital information. Since the majority of people on HN are developer-types, you'd think "we" would write a little code, if necessary, for ourselves to make it easier to remember passwords. Basically a little DIY.

IMO, this will end badly.

Re: On Password Managers

#245

Post by ktta »

moskie wrote: post #52

The one place that 1Password doesn't meet my needs is in ChromeOS. The browser plugin requires the machine you're on to have the 1Password app running in the background, which is how it gets its data from the local (and synced) vault. But there is no 1Password ChromeOS app (and I don't think it's really even possible for there to be something like that in ChromeOS), so the browser plugin does not work in Chrome on Ch…

> no 1Password ChromeOS app (and I don't think it's really even possible for there to be something like that in ChromeOS)

It is possible, but it is being deprecated[0]. Signal uses it currently, so it is viable to run a 'heavier' app.

[0]: https://blog.chromium.org/2016/08/from-chrome-apps-to-web.ht...

Re: On Password Managers

#246

Post by [deleted] »

hayleox wrote: post #167

> And anyhow I'm obviously a lame-ass hypocrite because I use the 1Pass­word Chrome plu­g­in to fill in forms for me, and this means I type the master password into a browser. Actually, you don't. When you click the 1Password button in your browser, it sends a request to the 1Password app on your computer via localhost, which then opens a pop-up for you to enter your password. You're entering it in the 1Password app,…

[deleted]

Re: On Password Managers

#247

Post by conorcleary »

bokglobule wrote: post #244

Frankly I think people are insane to use any of these password manager products, whether SaaS or local. You're trusting a 3rd party to exercise control over your most sensitive digital information. Since the majority of people on HN are developer-types, you'd think "we" would write a little code, if necessary, for ourselves to make it easier to remember passwords. Basically a little DIY. IMO, this will end badly.

By responding to this comment, I increase my chances of being victimized by some percent. By disagreeing with you within my reply, I increase it further. By listing and drawing attention to my comment 'almost deliberately', it probably raises the 'rate' of increase. Using a paragraph much longer than this point will draw further scrutiny.

A password manager is goodgreat [the] mostmajority of the time. By drawing attention to yourself in a manner as small as this or as largely as describing my exact setup and process, I should start to worry for myself and my digital security. By stating that locks are meant for honest people I should be able to draw in some agreement by readers of this comment. Any and all of these points will raise me out of the 'crowd' of password manager users and paint me some shade of a target to malicious activity.

However, I believe that notwithstanding the above information, the average user is 99100% safe using a password manager in best practice settings.

Re: On Password Managers

#248

Post by conorcleary »

joekrill wrote: post #88
pixelmonkey wrote: post #72

I use Enpass on Linux, Windows, OS X, Android, and iOS. I also use the Chrome extension. It has a similar user experience to 1Password, but is actually serverless (you sync your encrypted blob to a cloud service of your choice, or not at all). I wish Enpass were open source, but I can understand their decision not to make it so -- its desktop application is free and its mobile apps include a small perpetual license f…

I'm using Enpass, too. Your sentiments mirror mine exactly. In general I'm surprised they are not getting more press. Perhaps if they were more explicit and open about their underlying data format (the SQLite+SQLCipher database)?

I hope it stays reliable and low key.

Re: On Password Managers

#249

Post by conorcleary »

mnm1 wrote: post #114
pixelmonkey wrote: post #72

I use Enpass on Linux, Windows, OS X, Android, and iOS. I also use the Chrome extension. It has a similar user experience to 1Password, but is actually serverless (you sync your encrypted blob to a cloud service of your choice, or not at all). I wish Enpass were open source, but I can understand their decision not to make it so -- its desktop application is free and its mobile apps include a small perpetual license f…

Yes, me too. It took some missteps with shitty Lastpass before I finally found it. I sync directly from my computer to my phone and from my computer to my NAS. I've thought about syncing to Google Drive or some other service like that and it is an option, but so far hasn't been necessary. I don't see why my password data should ever have to leave my machines if I don't want it to. And it doesn't.

Your phone... I'm sure your data is hopping over many machines.

Re: On Password Managers

#250

Post by conorcleary »

zokier wrote: post #153
JoshTriplett wrote: post #57

Earlier quoted context omitted.

> Instead I use a tiny notebook that I keep in my wallet. So, if your wallet gets stolen or lost, you'll have to go through every site you use and change all your passwords, quickly, and hope that whoever has that notebook hasn't taken over your accounts in the interim? Also problematic if you travel, and don't particularly want to make that list of passwords available.

I used pen and paper password management for a while (I use keepass these days), so I'll defend it a bit. 1) I used practically exclusively my desktop at the time, so the password slip stayed home 2) My home was relatively safe place; I didn't really have guests or other people mingling around and bulglary was basically unheard of in the area. My threat model did not include defending against law enforcement. 3) Pape…

I don't think you can defend against the redundancy that digital password managers, whatever format, provide. However, if you Xerox your paper... Yeah... But, you must get my point.
Post reply on HN