Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

251–260 of 347 posts

Re: On Password Managers

#251

Post by remy_ »

sprice wrote: post #33
tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

> I recommend 1Password, and there's currently no other commercial password manager that I recommend. Are there any open source password manager products that you would recommend?

Passbolt, give it a try! https://www.passbolt.com/

Re: On Password Managers

#252

Post by ktta »

corybrown wrote: post #101

I've moved from LastPass to KeePass, but the biggest thing I miss from LastPass (other than the better browser integration) is a good CLI client. Lastpass-cli is great, and kpcli just isn't. Anyone have a recommendation for a good CLI client that isn't `pass`? (I don't want to deal with GPG)

KeepassXC has a command line option with the latest release.

Re: On Password Managers

#253

Post by BugsJustFindMe »

ihattendorf wrote: post #154
BugsJustFindMe wrote: post #85

Earlier quoted context omitted.

By default the browser plugin is configured in such a way that 2FA is completely bypassed for a second when logging in. This is officially documented, so we can likely assume that it will never be fixed. https://lastpass.com/support.php?cmd=showfaq&id=2775

This isn't a bug, this is due to the offline access option. If your machine has the database locally cached, 2FA won't do anything because your database won't be encrypted with 2FA (not possible), just your master password. An attacker could just copy the cached database and decrypt it with your master password. All 2FA does is restrict who can download your database (both initial and updates), not decrypt it. If you…

> This isn't a bug

Boo hoo. Did I say it's a bug? I said it's a security issue. It's also an exceptionally stupid thing to have as standard behavior without warning. It demonstrates poor priorities and ideas about safety on the part of LastPass.

Re: On Password Managers

#254

Post by raquo »

pixelmonkey wrote: post #72

I use Enpass on Linux, Windows, OS X, Android, and iOS. I also use the Chrome extension. It has a similar user experience to 1Password, but is actually serverless (you sync your encrypted blob to a cloud service of your choice, or not at all). I wish Enpass were open source, but I can understand their decision not to make it so -- its desktop application is free and its mobile apps include a small perpetual license f…

I found Enpass rather unfeatureful. It doesn't even have an option to use multiple vaults.

Re: On Password Managers

#255

Post by microtonal »

malchow wrote: post #210
eridius wrote: post #207

Earlier quoted context omitted.

You can do that, but those local vaults aren't part of the team/family.

"You can do that, but those local vaults aren't part of the team/family." Yes, this is correct. So if you want to share items or share a vault with a family member, you are obligated to store and sync with 1Password servers.

I am pretty sure that you are wrong. If you add a vault to e.g. Dropbox, you can share it. My wife and I had been doing this for years, even when we switched to a subscription. This was also AgileBits's supported/advised way of sharing vaults before 1password.com.

They now just recommend using their 1password.com service for sharing.

Re: On Password Managers

#256

Post by aryehof »

zeta0134 wrote: post #205

"2. In­stall a cam­era any­where I work and fo­cus it on my hand­s" I feel like we need to be talking about this more. For all the hullabaloo concerning password strength and encryption key length, MANY of our secret key entry methods would be quite easily defeated by a common webcam and a pair of human eyeballs. That's kind of scary! It's not about to make me stop using passwords, but it is going to make me stop and…

I always thought that conclusion was the reason the "encryption wars" ended in the USA, and the subsequent removal of encryption from being an export controlled "munition".

Forget breaking strong encryption, far easier to use a camera, key logger, or other means of "spy craft".

Re: On Password Managers

#257

Post by ViktorEvil »

atmosx wrote: post #180
bqe wrote: post #100

Earlier quoted context omitted.

I use pass, written by zx2c4 of WireGuard fame: https://www.passwordstore.org/ My favorite thing about it is that it uses standard tools I understand, and I can back it up and version it with git.

It doesn't have a browser plugin and will not work with my iPhone... So it's a no-go for me and I guess many others.

Pass - Password Store by Mingshen Sun https://appsto.re/gb/DY13hb.i

Re: On Password Managers

#258

Post by devcpp »

kronos29296 wrote: post #143
bmurphy1976 wrote: post #119

Earlier quoted context omitted.

If you can stomach an electron app Keeweb is a nice keepass compatible alternative.

I can't. Atom has given me electron trauma (older versions about a couple of years back).

Then forget about it. Keepass2 and KeepassXC (depending on your OS) are the best of the best.

Re: On Password Managers

#259

Post by conradk »

corybrown wrote: post #165
zokier wrote: post #125

Earlier quoted context omitted.

Just curious, is there a reason why you decided to design your own storage format instead of reusing kdbx4?

I really wish folks would just use kdbx4 as a standard. Or any other format, I just want portability.

I think there are better ways to have portability. Pass [1] handles this nicely with import-scripts. Unfortunately, it seems like it can import into pass, not into any other password managers.

[1] https://www.passwordstore.org/

Post reply on HN