Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

291–300 of 347 posts

Re: On Password Managers

#291

Post by tallanvor »

chiefalchemist wrote: post #182
BugsJustFindMe wrote: post #85

Earlier quoted context omitted.

By default the browser plugin is configured in such a way that 2FA is completely bypassed for a second when logging in. This is officially documented, so we can likely assume that it will never be fixed. https://lastpass.com/support.php?cmd=showfaq&id=2775

Well. Not to defend LP, but for those who don't click through, offline mode can (and should be?) disabled. Perhaps this is a case where a feature that makes some sense in some cases was added, the problem is, outside that scope it's a really bad idea. But then someone said "We'll make it optional..." and the rest was history?

I wouldn't agree that it necessarily should be disabled. Sometimes I'm on my computer with no internet access... If offline access is disabled, I have no access to passwords for locally installed applications.

Re: On Password Managers

#292

Post by chakalakasp »

nextlevelwizard wrote: post #264
tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

I changed from LastPass to 1Password for big part because it was "pay once, use forever" instead of LastPass' subscription service. It hasn't even been 3 years since I switched and I paid what felt like a lot of money, but I figured that it would still be less over all in comparison. Now I can't get my vault to sync on my Windows machine and last time I reinstalled my Mac it was a hunt for the right executable. I've…

What was unreliable about Lastpass? Anecdotally, I've been using it for quite a while and have never had it fail. 2FA, easy sharing, dead mans switch to give access to a loved one if they request the access and enough time elapses, etc. Security wise, despite several network breaches (which should be expected to happen at some point with any networked computer system), the database has remained secure because they do encryption right, and when Tavis sussed out bugs in the client they patched them immediately. You moved from a highly reliable service with a subscription to another service with no subscription that turns out to kinda suck for your needs. No shame in switching back to what works.

You can switch again to a homerolled solution like you are suggesting, but you're not going to "no deal with this shit", you are now your own IT for this shit you homerolled.

Re: On Password Managers

#293

Post by cyphar »

AbacusAvenger wrote: post #144
6ak74rfy wrote: post #132

Earlier quoted context omitted.

Have you used KeepassXC. I am panning to move to it from lastpass, and want to make sure I am making the right choice.

I've used KeePassXC, and I think it's the best KeePass variant. I don't like stock KeePass because it's horribly slow under Mono (Linux/OS X). And I like but am not as satisfied with KeePassX because it lacks some features I like. From what I recall, the maintainers of KeePassXC got frustrated with the feature set and development pace of KeePassX, so they made their own fork. And they added nice things like TOTP code…

With KeePassXC you would do this by adding new entries for each alias and then reference the username and password values of the "base" entry. I believe the feature still isn't in a release, and the UX isn't there at the moment.

The problem is that they can't deviate from the official KeePass database format, so adding something like aliases requires hacks like the above.

Re: On Password Managers

#294

Post by eddieroger »

StavrosK wrote: post #284

This is only tangentially related, but I believe it's time to have a unified login standard for the web. Not in the OAuth sense, as that's hard to do, but just a small, machine-readable file that tells your password manager "to log this user in, just submit credentials to /whatever/url/". That way, your password manager would show a "login" button on the browser's toolbar when you visited any page in a site, you'd cl…

It's been tried in various flavors of that. The one I liked the best was OpenID. You designate who you trust to actually log you in, which could even be localhost if you set your redirects right, then provide a URL as your "login." There was a somewhat standardized set of data that could go back and forth, and if a specific site needed more, it could ask for it on it's own.

The problem, I think, is that every site wants to own the web, and doesn't want to give up anything, let alone login. Facebook and Twitter and Google all want to be the auth providers to the net, but then you have to trust them in a much more elevated way than you should, and their motives are more around building a profile of you and where you go on the net than being a secure auth provider. If Facebook started supporting U2F (they may, I don't know), Yubikey sales would explode tomorrow and the web may be a safer place, who knows.

Re: On Password Managers

#295

Post by santiagobasulto »

Completely irrelevant to this post. A long time ago I was in an Android "workshop" in one of these Google conferences and I saw a tall guy with a cowboy hat and slippers walking around and talking to people. I though to myself, "what a funny guy". We chatted for a little while and I didn't know if he was a "Google evangelist" (those that can talk tech but can barely code) or if he was just serving coffee (he was super humble and relaxed). Then I learned that was Tim Bray, one of the "creators" of XML. I never underestimated anyone anymore (I was young and stupid, sorry).

Re: On Password Managers

#296

Post by npongratz »

danr4 wrote: post #36

The only cloud based password manager I'm willing to use is Dashlane[1]. It's supposedly "zero knowledge", and although you can never be 100% there isn't some bug waiting around to be exploited, it's a compromise I'm willing to make (the lesser evil). They also have several complementing features like encrypted notes, auto saving receipts, credit cards, batch password changer with quite a few major sites. I'm not aff…

They might have great features, but are Dashlane using the term "zero knowledge" in the accurate, historical (25+ years), cryptographic sense, a la [0]? Or are they just using it in the hand-wavey slick markety sense, "We could never know your secrets; give us your money and your secrets and trust us forever."?

[0] Words mean things. They are dealing with encrypting passwords, after all, so I hope they're truthfully representing the technology behind their system:

https://en.wikipedia.org/wiki/Zero-knowledge_proof

Maybe even:

https://en.wikipedia.org/wiki/Zero-knowledge_password_proof

My money's on some corporate bullshit, however, for example:

https://news.ycombinator.com/item?id=13303436

Re: On Password Managers

#297

Post by archagon »

Over time, it's become clear to me that the only business model with true longevity is open source. When I was first looking into password managers several years ago, I wanted something very simple: an iOS tool that could securely and locally encrypt a data blob with a memorized master password. 1Password did this job well for many years. Unfortunately, as with many App Store offerings, the pressing need for Agile Bits to grow has distorted the fundamental nature of the product. I was first alarmed when they added TouchID authentication: a seemingly innocuous feature, but one that necessarily stored your master password somewhere other than your head. (Fortunately, this was disabled by default.) Subsequently, features got added that stored your data on remote servers and even required you to send your master password over the web. I ignored this for the most part, but recent talk of this becoming the only use case for 1Password has put me on red alert. It's evidently time for me to start looking into OSS alternatives for my password manager, just as I have with a number of other tools in recent years.

Unfortunately, it seems that many companies these days are more interested in developing services rather than deftly solving specific user problems. Whether or not this is financially sound, it's an ongoing assault on my workflow. I can't live in fear of every utility on my system pivoting to a new business model! Fundamental software needs to be stable, and there's a good reason why most of our essentials (compression, video playback, web browsing, etc.) are free and open source.

Going forward, I hope we discover more ways to collectively fund open source software projects, large and small, because everything else is just an IOU for another future shakeup.

Re: On Password Managers

#298

Post by m3Lith »

darrmit wrote: post #171

I'm glad to see this getting more attention because it has been brewing for months and 1Password is essentially doing what they promised they wouldn't - forcing users to the subscription/online model my phasing out support for local vaults. I'm not mad at the subscription. I'd pay them the few bucks a month happily for what is an excellent application cross-platform. I AM mad at the forced cloud sync. My current plan…

Polished as in having a more "modern"/user friendly UI? I'd say the UI is the least important part of a password manager. Especially if you use an extension for autofilling/autosaving, you barely ever see it.

Anyways, there is a more stylish web UI for Keepass: https://keeweb.info/

Re: On Password Managers

#299

Post by epse »

pixelmonkey wrote: post #72

I use Enpass on Linux, Windows, OS X, Android, and iOS. I also use the Chrome extension. It has a similar user experience to 1Password, but is actually serverless (you sync your encrypted blob to a cloud service of your choice, or not at all). I wish Enpass were open source, but I can understand their decision not to make it so -- its desktop application is free and its mobile apps include a small perpetual license f…

Only downside is importing and exporting. I've been on Enpass since I got an android license through myappfree for some reason but exporting to KeePass was a bloody pain... Hadn't figured out the format of their blob, that could have helped. Might want to get back to it right now....

Re: On Password Managers

#300

Post by prophesi »

vbezhenar wrote: post #268

Is there simple open source non-commercial self-hosted password manager? I need something like 1Password, but with much more primitive interface, 1Password is just too user-friendly for me, so I'm reverted to text files which isn't very good from security point. I don't really need native apps, web interface would be sufficient, of course with crypto implemented in JavaScript.

There's PassIt[0], which was advertised in an earlier post[1] by one of its developers. Cross-platform, open source, and easily self-hosted if you know how to use Docker.

Then there's LessPass[2] which is an open-source stateless password manager. This one has an odd list of supported platforms (Chrome, Firefox, Android, Cozy (?), CLI), but I believe it also has a web interface.

If you're wanting one more team-oriented, there's Passbolt[3] which I think I'm going to give a try this weekend to solve my workplace's info-sharing problem.

Otherwise, you can just use KeePass/KeePassX/KeePassXC and sync the database file in the cloud with the host of your choice.

[0] http://passit.io/ [1] https://news.ycombinator.com/item?id=14814595 [2] https://lesspass.com [3] https://www.passbolt.com/

Post reply on HN