Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

On Password Managers

tbray.org

Post reply on HN
Print view View original

331–340 of 347 posts

Re: On Password Managers

#331

Post by jamesgeck0 »

jonny_eh wrote: post #20
tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

> 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords 1Password v6 for Windows doesn't work with local vaults, it requires 1password.com

1Password for Windows v6 is a apparently a complete rewrite and not yet feature complete. It will support local vaults in the future, although 1Password has always been very slow about updates for their Windows product.

https://discussions.agilebits.com/discussion/comment/340062/...

Re: On Password Managers

#332

Post by chiefalchemist »

tallanvor wrote: post #291
chiefalchemist wrote: post #182

Earlier quoted context omitted.

Well. Not to defend LP, but for those who don't click through, offline mode can (and should be?) disabled. Perhaps this is a case where a feature that makes some sense in some cases was added, the problem is, outside that scope it's a really bad idea. But then someone said "We'll make it optional..." and the rest was history?

I wouldn't agree that it necessarily should be disabled. Sometimes I'm on my computer with no internet access... If offline access is disabled, I have no access to passwords for locally installed applications.

Makes sense.

What would I do? I'd probably set up a second Chrome user and the LP for that user/browser would be auth creds for only stuff I'd need offline.

That would allow the main LP vault to have it disabled. This mitigates exposure.

Re: On Password Managers

#333

Post by wheresvic1 »

nextlevelwizard wrote: post #264
tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

I changed from LastPass to 1Password for big part because it was "pay once, use forever" instead of LastPass' subscription service. It hasn't even been 3 years since I switched and I paid what felt like a lot of money, but I figured that it would still be less over all in comparison. Now I can't get my vault to sync on my Windows machine and last time I reinstalled my Mac it was a hunt for the right executable. I've…

I use keepassx and Dropbox. Works beautifully everywhere!

Re: On Password Managers

#334

Post by mnm1 »

conorcleary wrote: post #249
mnm1 wrote: post #114

Earlier quoted context omitted.

Yes, me too. It took some missteps with shitty Lastpass before I finally found it. I sync directly from my computer to my phone and from my computer to my NAS. I've thought about syncing to Google Drive or some other service like that and it is an option, but so far hasn't been necessary. I don't see why my password data should ever have to leave my machines if I don't want it to. And it doesn't.

Your phone... I'm sure your data is hopping over many machines.

Can you explain? I use my home wifi to sync to my phone. I'm sure my data is not hopping over many machines, or any machines I do not control.

Re: On Password Managers

#335

Post by kchoudhu »

tptacek wrote: post #43
kchoudhu wrote: post #31

Earlier quoted context omitted.

> [t]here's currently no other commercial password manager that I recommend. I'm sorry I can't go into more detail than that Sounds like there's something about to blow?

I just get yelled at here when I leave out that sentence.

Aye, the alternate interpretation occurred to me shortly after posting. Apologies.

Re: On Password Managers

#336

Post by mvid »

yladiz wrote: post #239
Groxx wrote: post #209

Earlier quoted context omitted.

It's more that in-browser JS changes all the time and is basically never audited, nor can it be pinned and prevented from changing. It'd be downright trivial and unnoticeable to change it to capture your password rather than to behave as advertised. Compare that with the app. Sure it has an updater, but you can use it offline. Don't trust it in day-to-day affairs? Block network access. You can reliably not trust it,…

Playing devil's advocate: if you can trust that 1Password is doing everything they can to protect you, the user (using HTTPS, resource integrity) while using the browser app, then are you worried that 1Password may act maliciously? I see this argument all the time but I don't buy it because why on Earth would 1Password do such a thing, if their entire model is based on the customer trusting them handling their data?

They can be compelled by an outside force to do so. Or their business model may change

Re: On Password Managers

#337

Post by nextlevelwizard »

wheresvic1 wrote: post #333
nextlevelwizard wrote: post #264

Earlier quoted context omitted.

I changed from LastPass to 1Password for big part because it was "pay once, use forever" instead of LastPass' subscription service. It hasn't even been 3 years since I switched and I paid what felt like a lot of money, but I figured that it would still be less over all in comparison. Now I can't get my vault to sync on my Windows machine and last time I reinstalled my Mac it was a hunt for the right executable. I've…

I use keepassx and Dropbox. Works beautifully everywhere!

I sort of want to go whole hog if I go with KeePassX/C and roll my own cloud as well. I already have the parts set up, with TLS'd ownCloud and KeePassXC vault and I've mirrored my password on it, but I still don't trust it enough to use it over 1Password.

Re: On Password Managers

#338

Post by nextlevelwizard »

chakalakasp wrote: post #292
nextlevelwizard wrote: post #264

Earlier quoted context omitted.

I changed from LastPass to 1Password for big part because it was "pay once, use forever" instead of LastPass' subscription service. It hasn't even been 3 years since I switched and I paid what felt like a lot of money, but I figured that it would still be less over all in comparison. Now I can't get my vault to sync on my Windows machine and last time I reinstalled my Mac it was a hunt for the right executable. I've…

What was unreliable about Lastpass? Anecdotally, I've been using it for quite a while and have never had it fail. 2FA, easy sharing, dead mans switch to give access to a loved one if they request the access and enough time elapses, etc. Security wise, despite several network breaches (which should be expected to happen at some point with any networked computer system), the database has remained secure because they do…

I wasn't trying to imply that Lastpass was somehow unreliable, I simply switched away from Lastpass since it had yearly subscriptions VS. 1Passwords 'pay-once-own-for-life' model.

But since now 1Password is changing their subscription model if I were the use Lastpass, what would happen if one day they would shutdown their services? At least with 1Password I have (or had) my local vault in Dropbox/iCloud/whatever and I could still use it.

So next step beyond that would be to roll "my own" (obviously using software written by actually smart people) password management system which used open source and self hosted parts. That way I factor in upfront the "I have to deal with this shit" part and it doesn't come as a surprise years along the line when the company I'm relying on goes belly up, or changes their business strategy or whatever. Obviously it's not perfect, but I have to consider things. It's not wise to just rush into things.

Re: On Password Managers

#339

Post by grimborg »

analogist wrote: post #230
grimborg wrote: post #166

Why is the 1password login the same as the encryption password for all my other passwords? There is absolutely no reason why I should ever send them my encryption password. If they would make these two passwords separate and handle all encryption/decryption locally, I think that would solve the issue for me.

Because they don't transmit your encryption password. Authentication is not done by sending them your encryption password, but instead the derivation of an SRP static secret ( https://en.wikipedia.org/wiki/Secure_Remote_Password_protoco... ) from your password (PBKDF, XOR'd with HKDF of the entropy-boosting pepper that they call the "Secret Key"), and performing a session key exchange handshake, basically like a (non…

Thanks! I am so glad to see I was wrong on this!

Re: On Password Managers

#340

Post by j605 »

JoshTriplett wrote: post #58
danr4 wrote: post #36

The only cloud based password manager I'm willing to use is Dashlane[1]. It's supposedly "zero knowledge", and although you can never be 100% there isn't some bug waiting around to be exploited, it's a compromise I'm willing to make (the lesser evil). They also have several complementing features like encrypted notes, auto saving receipts, credit cards, batch password changer with quite a few major sites. I'm not aff…

> The only cloud based password manager I'm willing to use is Dashlane[1]. It's supposedly "zero knowledge", Firefox Sync has a similar property; everything is client-side encrypted.

Firefox sync got a security audit recently. I would trust it more.
Post reply on HN