Introducing Remembear, new password manager

From the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes.

Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors complain about. You really want to see a password manager get the basics right.

Notice also that the end of the Cure53 report complains about the project scope and the amount of time given. This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before.

Tunnelbear's user agreement makes me uneasy.

It might be a good alternative to Enpass. They use Rust and libsodium, which is a good sign.

But browser integration is the trickiest part in a modern password manager, yet what makes a password manager actually usable for most people.

So, give it some time before using the browsers (currently only Chrome) extension. Virtually all other password managers had security issues here.

Making these extensions smart (able to guess where login and password fields are, when passwords are being updated, etc) is also far from trivial. It's actually way more complex than password storage.

Gonna stick with Enpass for now, but that's definitely a project to watch.

The trouble I had with 1password is that it's secure in stupid ways.

Every time I log on a new device in there's SIX factor authentication and that's just too much work to get into my fap sites on my wankbook.

Great name! So much more evocative than "Remembr".

Let's hope they succeed, and inspire other companies to append a penultimate "a" after the penultimate "e", instead of just removing the penultimate "e".