101–110 of 156 posts
Earlier quoted context omitted.
Yes, us guys and gals working on the app are planning on the iOS 12 autofill API integration: https://github.com/mozilla-lockbox/lockbox-ios/issues/445
I think you mean https://github.com/mozilla-lockbox/lockbox-ios/issues/486 :)
I installed it and will compare it to Lastpass (which is pretty good IMO). HOWEVER, it saddens me to read on the front page: "using 256-bit encryption". I'd really expect the competent people at Mozilla to know that this statement means next to nothing. At the very minimum I want to know: 1) HOW is the key derived (say, "derived used PBKDF2 on the Firefox username + password") 2) WHERE is it encrypted (I assume "encr…
Firefox Lockbox architect here. Thank you for the feedback. Your comment is fair; we can, and will, do better on the details. The language we have today is the balance marketing, security reviewers, and engineering could reach for the masses to feel informed without being overwhelmed and confused. As you found, Firefox Accounts derives the encryption key from your username and password on the client-side; the server…
It would be fantastic to have a 'more details' page, where the nitty-gritty is detailed for those who care.
Has anyone done a thoughtful comparison of PW managers? I moved on from keepass because it was a huge hassle to use, but LastPass and 1password both have some detractors as well.
Has anyone done a thoughtful comparison of PW managers? I moved on from keepass because it was a huge hassle to use, but LastPass and 1password both have some detractors as well.
I think a valuable comparison would not be of features but of the security, and therefore a person comparing them would need real security expertise. I'd worry about bad information from non-experts. In the past, at least some security experts on HN have recommended 1Password.
All these people storing all their secrets in one place creates an exceptionally valuable target that I expect, IMHO, will attract well-resourced attacks. Find a way to crack Lastpass, and imagine what you have - it's the ultimate breach (and if you are smart, nobody will know).
To be a net gain in security, a password manager needs very effective security for itself. If the user wants something to ease the burden of managing all those exposed passwords, then perhaps features are the issue.
Earlier quoted context omitted.
I was tired of browser plugins that just didn't always work quite right. Keepass, on whatever platform using whatever client, just uses the clipboard. 100% chance of working, although not safe against certain types of spyware.
It's not all clipboard based - Keepass has an RPC plugin that can be used with browser extensions for Firefox and Chrome. I also use Keepass2android for (duh) Android, and while you can use copy/paste it also has a custom keyboard you can use instead.
Between Chrome's cross-platform autofill, Firefox's autofill, and browser plugins, I have too many things telling me what my password should be. s
Earlier quoted context omitted.
Firefox Lockbox architect here. Thank you for the feedback. Your comment is fair; we can, and will, do better on the details. The language we have today is the balance marketing, security reviewers, and engineering could reach for the masses to feel informed without being overwhelmed and confused. As you found, Firefox Accounts derives the encryption key from your username and password on the client-side; the server…
>The language we have today is the balance marketing, security reviewers, and engineering could reach for the masses to feel informed without being overwhelmed and confused. It would be fantastic to have a 'more details' page, where the nitty-gritty is detailed for those who care.
The iOS app seems to be region-locked to U.S. only App Store.
Only for now. This is just the beginning of an experimental product and we're hoping to bring it far and wide later. Other than "every", what language or regions would you want/expect/need first?
Has anyone done a thoughtful comparison of PW managers? I moved on from keepass because it was a huge hassle to use, but LastPass and 1password both have some detractors as well.
Wirecutter has done a comparison of them. https://thewirecutter.com/reviews/best-password-managers/