201–210 of 282 posts
Sorry 1Password, it took you so long to make this move that I had sold my soul to LastPass in the meantime.
I just use pass: https://www.passwordstore.org/
No, but in all seriousness, I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords. While I appreciate that they do have good skin in the game by being paid, etc -- your password storage on SOMEONE ELSE'S MACHINE fundamentally creates another huge attack vector/opportunity to screw it up, when they also must be accessed locally somehow. I appreciate it if you'…
I'm generally fine with this if the password vault is end-to-end encrypted, the vault's password is never shared with the server, and the server doesn't have access to the plaintext passwords at all.
At that point you have to trust that the crypto used for the vault is done correctly (and that trust is easier to come by if the clients are open source). But that's the same trust you'd have to extend if you used another solution (e.g. Bitwarden) that allowed you to self-host the sync service.
If you only access password-protected resources from one system, then you don't need sync at all, and this problem goes away. If you do need sync, you're going to have this problem no matter what.
What's the password recovery process like with 1Password for family accounts? I'm the administrator for my family's account on LastPass and my wife forgot her master password and has now burned the associated email. The account was unused and empty so nothing was lost but it highlighted to me that account recovery was not smooth or seamless. As an administrator you can't just issue a password reset on their behalf. I…
I have always wondered why we can’t make visible the master password when typing it. My master is very long (pass phrase) and I have to type it very carefully, it’s even harder on mobile. Such a pain ! Isn’t it a basic UX pattern to allow the user to show/hide the password as type it (with the popular eye icon at the end of the password input) ? Am I missing something ? Is this not present for security reason ?
PSA: Note that AgileBits intentionally hides the standalone license option and pushes subscription as the only visible scheme to get the application. This is a long standing dark pattern, and though the support staff will admit on their forums or here that the standalone license does exist, you wouldn't be able to find it without some special incantations on the forums. They will keep reiterating that it's for your o…
The sync story bothers me. In my mind, Enpass is one that does it correctly. They don't offer a sync service, instead they let you choose from a number of popular ones (OneDrive, Dropbox, iCloud, and a few others), one of which you probably already use. There's no need for yet another cloud service to solve this already solved problem.
Another constraint with using a file sync service is this is introducing a kitchen and egg problem when we lose everything. We first need to restore access to the file sync service to then be able to recover the password file. Which means we can’t use the password manager for the file sync service. Not a deal breaker, as it is what I’m currently doing, but I’ve always wondered how it would go after a catastrophe like losing everything in a home fire.
Earlier quoted context omitted.
> Okay, which site was this? The site it said it was? > Is there a password I'm supposed to change? Do you have a password saved or memorized? Does the site have a link or form to log in? > Was it actually a password I stopped using 5 years ago, but is still floating out there somewhere? They can't be sure. Why not change it to be safe?
>> Okay, which site was this? >The site it said it was? I'm sorry, but I have absolutely no idea what sites fall under the banner of the "FooBarBaz.NET" dark web data dump.
What's the password recovery process like with 1Password for family accounts? I'm the administrator for my family's account on LastPass and my wife forgot her master password and has now burned the associated email. The account was unused and empty so nothing was lost but it highlighted to me that account recovery was not smooth or seamless. As an administrator you can't just issue a password reset on their behalf. I…
Short answer:
When 1Password creates an encrypted vault, it will make a copy of the key, encrypt it with the public key of another family member (e.g. you) and hold the encrypted result in escrow on 1Password’s servers.
If your wife forgets her master password and chooses to request recovery, a special procedure starts. First, 1Password asks you to confirm that the request is legit. If you confirm, the server will delete and re-create your wife’s account, then send you her new public key and the encrypted escrow key. Your app uses your private key to decrypt it. (Now your app has your wife’s vault key.) Your app re-encrypts it with her new public key, uploads the result and forgets the key. Finally, the server sends your wife her encrypted vault together with the thing your app just did. Now your wife can access her vault again.
Long answer: see 1Password’s security white paper [1].
Earlier quoted context omitted.
> They do not say that they do not decrypt your entire vault into browser memory, because they do. I am sorry but this is just wrong. I have close to 6,000 items in my 1Password across family and business accounts. Loading everything into memory all the time would be ridiculous.
I agree, but I was under the impression that the vaults were encrypted as a whole, but according to the security white paper that changed at some point. So you can decrypt individual passwords. So I’m happy and am in the process of correcting my comments. Sorry.
I'm a big fan of 1Password. I've been paying for it for years. A few years ago I got my partner setup in a few minutes and now they have strong passwords everywhere. Its got great features for sharing vaults with other people so I've got password managers setup for the kids too. My partner and I both have personal vaults, we have a shared vault for financial stuff, and a shared vault for our media accounts (that we s…