Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1password is considering a self-hosted option to store vaults

1password.community

Post reply on HN
Print view View original

121–130 of 228 posts

Re: 1password is considering a self-hosted option to store vaults

#121

Post by YPPH »

lisper wrote: post #114
YPPH wrote: post #108

Earlier quoted context omitted.

Publishing your vault of passwords on a public GitHub repository seems like a pretty bad idea, no matter how well you trust the client-side encryption code. I'm no expert on the subject, but I suspect these password managers use a sophisticated mechanism of authentication (for accessing the vault) as well as encrypting of the actual contents of the vault. The effect of this means that Bob's encrypted vault cannot be…

And why do you think that authentication + encryption is going to be more secure than encryption alone? Either way, there's a secret. If you know the secret you can access the data and if you don't you can't. The UI/UX trappings of the mechanism don't change this fundamental dynamic. What does change the dynamic is if you allow a third party to control the code that you run.

2FA is engaged at the authentication stage, so knowing the vault passphrase may not be sufficient.

Further, allowing anyone to download my encrypted vault just feels really uncomfortable and unnecessary.

Re: 1password is considering a self-hosted option to store vaults

#122

Post by mormegil »

D-Nice wrote: post #113

Vaults, self-hosting, all these needless complications imo for what should be simple. Just give me a secure deterministic password from a website address + master pass combo. That's exactly what my project, https://app.srspass.com aims to do. Even though I have a super redundant NAS setup, I'd really hate to depend on a vault and have it all disappear due to some disaster. With SrsPass, I just remember one password,…

I think there should be (and probably already is) an FAQ page explaining why a "stateless password manager" is not a great idea for a common user. I guess the answers to this SE question might be a good start: https://security.stackexchange.com/q/214301/2530

Re: 1password is considering a self-hosted option to store vaults

#123

Post by tchalla »

iambateman wrote: post #118

I understand that 1Password is a business and it’s their prerogative to make money. In 2014 I switched to self-hosted password management with 1P and it changed my life. Today, my 1P vaults are a daily, indispensable part of computing. There are thousands of records and my overall security is dramatically higher. Fast forward a few years and I heard that they had introduced a subscription. Why? It’s not their fault:…

Also, why should you lose access to features because you stopped subscribing? You paid for them and now you don't want to support future features. Why should you lose access to past ones?

Re: 1password is considering a self-hosted option to store vaults

#124

Post by pvg »

lisper wrote: post #99

I've never understood why anyone who takes security seriously would even consider a non-self-hosted (and non-open-source) password manager, especially after the recent Apple shenanigans. If it's not open-source and self-hosted then your security is entirely dependent on the good will of your provider. If they decide to screw you, they can. And it's not just the good will of the people running your provider today that…

if it's not open-source and self-hosted then your security is entirely dependent on the good will of your provider.

It's because neither of these conditions are really true - you'd have to assume that source code is only way to assess the security of software and that end-to-end encryption doesn't actually work.

Re: 1password is considering a self-hosted option to store vaults

#125

Post by tw04 »

Ecstatify wrote: post #88
CrimsonRain wrote: post #35

Earlier quoted context omitted.

Enpass works nicely. I can freely share vaults and keep vaults backed up in anyway I prefer. Two downsides: 1. Mobile is paid I think 2. Not open source

Personally I don't recommend Enpass. They switched to a subscription model like every other password manager. They don't host your data so have no recurring expense, I don't understand how they can justify the subscription model. They have no real innovation, they added an "Audit Feature" for an additional €26.49 per year.

They appear to have a lifetime option?

“Enpass lifetime premium: $79.99”

Re: 1password is considering a self-hosted option to store vaults

#126

Post by geerlingguy »

bleachedsleet wrote: post #93
yreg wrote: post #69

Earlier quoted context omitted.

How did you do that? Did you port license from an older 1Password, or is there some way to buy 1Password 7?

Not the parent poster, but this can be done from inside the app. They hid the link, but the purchase flow is still available from inside 1Password.

Yeah this is what I did.

Re: 1password is considering a self-hosted option to store vaults

#127

Post by dehrmann »

Terretta wrote: post #83
AnonC wrote: post #13

They made the standalone license almost impossible to find and get, forced a subscription on users, and made the password vault storage online for the subscriptions. Now this self-hosting survey comes as a surprise, and it would be of some relief if/when it’s implemented. I do wonder how the licensing and pricing will be handled though. Bitwarden officially allows self-hosting for the personal use tiers, but it seems…

> Is there any password management application out there that makes sharing passwords or password vaults easy but is also free? For members of a relatively well-paid profession earning good wages from creating software, I wonder if the reluctance to support others earning money for quality work isn’t some form of cognitive dissonance. // Pre-emptive “edit” before this comment has replies: Folks post a lot of argument…

I have no idea what the cause is, but I'm surprised at how often I've seen people use an unlicensed Sublime Text copy at work.

Re: 1password is considering a self-hosted option to store vaults

#128

Post by jamesgeck0 »

Spooky23 wrote: post #119
Terretta wrote: post #83

Earlier quoted context omitted.

> Is there any password management application out there that makes sharing passwords or password vaults easy but is also free? For members of a relatively well-paid profession earning good wages from creating software, I wonder if the reluctance to support others earning money for quality work isn’t some form of cognitive dissonance. // Pre-emptive “edit” before this comment has replies: Folks post a lot of argument…

With 1Password, the subscription is really expensive, and I’m afraid that the bloat the company is stuffing into the product is weakening the security. Frankly, they make too much money. I’ve found enough bugs in the Mac product that I assume there are security issues I’m not aware of.

A 1Password subscription costs $36 a year. Their previous standalone product cost $50 per desktop OS you wanted to use it on and had a major version upgrade you needed to buy again about every two years.

If you needed it on both Mac and Windows, the subscription was cheaper.

Re: 1password is considering a self-hosted option to store vaults

#129

Post by lisper »

YPPH wrote: post #121
lisper wrote: post #114

Earlier quoted context omitted.

And why do you think that authentication + encryption is going to be more secure than encryption alone? Either way, there's a secret. If you know the secret you can access the data and if you don't you can't. The UI/UX trappings of the mechanism don't change this fundamental dynamic. What does change the dynamic is if you allow a third party to control the code that you run.

2FA is engaged at the authentication stage, so knowing the vault passphrase may not be sufficient. Further, allowing anyone to download my encrypted vault just feels really uncomfortable and unnecessary.

You can use 2FA to encrypt. OK, it would be 2FE, not 2FA, but it's the same idea. Just encrypt using a Diffie-Helman key derived from a secret contained on a device. (Of course, if you're going to do this, you could just as well keep the vault itself on the device.)

> Further, allowing anyone to download my encrypted vault just feels really uncomfortable and unnecessary.

It is unnecessary. I said you could publish your vault on github and still be more secure than a third-party provider. I didn't say you should do this. Of course you should try to keep your vault away from prying eyes. But you should not rely on this for your security. You should only ever rely on one thing for data security, and that is the integrity of your secrets, which should be small enough to be stored in your brain or in a device that allows them to be used without being read (2FA/E). That's the whole point of encryption.

Re: 1password is considering a self-hosted option to store vaults

#130

Post by tw04 »

ValentineC wrote: post #104
hanklazard wrote: post #41

Earlier quoted context omitted.

I self-host Bitwarden_rs and use the client apps on Windows, Linux, and MacOS. To me, the UI seems very usable, polished and attractive. It doesn’t seem that different from 1Password, which I switched from a few years ago. What exactly about the UI needs improvement?

I'm a 1Password user right now, but I've tried self-hosting Bitwarden_rs and like it very much. The one killer feature which is preventing me from switching is the ability to use multiple self-hosted servers at once (so I can separate family vaults from business) [1], but "client profiles" are likely to be implemented some time soon [2]. Now that I've learnt that local vaults are going away in 1Password 8 [3], I'll p…

I thought there were some features missing from vaultwarden compared to bitwarden. I think the one that stuck out to me was lack of AD integration. Any chance you’ve seen a list of what is and isn’t in vaultwarden? My search hasn’t turned anything up. Maybe they’re at feature parity now?
Post reply on HN