1password is considering a self-hosted option to store vaults

Post by pvg » Sun, Aug 08, 2021, 9:26 PM UTC

lisper wrote: post #131

pvg wrote: post #124

Earlier quoted context omitted.

if it's not open-source and self-hosted then your security is entirely dependent on the good will of your provider. It's because neither of these conditions are really true - you'd have to assume that source code is only way to assess the security of software and that end-to-end encryption doesn't actually work.

That depends on what you mean by "end-to-end encryption doesn't actually work". Of course E2EE works in principle. The problem is: how can I know that the code I am running is in fact a properly implemented E2EE system if I don't trust the vendor and I can't audit the code?

Post by lisper » Sun, Aug 08, 2021, 10:12 PM UTC

pvg wrote: post #171

lisper wrote: post #131

Earlier quoted context omitted.

That depends on what you mean by "end-to-end encryption doesn't actually work". Of course E2EE works in principle. The problem is: how can I know that the code I am running is in fact a properly implemented E2EE system if I don't trust the vendor and I can't audit the code?

If you don't trust the vendor, don't let them handle your passwords, obviously. But the security properties non-open-source code are routinely analyzed and vulnerabilities found, etc. Plus the track records of the various solutions, a cartesian product of open/closed source, 'hosted' or not, etc speak for themselves.

Post by beefjerkins » Sun, Aug 08, 2021, 10:47 PM UTC

kemayo wrote: post #117

bruckie wrote: post #78

Earlier quoted context omitted.

Tavis Ormandy (of Google Project Zero) has a pretty convincing post arguing that relying on browser extensions that modify the DOM (which includes [almost?] all password managers) is a bad idea: https://lock.cmpxchg8b.com/passmgrs.html (he recommends using your browser's built-in password manager, which isn't as convenient but is much more secure)

It'd be ideal if browsers offered standard hooks into their password-filling mechanisms. Let the password managers volunteer "I know a password for this site!" and fill it through the browser's standard UI. Basically, I want the browsers to implement something close to what Apple has for password management on iOS. Ideally go a bit further and expose hooks for creating/saving a new login, too. Unless they already do…

Post by Barrin92 » Sun, Aug 08, 2021, 11:52 PM UTC

YPPH wrote: post #108

lisper wrote: post #105

Earlier quoted context omitted.

If it's properly encrypted you should be able to publish it on github and still be more secure than entrusting it to a third party.

Publishing your vault of passwords on a public GitHub repository seems like a pretty bad idea, no matter how well you trust the client-side encryption code. I'm no expert on the subject, but I suspect these password managers use a sophisticated mechanism of authentication (for accessing the vault) as well as encrypting of the actual contents of the vault. The effect of this means that Bob's encrypted vault cannot be…

Post by freeone3000 » Mon, Aug 09, 2021, 1:22 AM UTC

jamesgeck0 wrote: post #128

Spooky23 wrote: post #119

Earlier quoted context omitted.

With 1Password, the subscription is really expensive, and I’m afraid that the bloat the company is stuffing into the product is weakening the security. Frankly, they make too much money. I’ve found enough bugs in the Mac product that I assume there are security issues I’m not aware of.

A 1Password subscription costs $36 a year. Their previous standalone product cost $50 per desktop OS you wanted to use it on and had a major version upgrade you needed to buy again about every two years. If you needed it on both Mac and Windows, the subscription was cheaper.