1password is considering a self-hosted option to store vaults • Hacker News Board

Re: 1password is considering a self-hosted option to store vaults

#181

Post by mekster » Mon, Aug 09, 2021, 2:26 AM UTC

aikinai wrote: post #36

microtonal wrote: post #5

Semi-related: this survey was announced alongside 1Password 8 for Windows early access. Apparently 1Password 8 for Windows uses Electron and there was some discussion about AgileBits wanting to move to the same architecture on all platforms. Does anyone know if 1Password 8 on macOS will also be an Electron app? Their Linux Electron app is pretty good and definitely much better than having no 1Password at all. However…

Thanks for the warning about this. I was already disappointed in the direction 1Password has been taking, and moving to Electron would certainly be the last straw. It’s totally reasonable that they want to cheap out on the actual software and expand their business into more lucrative services, but it’s not what I personally want in a password manager. So hopefully someone else, maybe a lone develop that doesn’t need…

Your focus on password manager is off.

> maybe a lone develop that doesn’t need perpetual growth, will make a good, standalone, native Mac password manager.

How do you trust this lone developer? Password manager is all about security and having a motivation to chase money has more trust than someone seemingly doing it voluntarily.

And electron app, not sure why people still complain in 2021... unless you're machine is still running with 2GB memory...

Usability is so much more important than using extra 300MB of memory being electron.

Re: 1password is considering a self-hosted option to store vaults

#182

Post by mekster » Mon, Aug 09, 2021, 2:28 AM UTC

gumby wrote: post #80

microtonal wrote: post #5

Semi-related: this survey was announced alongside 1Password 8 for Windows early access. Apparently 1Password 8 for Windows uses Electron and there was some discussion about AgileBits wanting to move to the same architecture on all platforms. Does anyone know if 1Password 8 on macOS will also be an Electron app? Their Linux Electron app is pretty good and definitely much better than having no 1Password at all. However…

One reason I use 1Password is because it’s a native app. Electron apps never have the affordances of the platform, so are frustrating to use whenever you leave the “happy path”. Because it’s so heavily used this would be a reason to leave it. Separately, Electron is itself a large piece of code and integrating it would increase the attack surface — of a piece of security code! Another good reason to switch if this co…

> Electron is itself a large piece of code and integrating it would increase the attack surface

At the same time, the most audited code it there. Maybe you don't use a GUI browser.

Re: 1password is considering a self-hosted option to store vaults

#183

Post by mekster » Mon, Aug 09, 2021, 2:30 AM UTC

PaulKeeble wrote: post #8

Bitwarden_rs and keypassxc are what dominate in this space at the moment, with bitwarden_rs being the self hosted option directly where keypass is local but usually combined with file synchronisation software like NextCloud. Both are pretty good and get the job done without having to put passwords into another companies care.

Dominate as in from what source? Those 2 are having such a tiny usage only over geeks and everyone else are using others with more brand recognition.

Re: 1password is considering a self-hosted option to store vaults

#184

Post by mekster » Mon, Aug 09, 2021, 2:34 AM UTC

lisper wrote: post #99

I've never understood why anyone who takes security seriously would even consider a non-self-hosted (and non-open-source) password manager, especially after the recent Apple shenanigans. If it's not open-source and self-hosted then your security is entirely dependent on the good will of your provider. If they decide to screw you, they can. And it's not just the good will of the people running your provider today that…

Because they put their effort for their reputation and pays millions to hire people to look after their security.

If the "good will" is making them money, I guess you can count on it.

And you think your own hosted version that you're only looking after is that much better?

Re: 1password is considering a self-hosted option to store vaults

#185

Post by mekster » Mon, Aug 09, 2021, 2:38 AM UTC

LazyOne wrote: post #7

I've been using the Bitwarden_RS, now Vaultwarden for a long time and love it. It's just the backend API implementation so you still use the official Bitwarden clients and extensions.

I almost feel sorry to the official developer as it's so well built. It probably covers most people's needs.

But it's because the official daemon takes more resource by using MS SQL server and Vault Warden takes such a tiny resource.

Re: 1password is considering a self-hosted option to store vaults

#186

Post by comex » Mon, Aug 09, 2021, 2:46 AM UTC

mekster wrote: post #181

aikinai wrote: post #36

Earlier quoted context omitted.

Thanks for the warning about this. I was already disappointed in the direction 1Password has been taking, and moving to Electron would certainly be the last straw. It’s totally reasonable that they want to cheap out on the actual software and expand their business into more lucrative services, but it’s not what I personally want in a password manager. So hopefully someone else, maybe a lone develop that doesn’t need…

Your focus on password manager is off. > maybe a lone develop that doesn’t need perpetual growth, will make a good, standalone, native Mac password manager. How do you trust this lone developer? Password manager is all about security and having a motivation to chase money has more trust than someone seemingly doing it voluntarily. And electron app, not sure why people still complain in 2021... unless you're machine i…

> Usability is so much more important than using extra 300MB of memory being electron.

I don't know if it's more important, but certainly, Electron apps' poor usability is another reason to avoid them.

While there are exceptions, they tend to lack usable right-click menus, use odd font sizes (everything's too big), have UI elements that behave differently from the platform standard, and, of course, lag, all of which make usability suffer.

Re: 1password is considering a self-hosted option to store vaults

#187

Post by jari_mustonen » Mon, Aug 09, 2021, 4:01 AM UTC

ebiester wrote: post #95

Terretta wrote: post #83

Earlier quoted context omitted.

> Is there any password management application out there that makes sharing passwords or password vaults easy but is also free? For members of a relatively well-paid profession earning good wages from creating software, I wonder if the reluctance to support others earning money for quality work isn’t some form of cognitive dissonance. // Pre-emptive “edit” before this comment has replies: Folks post a lot of argument…

I agree to the payment. I disagree to the subscription model. I absolutely would try to hook users on any SaaS. However, I go out of my way to avoid such products. If I can pay for them once, I much prefer it. (For something like jetbrains, I'm okay with a renewal fee because if I choose not to pay it, I can still use the older version.) I make an exception for Bitwarden because I like the idea of my password manager…

You know, I bought 1Password version 3 licence. There’s the support. Fast forward some time and the software started recommending that I uograde to version 4. After installing it, the software told me that it requires subscription from here on. It was almost impossible to roll back to version 3. I ended up switching to Unix pass.

Re: 1password is considering a self-hosted option to store vaults

#188

Post by kenneth » Mon, Aug 09, 2021, 4:09 AM UTC

nucleardog wrote: post #103

Terretta wrote: post #94

Earlier quoted context omitted.

You don’t like the idea of storing opaque bits along with everyone else’s equally opaque bits? So long as the secret key to these bits is yours, not theirs, what’s the catch?

For a whole class of potential (if unlikely) situations, it shifts from me potentially being caught up in a mass hack, response to an overly broad warrant, etc to needing be targeted specifically. Passphrase compromised? If they're hosting, you know exactly where to go to access my passwords. If I'm hosting, I can tell you that I use 1Password and my master password and I'm still _relatively_ safe in that you don't e…

This is exactly and precisely why I don't host with 1Password, I don't want to have the same profile as the big valuable target of everyone's else's setup. Having something custom is far better if only for the fact that you have to be targeted individually vs. as a big mass prize.

Re: 1password is considering a self-hosted option to store vaults

#189

Post by rovr138 » Mon, Aug 09, 2021, 4:18 AM UTC

mekster wrote: post #183

PaulKeeble wrote: post #8

Bitwarden_rs and keypassxc are what dominate in this space at the moment, with bitwarden_rs being the self hosted option directly where keypass is local but usually combined with file synchronisation software like NextCloud. Both are pretty good and get the job done without having to put passwords into another companies care.

Dominate as in from what source? Those 2 are having such a tiny usage only over geeks and everyone else are using others with more brand recognition.

Dominate in this space, self-hosted options.

Mainly geeks are the ones that will self-host so it looks like a fair comparison.

Re: 1password is considering a self-hosted option to store vaults

#190

Post by AnonC » Mon, Aug 09, 2021, 6:06 AM UTC

Terretta wrote: post #83

AnonC wrote: post #13

They made the standalone license almost impossible to find and get, forced a subscription on users, and made the password vault storage online for the subscriptions. Now this self-hosting survey comes as a surprise, and it would be of some relief if/when it’s implemented. I do wonder how the licensing and pricing will be handled though. Bitwarden officially allows self-hosting for the personal use tiers, but it seems…

> Is there any password management application out there that makes sharing passwords or password vaults easy but is also free? For members of a relatively well-paid profession earning good wages from creating software, I wonder if the reluctance to support others earning money for quality work isn’t some form of cognitive dissonance. // Pre-emptive “edit” before this comment has replies: Folks post a lot of argument…

> For members of a relatively well-paid profession earning good wages from creating software, I wonder if the reluctance to support others earning money for quality work isn’t some form of cognitive dissonance.

GP here. I agree that all software developers and maintainers need to earn an income for their work. It's just that you don't know my circumstances, my geographic location, and the constraints I have to deal with when posing such a question. Believe me when I say that I have some real constraints that cannot be surmounted on this particular front. I don't like my circumstances, but that's just how things are right now and there's nothing I can do about it.