Ask HN: What password managers can you recommend? • Hacker News Board

Re: Ask HN: What password managers can you recommend?

#21

Post by kristiandupont » Tue, Jan 04, 2022, 5:31 PM UTC

putlake wrote: post #11

I've not understood why one wouldn't use Chrome or Edge's built-in password manager. Is there a compelling reason to use a separate password manager app?

The reason I don't is that those are not the only browsers I use. And I want my passwords available to me everywhere.

Re: Ask HN: What password managers can you recommend?

#22

Post by wepple » Tue, Jan 04, 2022, 5:31 PM UTC

thebean11 wrote: post #12

Why are Dropbox and iCloud preferable to 1Password sync?

I’m curious about this too. 1Password used to sync to a file that could be backed up to iCloud/Dropbox/drive and I wished they’d kept it that way, but it at least partially suggests they may have stuck with full client-side encryption (I have not verified)

Re: Ask HN: What password managers can you recommend?

#23

Post by firepacket » Tue, Jan 04, 2022, 5:32 PM UTC

I wrote my own with ridiculous Argon2 requirements (Takes 18 secs to open) combined with PKDF hybrid hashing system. (not chained) and strong AES256 CBC implementation with proper random IVs for each field and correct padding. You can encrypt any kind of data and files, it's encoded as 32k UTF-16 + sig XML losing only 1.3% over binary, but I like text files. Of course, some files come out smaller due to the Gzip compression.

It is Dropbox friendly meaning any change or addition in another person using the same vault in the same directory is automatically updated in all open vaults. This was originally for collaboration. You can have your own private vault too with a unique password, as many as you like. They just end up as XML files. It runs fast as uses databinding, can generate strong passwords, and makes copying/pasting easy. I am having trouble encrypting files over 1GB though.

I take great lengths to protect the key. If the file is open too long, it minimizes and locks, when you open it, it decrypts everything again. As soon as decryption is done, the key is stashed away using ProtectMemory function in the framework. I have done memory dumps to ensure the key is not visible when the app is idle.

Files works differently, Their meta data is encrypted but you are able to checksum then and preview them in memory without the key ever being exposed and the content never touches the disk and is zeroed afterward. You can currently play sound, view pictures, execute files (in memory!) and soon video.

I plan on browser integration by a cross-browser userscript and loopback routing (127.0.0.1) that recognizes when the cursor is in a field specified in the login's metadata. But I am am running into trouble because sites like to randomize the name of the login fields, so I a have to use some reliable heuristic approach.

Does anyone have any ideas on how to deal with that? If I can figure that out, and get video previews working I will open source it.

EDIT: Here's a preview of the app: https://imgur.com/a/rZGPCPZ

Re: Ask HN: What password managers can you recommend?

#24

Post by hprotagonist » Tue, Jan 04, 2022, 5:32 PM UTC

keepass tics all those boxes for you.

Re: Ask HN: What password managers can you recommend?

#25

Post by bloopernova » Tue, Jan 04, 2022, 5:32 PM UTC

Bitwarden can be self-hosted. $10/year subscription cost is well, well worth it.

If you don't self-host, note that everything is encrypted before being stored at bitwarden. They don't have access to your passwords.

Re: Ask HN: What password managers can you recommend?

#26

Post by drcongo » Tue, Jan 04, 2022, 5:32 PM UTC

I hate what 1Password has become, and how user-hostile Agile Bits are. BUT after the last bait and switch they pulled I tested _every single password manager on the market_, and the bad news is that the others are all worse. The only two I found that I liked, but sadly lacked at least one feature that we need, were Secrets [0] and Elpass [1]. I think both might fail your requirements list too. I've begrudgingly had to stick with 1Password, but after the way they've treated the customers who have been giving them money for over a decade I'll be off the second someone makes a password manager that meets our requirements.

[0]https://outercorner.com/secrets-mac/

[1] https://elpass.app

Re: Ask HN: What password managers can you recommend?

#27

Post by benbristow » Tue, Jan 04, 2022, 5:32 PM UTC

itake wrote: post #9

jstx1 wrote: post #2

Bitwarden. The free version does everything I need from a password manager (which is to store, sync and generate passwords); decent browser extension, decent mobile app.

+1 Bitwarden. I wish they dog fooded more so they can see how bad their browser extension is though.

How come? Seems to work pretty well for me. Better than LastPass/Dashlane worked for me in the past.

Re: Ask HN: What password managers can you recommend?

#28

Post by wepple » Tue, Jan 04, 2022, 5:33 PM UTC

Can you elaborate on

> they seem insistent on making the experience as terrible as possible lately

Re: Ask HN: What password managers can you recommend?

#29

Post by koheripbal » Tue, Jan 04, 2022, 5:33 PM UTC

SamuelAdams wrote: post #14

putlake wrote: post #11

I've not understood why one wouldn't use Chrome or Edge's built-in password manager. Is there a compelling reason to use a separate password manager app?

I thought they were stored on-disk in a non-encrypted SQLite database. So anyone with physical access to your computer has all your passwords.

I believe they are encrypted with you Windows credentials.

Re: Ask HN: What password managers can you recommend?

#30

Post by dxf » Tue, Jan 04, 2022, 5:34 PM UTC

I was a happy 1Password user and warily switched to their subscription model. But It still does everything I want and now it even does more -- e.g. I can have shared vaults with my partner and other family members, which is more convenient than duplicating entries between machines or going to each others' computers to look something up.