Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What password managers can you recommend?

news.ycombinator.com

Post reply on HN
Print view View original

51–60 of 136 posts

Re: Ask HN: What password managers can you recommend?

#51

Post by torstenvl »

thebean11 wrote: post #12

Why are Dropbox and iCloud preferable to 1Password sync?

Because they work at a standard level of abstraction (the file system) and can be replaced if necessary. I can replace Dropbox with Box or Syncthing or OwnCloud or rsync or sftp coupled with crontab or an FSEventsD monitor or whatever I want, at any time I want.

1Password's proprietary sync isn't open source and isn't open standards. It is designed to lock me into reliance on a company that has inarguably demonstrated that it hates its users.

Re: Ask HN: What password managers can you recommend?

#52

Post by torstenvl »

bloopernova wrote: post #25

Bitwarden can be self-hosted. $10/year subscription cost is well, well worth it. If you don't self-host, note that everything is encrypted before being stored at bitwarden. They don't have access to your passwords.

Bitwarden is just as user-hostile. They go out of their way to make it harder to own your data, when it should just be local-first vaults.

Import/export is irrelevant. I want to own my data, not just be able to check out a copy whenever I want.

Re: Ask HN: What password managers can you recommend?

#53

Post by computershit »

basseq wrote: post #50
computershit wrote: post #45

Earlier quoted context omitted.

A few HN posts from the last week regarding LastPass: Ask HN: How did my LastPass master password get leaked?: https://news.ycombinator.com/item?id=29716715 LastPass users warned their master passwords are compromised: https://news.ycombinator.com/item?id=29716715

Note that master passwords were not compromised, the the warnings were triggered in error[1]. That's not to say that other concerns around security aren't valid. [1] https://www.theverge.com/2021/12/28/22857485/lastpass-compro...

The warnings might have been triggered in error, but the evidence is certainly there for masters to have been compromised. Until recently their publicly available support forum running phpBB was using the master password for customer logins.[1]

[1] https://news.ycombinator.com/item?id=29706579

Re: Ask HN: What password managers can you recommend?

#54

Post by pydry »

aidenn0 wrote: post #42
itake wrote: post #9

Earlier quoted context omitted.

+1 Bitwarden. I wish they dog fooded more so they can see how bad their browser extension is though.

On firefox, their browser extension is excellent for me; what issues do you have?

Not him, but:

* Android app logs itself out every time I use it.

* Lacked versioning of passwords (last time I checked).

* The workflow to add new passwords / reset passwords on websites is clunky. This hasnt improved for years.

Re: Ask HN: What password managers can you recommend?

#55

Post by noman-land »

torstenvl wrote: post #52
bloopernova wrote: post #25

Bitwarden can be self-hosted. $10/year subscription cost is well, well worth it. If you don't self-host, note that everything is encrypted before being stored at bitwarden. They don't have access to your passwords.

Bitwarden is just as user-hostile. They go out of their way to make it harder to own your data, when it should just be local-first vaults. Import/export is irrelevant. I want to own my data, not just be able to check out a copy whenever I want.

Curious what makes you say this. I recently started using it and it has prominent import and export functionality.

Re: Ask HN: What password managers can you recommend?

#56

Post by kemayo »

torstenvl wrote: post #47
santoshalper wrote: post #36

Earlier quoted context omitted.

I've been a happy 1PW user on Windows 10 for a few years, but admit I haven't paid a lot of attention. I haven't noticed any big changes. What are you guys referring to?

They made generating passwords more difficult. You can no longer tell it how many, e.g., special symbols to use, only to use them or not. This means regenerating new passwords over and over until one fits site requirements, and/or manual tweaking that might unintentionally reduce entropy. They stopped supporting the mobile extension. I can no longer invoke 1Password from Safari on iOS. If I'm lucky , then Safari's ow…

> They stopped supporting the mobile extension. I can no longer invoke 1Password from Safari on iOS.

They did provide an alternative, to be fair -- they're shipping a Safari web extension that you can turn on, which gives you about the same behavior as in a desktop browser.

Honestly, I find that the built in iOS autofill stuff works fine for my purposes. I recognize that's probably very specific to the exact sites I'm using, though...

Re: Ask HN: What password managers can you recommend?

#57

Post by hashhar »

pydry wrote: post #54
aidenn0 wrote: post #42

Earlier quoted context omitted.

On firefox, their browser extension is excellent for me; what issues do you have?

Not him, but: * Android app logs itself out every time I use it. * Lacked versioning of passwords (last time I checked). * The workflow to add new passwords / reset passwords on websites is clunky. This hasnt improved for years.

Agreed on the third point. But the first two have been fixed for quite some time now.

Re: Ask HN: What password managers can you recommend?

#58

Post by ryandvm »

Am I the only one that thinks that password managers are a terrible idea?

Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong?

The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code from one of these password managers is modified with trojan code and we realize that some group has been slurping up credentials by the billions over the course of a few months.

Seems like the charitable take is that password managers are maybe the best approach to a horrible idea, and the real solution is that we ought to be racing to abolish passwords altogether as soon as possible.

Re: Ask HN: What password managers can you recommend?

#59

Post by granddave »

pydry wrote: post #54
aidenn0 wrote: post #42

Earlier quoted context omitted.

On firefox, their browser extension is excellent for me; what issues do you have?

Not him, but: * Android app logs itself out every time I use it. * Lacked versioning of passwords (last time I checked). * The workflow to add new passwords / reset passwords on websites is clunky. This hasnt improved for years.

1) Never experienced that

2) The older versions are available online if you click on the number to the right of "Password History"

3) Agree, that can use some polish

Re: Ask HN: What password managers can you recommend?

#60

Post by tcfhgj »

brycewray wrote: post #40

If you can handle what I call[0][1] "the KeePass way": on desktop, KeePassXC (Windows/macOS/Linux) on desktop; on mobile, KeePass2Android or Keepassium (iOS). [0]: https://www.brycewray.com/posts/2021/06/two-paths-password-m... [1]: https://www.brycewray.com/posts/2021/08/1password-hits-fan/

In my experience Keepass2Android has very bad usability on Android compared to Bitwarden
Post reply on HN