Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What password managers can you recommend?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 136 posts

Re: Ask HN: What password managers can you recommend?

#61

Post by jrockway »

santoshalper wrote: post #36
drcongo wrote: post #26

I hate what 1Password has become, and how user-hostile Agile Bits are. BUT after the last bait and switch they pulled I tested _every single password manager on the market_, and the bad news is that the others are all worse. The only two I found that I liked, but sadly lacked at least one feature that we need, were Secrets [0] and Elpass [1]. I think both might fail your requirements list too. I've begrudgingly had t…

I've been a happy 1PW user on Windows 10 for a few years, but admit I haven't paid a lot of attention. I haven't noticed any big changes. What are you guys referring to?

People are mad because it used to be self-hosted and free, but now it's mostly something you pay for. I just pay for it and yeah, it's great.

Re: Ask HN: What password managers can you recommend?

#62

Post by brycewray »

tcfhgj wrote: post #60
brycewray wrote: post #40

If you can handle what I call[0][1] "the KeePass way": on desktop, KeePassXC (Windows/macOS/Linux) on desktop; on mobile, KeePass2Android or Keepassium (iOS). [0]: https://www.brycewray.com/posts/2021/06/two-paths-password-m... [1]: https://www.brycewray.com/posts/2021/08/1password-hits-fan/

In my experience Keepass2Android has very bad usability on Android compared to Bitwarden

Am not an Android user, so in that app's case I was relying on the many favorable comments I've seen about the app here and on appropriate places on Reddit.

Re: Ask HN: What password managers can you recommend?

#63

Post by tcfhgj »

benbristow wrote: post #33
tcfhgj wrote: post #13

Earlier quoted context omitted.

I use Bitwarden, but the lack of auto type on Desktop as well as the limited selection of symbols of the password generator annoys me a lot

What symbols do you want? Kanji and Russian Cyrillic also? The limited subset is that they're easily typeable on a normal English keyboard without having to resort to on-screen keyboards or alt sequences.

from KeePass at least:

- Upper-case

- Lower-case

- Digits

- Minus

- Underline

- Special

- Brackets

Re: Ask HN: What password managers can you recommend?

#64

Post by jrockway »

ryandvm wrote: post #58

Am I the only one that thinks that password managers are a terrible idea? Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong? The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code fro…

Yes, you're pretty much the only one that thinks password managers are a terrible idea. The alternative is using the same password on every site, which is proven not to work. Even ignoring breaches, you're sending the administrators of your favorite forum or whatever your email password. That rarely ends well.

If you generate random 16 character passwords and commit them to memory for every site (likely thousands you'll encounter over your lifetime), then fine, you don't need a password manager. For most other humans, it's a net win.

Having said that, passwords are a fundamentally flawed idea. Everyone should be using WebAuthn. Password managers turn "something you know" into "something you have". Webauthn skips the guessable backdoor and just goes right to "something you have". Much safer, and much easier to use!

Re: Ask HN: What password managers can you recommend?

#65

Post by basseq »

computershit wrote: post #53
basseq wrote: post #50

Earlier quoted context omitted.

Note that master passwords were not compromised, the the warnings were triggered in error[1]. That's not to say that other concerns around security aren't valid. [1] https://www.theverge.com/2021/12/28/22857485/lastpass-compro...

The warnings might have been triggered in error, but the evidence is certainly there for masters to have been compromised. Until recently their publicly available support forum running phpBB was using the master password for customer logins.[1] [1] https://news.ycombinator.com/item?id=29706579

I'm trying to differentiate between "there has been evidence of a breach" and "there are less-desirable security practices". As I understand it, the phpBB / master password practices—which are indeed, not good, but also not fully understood exactly how they did it—are also not evidence that the masters have been compromised.

Again, that it could be an attack vector is interesting and relevant, but different from "has been breached" per OP.

Re: Ask HN: What password managers can you recommend?

#66

Post by politelemon »

I can recommend not using an online password manager. When it comes to a sensitive set of information, the first step in a terrible experience is giving another entity control of that set of information. Offline password managers have a reduced risk due to the not-always-on nature and your own control over its syncing.

So your choice of KeePass is pretty good. There is KeePass2 which is by the original author of the KDBX format. There is KeePassXC which is an alternative. KeePass2 has a lot of community plugins if that's what you're after.

Re: Ask HN: What password managers can you recommend?

#67

Post by politelemon »

ryandvm wrote: post #58

Am I the only one that thinks that password managers are a terrible idea? Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong? The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code fro…

I think you're mixing a few aspects of a password management solution. Not all password managers are online (LastPass). Not all password managers require an extension.

If you use an offline password manager you don't need to use a browser extension. If your password manager requires a browser extension, it's increasing the risk profile.

Password managers are not a terrible idea. Certain implementations of password managers are a terrible idea.

Re: Ask HN: What password managers can you recommend?

#68

Post by firepacket »

ryandvm wrote: post #58

Am I the only one that thinks that password managers are a terrible idea? Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong? The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code fro…

This is a huge problem.

How do we reliably be sure we are entering credentials in the right place?

I am thinking we need to look at a bunch of different factors, but what?

Re: Ask HN: What password managers can you recommend?

#70

Post by firepacket »

I believe the most popular password managers have been cracked already, that is why I did a LOT of research and built my own.

It was not easy, but it was fun, and if anyone wants to decrypt my files they have a lot of difficult hurdles to jump through.

Of course, keylogging is easier, but then they still have to run my software or at least seriously read the source code.

Post reply on HN