Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: What password managers can you recommend?

news.ycombinator.com

Post reply on HN
Print view View original

101–110 of 136 posts

Re: Ask HN: What password managers can you recommend?

#101

Post by madmonk »

I've been working on a concept where, instead of storing passwords in a manager I use a generator that creates pseudorandom passwords based on a few, easy to remember things. It's essentially a hashing algo created in javascript. You provide a site name, a password length and a pin code and it will consistently generate the same pseudorandom string. Nothing is stored and the generator can be publicly hosted.

https://github.com/madmonk13/keymaster

This is the first time I've publicly shared it and I welcome your feedback.

Re: Ask HN: What password managers can you recommend?

#102

Post by sliken »

torstenvl wrote: post #95
sliken wrote: post #82

Earlier quoted context omitted.

How so? It's easy to run vault warden if you want local, and their android app supports connecting to your local vault warden. You can also export your data. How could they be less user-hostile?

BitWarden is server-based and not local-first. Stop trolling for software that does not meet the parameters of the OP just because you disagree with those parameters.

Er, not sure how I'm disagreeing or trolling. You claim I'm trolling without mentioning specifically why. Which parameter of the OP isn't being met?

You can install the android bitwarden, which maintains a local DB. You can use it offline, and you can sync as you need with a server as needed or never at all. Which fits my definition of "local first". To double check I just put my phone in airplane mode, opened my local vault, and saw my password DB, which I could edit.

You can sync by telling it to, and there's plugins for all major browsers. You can use a bitwarden provided server, run your own, or not have one. You can export and sync via dropbox, icloud, syncthing, etc. Not sure why you would do that instead of clicking sync and letting the client upload to your own server or a bitwarden server.

Not sure how this could be consider user hostile. The rust server in particular is open source, single command to install, runs happily in provided docker container, etc. Exports are available in .json, or .csv. You can export from a web vault, browser extension, desktop client, mobile, or even command line.

I'm not trolling, I use bitwarden on android, and vaultwarden (rust server compatible with warden) on the server and it works great. I'm quite fond of it's security, track record, security assessments, open source, SOC certifications etc. I also like having the local DB on a device I control and doesn't depend on any cloud, remote server, etc so I can have my password db accessible without any internet access.

Re: Ask HN: What password managers can you recommend?

#103

Post by detaro »

sliken wrote: post #102
torstenvl wrote: post #95

Earlier quoted context omitted.

BitWarden is server-based and not local-first. Stop trolling for software that does not meet the parameters of the OP just because you disagree with those parameters.

Er, not sure how I'm disagreeing or trolling. You claim I'm trolling without mentioning specifically why. Which parameter of the OP isn't being met? You can install the android bitwarden, which maintains a local DB. You can use it offline, and you can sync as you need with a server as needed or never at all. Which fits my definition of "local first". To double check I just put my phone in airplane mode, opened my loc…

not that calling that "trolling" is exactly appropriate, but OP is clearly asking for sync over standard file sync methods, without having to run any extra server software, and "but you can export/import every time" is not exactly a good way of doing that...

Re: Ask HN: What password managers can you recommend?

#104

Post by sliken »

detaro wrote: post #103
sliken wrote: post #102

Earlier quoted context omitted.

Er, not sure how I'm disagreeing or trolling. You claim I'm trolling without mentioning specifically why. Which parameter of the OP isn't being met? You can install the android bitwarden, which maintains a local DB. You can use it offline, and you can sync as you need with a server as needed or never at all. Which fits my definition of "local first". To double check I just put my phone in airplane mode, opened my loc…

not that calling that "trolling" is exactly appropriate, but OP is clearly asking for sync over standard file sync methods, without having to run any extra server software, and "but you can export/import every time" is not exactly a good way of doing that...

A bit hard to guess without knowing the use case and reasoning. Keeping 10 devices synced on a DB that changes often = poor. Protection against some cloud service going down and leaving you stranded seems reasonable. Every server/cloud could explode, decide to charge me $1m a year, or be confiscated by the government and I could still use my phone and then export it to use a 2nd standalone device if I needed to. Even transfer it over USB if needed.

But even with 10 devices and a fast changing DB, using rsync or similar sounds pretty painful. Not sure where the ground is that good for rsync, but bad for import/export. I've friends that are particularly security conscious and only sync sometimes, and only over a VPN... but use bitwarden.... just like they would if they used rsync.... which you could use.

Re: Ask HN: What password managers can you recommend?

#105

Post by torstenvl »

sliken wrote: post #102
torstenvl wrote: post #95

Earlier quoted context omitted.

BitWarden is server-based and not local-first. Stop trolling for software that does not meet the parameters of the OP just because you disagree with those parameters.

Er, not sure how I'm disagreeing or trolling. You claim I'm trolling without mentioning specifically why. Which parameter of the OP isn't being met? You can install the android bitwarden, which maintains a local DB. You can use it offline, and you can sync as you need with a server as needed or never at all. Which fits my definition of "local first". To double check I just put my phone in airplane mode, opened my loc…

BitWarden's architecture requires a server when there is no technical reason to require one. That enforces a dark pattern whereby users must either (a) acquiesce to BitWarden owning their password database or (b) go through the pain of running their own dedicated server.

You say you are "Not sure why [I] would do that instead of..." This is exactly my point. You fundamentally disagree with my requirements.

I'm genuinely, sincerely glad that BitWarden works well for you. It doesn't work well for me because it is not local-first and requires a server. As a result, all these BitWarden posts are off-topic for the OP.

If you have a recommendation that meets the criteria in the OP, I'd be very grateful to hear it. However, please don't come here just to get all fighty and argue that my requirements are wrong.

Re: Ask HN: What password managers can you recommend?

#106

Post by sliken »

jstx1 wrote: post #85
tcfhgj wrote: post #63

Earlier quoted context omitted.

from KeePass at least: - Upper-case - Lower-case - Digits - Minus - Underline - Special - Brackets

In the Bitwarden password generator you can use uppercase, lowercase letters, digits and !@#$%^&*. Is the lack of brackets or a minus really an issue for you?

Does seem weird to ignore []{}-_,()'`"

Re: Ask HN: What password managers can you recommend?

#107

Post by sliken »

silisili wrote: post #38
bloopernova wrote: post #25

Bitwarden can be self-hosted. $10/year subscription cost is well, well worth it. If you don't self-host, note that everything is encrypted before being stored at bitwarden. They don't have access to your passwords.

Same. 10/yr is not worth self hosting IMO, unless for security/paranoia reasons. Having a reliable, stable PW manager with a good app and TOTP capabilities feels like a steal at that price.

Normally I'd agree, but a single docker command makes is so easy to run. I still recommend the $10/year jsut to help support them.

Re: Ask HN: What password managers can you recommend?

#108

Post by sliken »

torstenvl wrote: post #105
sliken wrote: post #102

Earlier quoted context omitted.

Er, not sure how I'm disagreeing or trolling. You claim I'm trolling without mentioning specifically why. Which parameter of the OP isn't being met? You can install the android bitwarden, which maintains a local DB. You can use it offline, and you can sync as you need with a server as needed or never at all. Which fits my definition of "local first". To double check I just put my phone in airplane mode, opened my loc…

BitWarden's architecture requires a server when there is no technical reason to require one. That enforces a dark pattern whereby users must either (a) acquiesce to BitWarden owning their password database or (b) go through the pain of running their own dedicated server. You say you are "Not sure why [I] would do that instead of..." This is exactly my point. You fundamentally disagree with my requirements. I'm genuin…

Er, I don't understand. You install bitwarden on your phone, you use it, never use a server. Not even required to have internet. The app isn't some crippled client, it can create a vault, encrypt the vault, edit the vault, etc. No cloud or server is required, only if it's useful for you to sync with other devices.

Seems weird to call it a dark pattern because they optionally provide a way to sync through a server to keep N clients in sync that's easier to use than trying to rsync between N clients. Having used rsync to keep a work computer, home computer, laptop, and 2 phones synced with a password DB (Keepass) for years, I greatly prefer the sync through server solution, but that's not forced on you.

Re: Ask HN: What password managers can you recommend?

#109

Post by torstenvl »

sliken wrote: post #108
torstenvl wrote: post #105

Earlier quoted context omitted.

BitWarden's architecture requires a server when there is no technical reason to require one. That enforces a dark pattern whereby users must either (a) acquiesce to BitWarden owning their password database or (b) go through the pain of running their own dedicated server. You say you are "Not sure why [I] would do that instead of..." This is exactly my point. You fundamentally disagree with my requirements. I'm genuin…

Er, I don't understand. You install bitwarden on your phone, you use it, never use a server. Not even required to have internet. The app isn't some crippled client, it can create a vault, encrypt the vault, edit the vault, etc. No cloud or server is required, only if it's useful for you to sync with other devices. Seems weird to call it a dark pattern because they optionally provide a way to sync through a server to…

No post body was provided.

Re: Ask HN: What password managers can you recommend?

#110

Post by torstenvl »

madmonk wrote: post #101

I've been working on a concept where, instead of storing passwords in a manager I use a generator that creates pseudorandom passwords based on a few, easy to remember things. It's essentially a hashing algo created in javascript. You provide a site name, a password length and a pin code and it will consistently generate the same pseudorandom string. Nothing is stored and the generator can be publicly hosted. https://…

Before I started using 1Password I used to do the same thing.
Post reply on HN