231–240 of 242 posts
I'm surprised there's no mention of Hashicorp Vault. Maybe a misunderstanding on my side on why they differ. Can someone care enough to explain this to me?
HashiCorp Vault solves a different problem. Password managers target the end user password management problem, whereas HashiCorp Vault targets the bootstrapping problem for servers/services.
I use Biwarden extensively, in self-hosted mode (vaultwarden), for a few years now. It is truly excellent, especially the fact that you can "move" an entry to an organization, where everyone has the same ownership and rights (and not merely "share" it). Plus a ton of wonderful things. There are two minor points I am missing: - the ability to control someone's passwords. Typical usage: the 24/7/365 support for my pare…
I've been wanting to set up vaultwarden with Docker. However the setup guide[1] uses caddy with ports 443 and 80, but I already have traefik set up with those ports, so docker-compose aborts. My docker knowledge is quite minimal, so I am unsure how (or if) I can resolve this. [1] https://github.com/dani-garcia/vaultwarden/wiki/Using-Docker...
Now - I used traefik and caddy extensively (and everything I do is in docker these days) and caddy is so much, much better than traefik.
I used traefik v1 and v2 and struggled with having an optimal configuration. With caddy it just works.
The main difference is that with traefik you usually try to squeeze your configuration in the docker-compose.yaml, but end up with a traefik configuration as well.
With caddy you have everything in a caddy file - in my case adding a service with plenty of things set up (filtering for networks etc. is a matter of adding
https://my-new-service.com { import lan container-name:PORT }
On top of that, the caddy community is great - some questions may seem simple for the ones who are used to proxies etc. but are very hard to understand for the newcomers. There are always kind guidance for these people in the forum.
I use Biwarden extensively, in self-hosted mode (vaultwarden), for a few years now. It is truly excellent, especially the fact that you can "move" an entry to an organization, where everyone has the same ownership and rights (and not merely "share" it). Plus a ton of wonderful things. There are two minor points I am missing: - the ability to control someone's passwords. Typical usage: the 24/7/365 support for my pare…
Couldn't you revoke the permission for the android app to draw on your screen? But maybe I misinterpret your comment.
Earlier quoted context omitted.
1Password has a pretty good white paper explaining their security design (PDF behind the link): https://1passwordstatic.com/files/security/1password-white-p... . The parts "How Vault Items Are Secured" and "How Vaults Are Securely Shared" go into sharing passwords in a vault. For the record, Bitwarden's white paper is a good read as well. Available at https://bitwarden.com/help/article/bitwarden-security-white-... .…
So I'm reading on pg 22. The red block. How hard is it for 1Pass --basically a mandated MITM-- to send a false request to Alice when Bob made a request? That whitepaper is a piece of marketing text. Not saying their audit did not take place. But they are soooooo powerful in their own system that they basically have access to everything. BitWarden: not so much.
Alice is the one that initiates the request. She owns the vault being shared and encrypts it with Bob's pre-shared public key.
I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember th…
Password managers are the most stupid thing, really? What better alternative do you propose?
I frankly thing password managers are the most stupid thing. We fake users inputing text to input boxes and spend crazy time figuring out how to do that and how to get around various sites trying to block that, so the site can still pretend it’s actual user inputting the password. Plus the manager needs to work around arbitrary password rules. Plus they usually don’t work at OS level; so you still need to remember th…
Password managers are the most stupid thing, really? What better alternative do you propose?
* Things you have (physically)
* Things you are
We have abstracted a thing we know, passwords, to be managed. The alternative could be multiple things we have and things we are.
So a combination of:
* physical objects, such as keys, smart phones, smart cards, USB drives, and token devices.
* fingerprint scanning, palm scanning, facial recognition, retina scans, iris scans, and voice verification, etc.
> The most trusted open source password manager for business I expected a blog article with actual feedbacks from companies and data, but ended up on bitwarden.com main page. Baseless claims can be quite common when it comes to marketing, but I'm genuinely curious: which password manager is used in your workplace, if any? I've personally never seen in my (for now short) career anything else than Keepass.
Also, I'm a happy and paying user personally.
Earlier quoted context omitted.
One suitable option is to memorize an algorithm as a password: Say, given a site, create a password as: HardcodedChars+siteName+len(siteName)+symbolInKeyboardOf(lenSiteName)+len(TLD)*N+hardcodedChars So gmail.com would be something like Chad1Gmail5%9Foo@ And then use that algorithm for generating all passwords.
What happens if siteName changes? What happens if you lose your memory? Wait was it "TransferWise" or "Transferwise" or "Wise" or "wise" or "transferwise"? I don't hate the idea, but what happens when you stumble upon a website that does not accept % in passwords, or needs less then 8 characters or one of the other random things that do exist? Then you have an algo for this, and a algo for that, you end up back at th…
What happens if you lose your KeePass file?
What happens if your password manager service goes out surprisingly, or gets hacked and someone deletes their DB?
What if, what if...!
Earlier quoted context omitted.
Couldn't you revoke the permission for the android app to draw on your screen? But maybe I misinterpret your comment.
The thing is that I still want BW to give me the possibility to choose a site to fill in (so I do need the popup). It is just that sometimes I need it out of the way, and there is no gesture for that (such as sliding it to the side for instance, or long pressing to make it go away)
Earlier quoted context omitted.
The nice thing with keepass is that you manage the password database and key yourself.
The problem with keepass is that you have to manage the password database and key yourself. (Not for most of us here, but for most people out there.)