1Password and the Crypto Wars • Hacker News Board

Re: 1Password and the Crypto Wars

#51

Post by MacsHeadroom » Sat, Sep 07, 2013, 10:31 AM UTC

laurent123456 wrote: post #24

SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.

KeepPass2 is actually built on Mono, the open source multi-platform .net clone. It just happens to work with M$ .net.

I have it running on OS X, Linux, Android and Windows, all at the same time, while singing changed across platforms with secure Web Dav based cloud storage. Took me 20 min to set up on all four devices.

As someone who had their passwords leaked by an attack against one of the largest commercial password safes just a few years ago (heard of pwnedlist or the LastPass beaches?) I have been happily using KeePass as amuch more secure FOSS alternative with equal (if not more) functionality ever since, without any hangups to speak of.

Re: 1Password and the Crypto Wars

#52

Post by logn » Sat, Sep 07, 2013, 10:46 AM UTC

AgileBits, if you're not not ok, then blink twice.

Re: 1Password and the Crypto Wars

#53

Post by bowlofpetunias » Sat, Sep 07, 2013, 10:48 AM UTC

SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

KeePass is utterly unusable for ordinary users. Especially on non-Windows platforms, where it takes voodoo to make it even run.

Re: 1Password and the Crypto Wars

#54

Post by StavrosK » Sat, Sep 07, 2013, 10:57 AM UTC

bowlofpetunias wrote: post #53

SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

KeePass is utterly unusable for ordinary users. Especially on non-Windows platforms, where it takes voodoo to make it even run.

Really? I use KeePassX on Linux and it literally could not be easier. I just enter my passphrase and my password file opens up, there's not much more to it.

EDIT: Apparently KeePass and KeePassX are different?

Re: 1Password and the Crypto Wars

#55

Post by scrrr » Sat, Sep 07, 2013, 11:02 AM UTC

“I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” (Assuming being a Canadian company counts..)

Re: 1Password and the Crypto Wars

#56

Post by fauigerzigerk » Sat, Sep 07, 2013, 11:26 AM UTC

SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

I agree that using anything non-opensource for this particular purpose makes no sense whatsoever.

But when I tried keepass a few months ago (maybe a year) I wasn't able to get it running properly on the Mac. Half the UI was somehow missing.

I'm using a simple text file stored in a truecrypt drive.

Re: 1Password and the Crypto Wars

#57

Post by deckiedan » Sat, Sep 07, 2013, 12:11 PM UTC

jl6 wrote: post #27

laurent123456 wrote: post #24

Earlier quoted context omitted.

Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.

I use KeepassX on Linux, Windows and Android.

I have been using KeepassX for years on Linux, Android and OSX. No problems anywhere. Yes, the interface isn't the most '2013 flat UI webapps' whatever, but it's simple, and works.

We're currently moving our office over to KeepassX for our lists, also iOS clients, Windows and for a while I had it quite happily on my java feature-phone. (Entering the master password on the feature-phone was a bit fiddly though...)

Re: 1Password and the Crypto Wars

#58

Post by eknkc » Sat, Sep 07, 2013, 12:22 PM UTC

SCdF wrote: post #21

In for a penny, in for a pound. If you care about security enough to use a password safe you might as well also use an open source solution that has even a remote chance of having its code looked at by more people than the ones trying to sell it to you. I mean, I know 1Password is all pretty and animated and things, but things like KeePass aren't so ugly as to be unusable.

I used both KeePass and 1Password is not just about the pretty interface as you make it to be. Entire UX is much better.

Also, even if some 3rd party looked at the code, it doesn't really matter because they are really transparent about the file storage format, there are even some open source cli tools to extract data. Also it is a fact that no data leaves your control. No server side storage or something like that.

I believe 1Password has a great model for a closed source password manager here.

KeePass had been really unreliable and I could not just trust it to store anything. Maybe I should give it another shot. LastPass and other "server side" storage services are not even an option for me though.

Re: 1Password and the Crypto Wars

#59

Post by clebio » Sat, Sep 07, 2013, 12:49 PM UTC

lwhalen wrote: post #26

laurent123456 wrote: post #24

Earlier quoted context omitted.

Unfortunately, the developer of Keepass has made the choice of using .NET for development, which means it's pretty much Windows only. There are some non-official clients for Mac OS X and Linux but they don't work great (missing features like auto-completion or browser integration). I'm still using Keepass on these platforms though, but I can see how a truly cross-platform solution like 1Password is appealing.

Does 1Password have a Linux client? Looking at their page, they appear to only support Mac, Windows, iOS, and Android.

No, but it runs fine using Wine. I created a shell script to launch it with a key-stroke. If you want browser integration, you can run Firefox in Wine as well (or Chrome).

Re: 1Password and the Crypto Wars

#60

Post by clebio » Sat, Sep 07, 2013, 12:53 PM UTC

scrrr wrote: post #55

“I would strongly recommend against anyone trusting their private data to a company with physical ties to the United States.” (Assuming being a Canadian company counts..)

Is that a quote from the article, or do you just use quotes for emphasis of your own words?