Evaluation of five password managers • Hacker News Board

Re: Evaluation of five password managers

#101

Post by tanderson92 » Fri, Dec 21, 2018, 11:52 PM UTC

zeveb wrote: post #81

zmmmmm wrote: post #52

In the end I've just been using the Unix pass password manager [1]. It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand. [1] https://www.passwordstore.org/

My one concern with pass is that it doesn't encrypt filenames; it's a real pity, as that's an information leak itself.

Have you tried to use pass-tomb?

Re: Evaluation of five password managers

#102

Post by zmix » Sat, Dec 22, 2018, 12:02 AM UTC

I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

Re: Evaluation of five password managers

#103

Post by woolvalley » Sat, Dec 22, 2018, 12:05 AM UTC

tmikaeld wrote: post #98

VectorLock wrote: post #28

I like the functionality comparison but I'm really curious how they stack up to each other security wise.

Bitwarden recently completed a 3rd party Audit[1] and Bitwarden is the only one to be completely open source[2] (server and client). [1] https://blog.bitwarden.com/bitwarden-completes-third-party-s... [2] https://github.com/bitwarden/

It also has pretty much zero automated (unit, integration, etc) tests as of a few weeks ago.

Re: Evaluation of five password managers

#104

Post by abrowne » Sat, Dec 22, 2018, 12:11 AM UTC

zmix wrote: post #102

I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

If you want the Qt one, make sure to use KeyPassXC, the active fork of KeePassX.

https://keepassxc.org/

Re: Evaluation of five password managers

#105

Post by faitswulff » Sat, Dec 22, 2018, 12:11 AM UTC

Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub:

> ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later, and just a few days after that the fix was released to the public.

Re: Evaluation of five password managers

#106

Post by JJseiko » Sat, Dec 22, 2018, 12:15 AM UTC

If someone is still looking for a good one, I use Keepass and can very much recommend it.

Re: Evaluation of five password managers

#107

Post by Shoelace68 » Sat, Dec 22, 2018, 12:18 AM UTC

zmix wrote: post #102

I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

When I migrated from Ubuntu to mac os, I started using macpass, for convenience, and in order to avoid decrypting my passwords when switching to another password manager. Macpass is free, fully compatible with keepass and has on top of it, a much nicer UI than keepass on Linux or Windows.

https://macpassapp.org

Re: Evaluation of five password managers

#108

Post by jopsen » Sat, Dec 22, 2018, 12:20 AM UTC

rrdharan wrote: post #68

CiPHPerCoder wrote: post #42

I'm surprised there was no mention of recent security audits. BitWarden just famously had one.

1Password cites several on their support page: https://support.1password.com/security-assessments/

Did you click on the "full report" links, those are just simple page attestations.

The latest appears to be a private bug bounty program, where 9 high priority issues were discovered. Who knows what they where, or whether any of the low priority issues should have been classified differently.

Without transparency, we just trust an empty attestation.

Re: Evaluation of five password managers

#109

Post by jopsen » Sat, Dec 22, 2018, 12:21 AM UTC

woolvalley wrote: post #103

tmikaeld wrote: post #98

Earlier quoted context omitted.

Bitwarden recently completed a 3rd party Audit[1] and Bitwarden is the only one to be completely open source[2] (server and client). [1] https://blog.bitwarden.com/bitwarden-completes-third-party-s... [2] https://github.com/bitwarden/

It also has pretty much zero automated (unit, integration, etc) tests as of a few weeks ago.

But you only know that because you can see the source.

Re: Evaluation of five password managers

#110

Post by stcredzero » Sat, Dec 22, 2018, 12:28 AM UTC

abrowne wrote: post #104

zmix wrote: post #102

I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

If you want the Qt one, make sure to use KeyPassX C , the active fork of KeePassX. https://keepassxc.org/

I use keepassxc on MacOS, Windows, Linux, along with MiniKeePass on iOS. It's synced through my free Dropbox account. I just make sure to set the preferences so that every change to the key database results in a file save.