111–120 of 216 posts
Has anyone gone through the process of switching? I use Keeper for personal stuff, and I suppose there's always the chance to switch if one turns out to be technically or politically much superior, but there are dozens and dozens of passwords in there to transfer...
Also it has no automated tests, which makes me somewhat wary.
I've been using masterpassword [1] which is stateless and requires no sync. I wonder what the HN crowd thinks of its features. Another option with the same paradigm is lesspass [2]. 1. https://masterpassword.app/ 2. https://lesspass.com/#/
There's a few issues with the master password derived password system, including: What if you need to change your password for a site to a different one? What if the site changes its URL?
This does mean that you need to remember what the version is. Fortunately this information doesn't need to be kept secret. I also have a system that generates emojis based on your settings, so as long as you remember the emoji that goes with the site, you can just increment it until you get the right one, so it's down to you whether you store the version number somewhere or remember the emoji.
I use URLs by default, but you can enter anything you want into the 'purpose' field. It's still pretty raw, but it's at https://github.com/kybernetikos/sinkless
Most of the complaints people have about deterministic systems don't really hold up in practice for me. Protecting them by 2fa would be better of course, which deterministic can't do and lots of the good password managers do, but I really dislike having to worry about syncing state beyond just emailing it to myself.
One thing that would be awesome would be if someone came up with a standard machine readable way of describing the limitations on passwords for sites (allowable characters, number of characters, any restrictions on previous values / sequences etc), and all good sites could embed that information, and poor sites could be looked up in a third-party service.
I'm surprised there was no mention of recent security audits. BitWarden just famously had one.
Many of these have had audits, not just this Bitwarden audit. There are some disquieting things in that audit, for what it's worth. I don't understand how this information is actionable. It would be worth knowing whether something has _ever_ been audited (again: most of the major password managers have been), but just knowing an audit has been done isn't sufficient to know whether it's secure.
Our company went through an audit and did quite well, and we fixed most of the findings. However, I know for a fact that there are things we can do to improve that weren't covered.
Not all audits are created equal, no audit will catch everything, and there's no guarantee that findings were patched sufficiently. However, I feel much better knowing that an audit was done, which means the author cares at least somewhat about security.
Has anyone gone through the process of switching? I use Keeper for personal stuff, and I suppose there's always the chance to switch if one turns out to be technically or politically much superior, but there are dozens and dozens of passwords in there to transfer...
https://www.enpass.io/docs/desktop-windows/import_export.htm...
Earlier quoted context omitted.
If you want the Qt one, make sure to use KeyPassX C , the active fork of KeePassX. https://keepassxc.org/
I use keepassxc on MacOS, Windows, Linux, along with MiniKeePass on iOS. It's synced through my free Dropbox account. I just make sure to set the preferences so that every change to the key database results in a file save.
...so it's not like this app is unheard of, per this thread's parent comment. Super odd that they didn't include it haha
Earlier quoted context omitted.
You're forever locked into Google Chrome! I realize this is becoming an increasingly minor problem in the modern world, but it still bothers me. I don't know what future situations I'll find myself in, and I don't want to be locked out of all my accounts. • What if a new browser comes out that's actually better than Chrome? (I don't want to admit to myself how unlikely this actually is.) • What happens if I'm using a…
I recently starting using Firefox again, and getting my passwords out of Chrome was by far the most difficult part of the process for me. A few things I learned: Chrome has a feature to export passwords to a CSV file, but I had to enable it via a chrome:flag, so who knows if/when support for this will disappear. This created a bit of a sense of urgency for me, as Google aggressively removes features that they don't w…
EDIT: Oh, you probably didn't mean getting them out and into firefox, you probably wanted to use something different to avoid the same issue (but with firefox) if you switch browsers again in the future.
I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.
When I migrated from Ubuntu to mac os, I started using macpass, for convenience, and in order to avoid decrypting my passwords when switching to another password manager. Macpass is free, fully compatible with keepass and has on top of it, a much nicer UI than keepass on Linux or Windows. https://macpassapp.org
Given macOS's security track record - especially with High Sierra - and how particularly verbose Mach-O binaries tend to be, I'd be kinda worried about something relying so heavily on proprietary APIs (and potentially the system keystore?) Though I'm sure using Keepass with Mono (that the Macpass site lightly implies is the only Keepass macOS alternative) isn't exactly an impenetrable fortress either haha
Got that Hopper license around here somewhere...
Earlier quoted context omitted.
Bitwarden recently completed a 3rd party Audit[1] and Bitwarden is the only one to be completely open source[2] (server and client). [1] https://blog.bitwarden.com/bitwarden-completes-third-party-s... [2] https://github.com/bitwarden/
It also has pretty much zero automated (unit, integration, etc) tests as of a few weeks ago.
What did you find changed in lastpass after the logmein acquisition? We've been using lastpass since before the acquisition, and i can't say i've noticed any substantial changes (either positive or negative)
Earlier quoted context omitted.
Many of these have had audits, not just this Bitwarden audit. There are some disquieting things in that audit, for what it's worth. I don't understand how this information is actionable. It would be worth knowing whether something has _ever_ been audited (again: most of the major password managers have been), but just knowing an audit has been done isn't sufficient to know whether it's secure.
Sure, but if it has been audited, it's more likely that security issues were found and resolved than if it hasn't gone through one. Our company went through an audit and did quite well, and we fixed most of the findings. However, I know for a fact that there are things we can do to improve that weren't covered. Not all audits are created equal, no audit will catch everything, and there's no guarantee that findings we…