121–130 of 216 posts
Earlier quoted context omitted.
My one concern with pass is that it doesn't encrypt filenames; it's a real pity, as that's an information leak itself.
Have you tried to use pass-tomb?
interested to know your experience good/bad/etc...I am considering installing on a vm at home to use for family.
I've been using masterpassword [1] which is stateless and requires no sync. I wonder what the HN crowd thinks of its features. Another option with the same paradigm is lesspass [2]. 1. https://masterpassword.app/ 2. https://lesspass.com/#/
A good critique of these systems is here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... , discussed on HN here: https://news.ycombinator.com/item?id=13016132 The general consensus of security experts seems to be that they're a bad idea. I think my setup using `password-store` works great, and arguably is more secure since I rotate my passwords regularly as well. The main reason I argue my system is…
Earlier quoted context omitted.
A good critique of these systems is here: https://tonyarcieri.com/4-fatal-flaws-in-deterministic-passw... , discussed on HN here: https://news.ycombinator.com/item?id=13016132 The general consensus of security experts seems to be that they're a bad idea. I think my setup using `password-store` works great, and arguably is more secure since I rotate my passwords regularly as well. The main reason I argue my system is…
Is there a technical restriction that makes yubikeys incompatible with stateless password generators or is it just that no one has implemented it yet?
If the yubikey is only used to secure the master passphrase that derives the other deterministic passwords, then relatively little has been gained because the actual derivation of the passwords happens separately and the original concerns are still largely present.
Even if the master password is secured with a yubikey, many of the other flaws are still present, and if you need a yubikey to access your passwords anyway, you might as well encrypt the passwords directly rather than going through this awkward extra step that reduces security.
Earlier quoted context omitted.
If you want the Qt one, make sure to use KeyPassX C , the active fork of KeePassX. https://keepassxc.org/
I use keepassxc on MacOS, Windows, Linux, along with MiniKeePass on iOS. It's synced through my free Dropbox account. I just make sure to set the preferences so that every change to the key database results in a file save.
I was always a bit paranoid about this, even though I did it myself.
For me an important selling point of 1Password was that their software looks like native Windows software and native iOS software while Bitwarden is just Chrome wrapper or something like that for desktop and C# for mobile and I don't want to support that kind of cross-platform software.
1Password felt like Mac/iOS software ported to other platforms.
Earlier quoted context omitted.
There's a counter on Master Password, so if the password expires or you need to change it, you just +1 and it's new. They also have settings depending on password requirements (no special characters, etc.). I'm unsure what the URL really has to do with it, you could just generate a new password for the new URL and change it.
Sometimes different URLs share credentials (LDAP). Changing isn't necessarily an option?
Earlier quoted context omitted.
How many Linux users don't have chrome or firefox installed? I think the article would be a bit more accurate to say there's not native client support for Linux.
There are applications besides web browsers that require passwords. For example, password-protected documents, or encrypted archives. A password managers that requires, or only supports, web browsers is incomplete.
Earlier quoted context omitted.
they don't make it very obvious, but note that 1password doesn't require a subscription. i use it with vaults shared and kept in sync via dropbox for example.
Same. I recently purchased an upgrade and consider it well worth the price, although I'm considering switching to the subscription model / family plan to make it easier to support my parents and in-laws. However my main concern is that you can't disable browser access when using ay of the subscription plans: https://discussions.agilebits.com/discussion/80105/cant-disa...
> Limiting the access of unencrypted passwords to only properly setup 1PW applications would seem to eliminate the possible (probable?) web based attack vector to a 1password.com account.
This doesn't make sense. What's a "properly setup 1PW application"? Presumably that's an instance of 1Password that has been given both the master password and account key for the account. But when you use the web-based portal, you have to give it, yep, the master password and account key.
Anyone who is able to access the passwords using the web portal can already set up a local instance of the 1PW application that syncs with the same account.
Ultimately, asking to "disable browser access" is basically the same thing as asking to "disable the syncing API", which would obviously defeat the entire point of having the family account.
I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.