How will this integrate with passwordless infrastructure? Isn’t that the way we are going?
1Password for Linux beta
121–130 of 254 posts
Re: 1Password for Linux beta
#122It blows my mind how you can be smart enough to use Linux and still use a proprietary closed source "password manager" on it. If it was something unimportant, like a game, ok. But a password manager? The key to all your digital life and secrets... And in addition from an American company that will upload your (encrypted) passwords to a cloud in US? And in addition, I find it deceptive that they try to confuse the pot…
It is worth mentioning that even if you're using an open source manager like Bitwarden, unless you're compiling your own apps and servers you're not really guarenteed to be running the code they host on github.
Unless you lovingly hand-entered all the 1s and 0s for your compiler, you may not even be able to trust anything: https://www.cs.cmu.edu/~rdriley/487/papers/Thompson_1984_Ref...
Re: 1Password for Linux beta
#123The reasonable person inside me wants to use a password manager, yet the paranoid in my brain is terrified. I read all those texts explaining why password managers are better, yet I am still afraid. I keep thinking in attack vectors such as someone compromising the Play Store and submitting a malicious app or other similar stuff. I even have a Bitwarden account and have some passwords stored on it. I also considered…
What's your baseline? While there are theoretically more secure alternatives to using a password managers, the vast majority of people don't have the discipline or skill to implement them effectively. Password managers make security tradeoffs, providing a nice balance of convenience and defense against many of the most important attack vectors. So while it of course possible to come up with basically endless possible…
> the vast majority of people don't have the discipline or skill to implement them effectively.
I'd go so far as saying -- most people who think they have the discipline and skill, don't. Or rather, maybe they have it maybe for a few passwords (email, online banking, work, machine passwords).
But it's almost impossible to do well once you cross ~20 passwords. Remember trying out Goodreads years ago? Well, turns out someone's hacked into your account and is posting reviews critiquing travel books for not buying into Flat Earth Theory. You only notice when searching for your name on Google. Or even nastier scenarios.
Re: 1Password for Linux beta
#124The reasonable person inside me wants to use a password manager, yet the paranoid in my brain is terrified. I read all those texts explaining why password managers are better, yet I am still afraid. I keep thinking in attack vectors such as someone compromising the Play Store and submitting a malicious app or other similar stuff. I even have a Bitwarden account and have some passwords stored on it. I also considered…
You aren't the only one. Those "fancy" apps are too complex IMO to be trustworthy. Neither are other people's computers (aka clouds). My secrets are stored in plain text files which are encrypted with GnuPG. Emacs (and vi too) can handle encrypted files easily, even on an Android device using the Termux (i.e. Debian) app. Syncing with rsync (even version control software is an option) works and with a bit discipline…
This is literally what pass(1) does. Although it's rather fun to write a bunch of shell scripts that provide equivalent functionality.
Re: 1Password for Linux beta
#125Unpopular opinion: using a password manager as a service is as bad as password reuse: all your passwords behind a single password.
You're totally right. As long as you have a different, secure password for every site and service, and you keep a careful list of all of them, and make sure to keep this list backed up, and encrypted, and sync this list across your devices so you have access to it when and where needed, then you totally don't need a password manager.
...oh wait, that's literally a password manager. Sometimes opinions are unpopular for good reasons.
Re: 1Password for Linux beta
#126I've been using gnupass for a few years after using LastPass. I couldn't be happier. I control the codebase and all changes made to my password store via my gpg key. It's easy to use, easy to store on multiple repositories.
Re: 1Password for Linux beta
#127How will this integrate with passwordless infrastructure? Isn’t that the way we are going?
1pass can store arbitrary keys, not just passwords. Also, we're a long, long way from that being reality.
Re: 1Password for Linux beta
#128The reasonable person inside me wants to use a password manager, yet the paranoid in my brain is terrified. I read all those texts explaining why password managers are better, yet I am still afraid. I keep thinking in attack vectors such as someone compromising the Play Store and submitting a malicious app or other similar stuff. I even have a Bitwarden account and have some passwords stored on it. I also considered…
> I also considered "offline" managers like KeepassXC, but synchronization gets way worse, and there's also the issue about trusting someone else with your mobile apps. I'm using KeePassXC. Originally between three computers (Debian desktop, Debian laptop, and Microsoft laptop) where it was part of my git repo that I'd sync in between the machines as needed (git repo hosted within my own instance of gitolite, btw). I…
This is one great setup, and you can change KeepassXC for any other thing, eg. https://www.passwordstore.org/
Re: 1Password for Linux beta
#129Oh good it's another Electron app and since there are only about 50 random dependencies mentioned in the package.json maintained by about 25 random people, exfiltration of all your passwords is only one of those being compromised away at any given point. And that is just the direct dependencies, I don't even want to look at the tree of it all. If you trust 1password with your passwords, really you are also trusting w…
The article says that it's written in rust, and also implies that it is a gtk app. That doesn't sound like an electron app to me. Did I miss something?
It's definitely an electron app. It may incorporate some rust code as well, but it also rolls in approximately the entire Chrome codebase. The decompressed AppImage is 208MB, which is mostly chrome (electron) by size.
Re: 1Password for Linux beta
#130Earlier quoted context omitted.
Playing devil's advocate here, but the service fee (at least to my mind) is more for the maintenance & upkeep of the infra. I'd gladly move to self-hosting if it was only me. But after a few months, I was able to convince my wife to use it for convenience and security. So if there's an issue with the self-hosted version, it wouldn't just be me impacted, but my wife. And that's an SLA you don't wanna break. :D Also, w…
Haha, those are great points. However, if you make $50/hour and it takes any where close to an hour to install 1Pass, you're overpaid!! The install is super simple. Setting up the passwords is an ongoing thing and something I consider outside of the initial setup of the self-hosted version.
Ha! I was referring to a self-hosted password manager. I looked at keepass some long time ago (in internet time anyways, likely 4ish years ago), and after starting to get things hooked up and trying to demo it for the spouse, I realized that it wasn't worth my time.
I'm 1000% behind them existing and am planning to toss them a donation cause I like that these FOSS alternatives exist, but I'd rather not have to manage my own in the end.
I've gotten past the stage of wanting to do it all on my own and hit the point where I'd rather pay a company to do it so I can go about the things I want to do in my free time (hobbies and spending time with my kids). I know it means I'm potentially trading privacy for this convenience, but it's something I've accepted in this case.
My new campaign is convince the spouse that we should move away from free email into paid.