https://pwsafe.org/ by Bruce Schneier
Evaluation of five password managers
131–140 of 216 posts
Re: Evaluation of five password managers
#132I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.
If you want the Qt one, make sure to use KeyPassX C , the active fork of KeePassX. https://keepassxc.org/
I use keepassx and yeah it could use some tlc, but overall I consider stability a feature in security software. How does one tell if xc isn't just a bunch of wannabes making keepassx with blackjack and hookers until they break it? At least keepassx has taviso's off-handed Twitter comment that it "looks sane".
Re: Evaluation of five password managers
#133> Yubikey support in browser (Personal) BitWarden: no huh? I use my yubikey in the Bitwarden browser extension. Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.
"Yubikey support" is a meaningless phrase, anyway.
Bitwarden supports 2FA with Yubico OTP - although there's a bug so it works only for QWERTY layouts. Or you can use Yubikey's static password feature for your master password, I guess.
There's also OpenPGP Card and PIV, which, to my knowledge, is not used/supported by any password manager software except for `pass` and some compatible implementations.
Re: Evaluation of five password managers
#134i was using dashlane for a while. The features were great, but one thing really bothered me:
On macOS everytime I opened safari it launched a dashlane.com page reminding me to install the plugin. I did not want the plugin, and after much googling never was able to prevent this behavior. I had to uninstall it.
Switched to KeepassXC, its good.
Re: Evaluation of five password managers
#135Earlier quoted context omitted.
Interesting. Lastpass works perfectly for me on Debian based Linux, and I have friends that use it on arch. I can't speak to use on other distros though.
Same, Lastpass works just just fine for me on Solus in both Firefox and Vivaldi.
I think that parent is referring to standalone apps, not in browser extensions.
Re: Evaluation of five password managers
#136i find it hilarious, hilarious i tell you, that he felt the need to put a quasi-legal disclaimer at the bottom of his medium post. i suppose it is demanded by the field he is in (investment banking) but it just strikes me as nonsense.
too bad the article is quite thin.
Re: Evaluation of five password managers
#137In the end I've just been using the Unix pass password manager [1]. It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand. [1] https://www.passwordstore.org/
My one concern with pass is that it doesn't encrypt filenames; it's a real pity, as that's an information leak itself.
I mitigated this by storing username in the gpg file itself using the 'user:' tag, while having the file named jdoe or something similar instead of a login name.
Re: Evaluation of five password managers
#138Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub: > ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later , and just a few days after that the fix was released to the public.
Nice. That's some response time.
Re: Evaluation of five password managers
#139Earlier quoted context omitted.
I use 1Password via the CLI ( https://support.1password.com/command-line/ ) on Linux (well -- FreeBSD) Desktop all the time. I wrote a wrapper for the CLI ( https://github.com/dcreemer/1pass ) to make it a bit more ergonomic to use with things like FZF. I used to use "pass" like others here, but did not like the Android experience. *edited to add: and we use the 1Password team account at my day job -- and are satisfi…
afaict, the 1password cli app is just a client for their API and has no offline mode, so if I can't reach 1password's servers, I can't access any of my secrets. I believe the browser addons do not share this shortcoming, though.
You are correct - that's the main reason I wrote the 1pass wrapper mentioned above. It mirrors the data locally (in a gpg-encrypeted cache).
Re: Evaluation of five password managers
#140In the end I've just been using the Unix pass password manager [1]. It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand. [1] https://www.passwordstore.org/
Password store is an excellent alternative to paid applications.
I have recently submitted a bug, be careful when saving a password with duplicate name (it replaces old password without warning); not sure if it has been fixed.[1]
[1]:https://github.com/zeapo/Android-Password-Store/issues/451