Evaluation of five password managers

Post by dmoy » Sat, Dec 22, 2018, 4:44 AM UTC

drdaeman wrote: post #133

redwards510 wrote: post #2

> Yubikey support in browser (Personal) BitWarden: no huh? I use my yubikey in the Bitwarden browser extension. Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.

"Yubikey support" is a meaningless phrase, anyway. Bitwarden supports 2FA with Yubico OTP - although there's a bug so it works only for QWERTY layouts. Or you can use Yubikey's static password feature for your master password, I guess. There's also OpenPGP Card and PIV, which, to my knowledge, is not used/supported by any password manager software except for `pass` and some compatible implementations.

Post by CiPHPerCoder » Sat, Dec 22, 2018, 5:13 AM UTC

tptacek wrote: post #120

beatgammit wrote: post #113

Earlier quoted context omitted.

Sure, but if it has been audited, it's more likely that security issues were found and resolved than if it hasn't gone through one. Our company went through an audit and did quite well, and we fixed most of the findings. However, I know for a fact that there are things we can do to improve that weren't covered. Not all audits are created equal, no audit will catch everything, and there's no guarantee that findings we…

I think Scott knows that most of these other password managers have been audited, and I know he knows audits are of varying quality and are virtually never conclusive, so I'm not sure what he's trying to say by pointing Bitwarden's audit out.

Post by philliphaydon » Sat, Dec 22, 2018, 5:57 AM UTC

faitswulff wrote: post #105

Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub: > ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later , and just a few days after that the fix was released to the public.

Post by callalex » Sat, Dec 22, 2018, 6:30 AM UTC

faitswulff wrote: post #105

Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub: > ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later , and just a few days after that the fix was released to the public.

Post by microtonal » Sat, Dec 22, 2018, 7:29 AM UTC

village-idiot wrote: post #144

dmoy wrote: post #141

Earlier quoted context omitted.

No u2f support? :(

U2f support is badly hampered by half-assed browser support. Only chrome enables it by default, Firefox disables it by default, and no love from safari. Even LastPass in the browser uses yubico’s proprietary otp algorithm rather than u2f.