Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for Linux beta

blog.1password.com

Post reply on HN
Print view View original

151–160 of 254 posts

Re: 1Password for Linux beta

#151

Post by mekster »

xienze wrote: post #22
tw04 wrote: post #15

Earlier quoted context omitted.

Requisite: Use bitwarden-rs if you're planning on self-hosting. https://github.com/dani-garcia/bitwarden_rs

Yes, this is a fantastic project. The official Bitwarden Docker image is kind of wonky, it needs some sort of license and you have to generate the docker-compose.yml, etc. It really doesn't make for a good automated process at all. bitwarden_rs on the other hand, works just fine, never had an issue with it or incompatibility with the browser extensions or mobile apps.

The "rs" project is too good to be true.

The official one uses MS SQL server and takes quite a bit of memory (which I call it a hidden monthly cost as I need to be using a bigger cloud instance) but this one only takes so little, you can host it on any cheap VPS and it has been working just fine against official clients for years.

Re: 1Password for Linux beta

#152

Post by 29athrowaway »

luhn wrote: post #68
29athrowaway wrote: post #56

Earlier quoted context omitted.

Using a password manager is a good idea. Using a password manager as a service is my point of contention.

You still haven't substantiated your opinion in any way.

Because it's a service many things can happen.

Hacking aside... these are many ways in which it can go wrong:

- There can be an outage and you get locked out of your keys. You can have a connectivity issue to the service.

- The service can be discontinued or they could randomly terminate your account based on some automated system decision by mistake, sometimes with no right to appeal...

- They can change leadership and start mismanaging the service, or start selling your data like the services you use and such.

- They can start cutting corners and rushing unsafe things live.

- They can offshore all their development and reboot the team somewhere cheaper, at the expense of introducing defects during the transition.

- They can be ordered by a government to have a backdoor.

- There can be disgruntled employees, infiltrators, bad hires, malicious employees, etc...

And finally, they're a famous service that is known to have the keys to many other systems. This makes it very lucrative for a black hat to attempt to hack them. Even smart, dedicated people are not safe from 0day vulnerabilities that nobody know they exist.

Many things can go wrong. And what happens when they do? you can get locked out of essential services you need, or someone can ruin your life, force you to pay a ransom or even make you homeless if they wanted to.

Then, there are other aspects I don't like much. You can set a secure password, but then your browser will ask you to remember it. Some services allow you to skip MFA in a trusted computer... so then all your stuff is simply behind physical access to one of the trusted devices.

I don't know, it just doesn't feel right to me.

And by the way: I started by saying it's an opinion. It's an unpopular, provocative opinion, but I was honest enough to communicate it was indeed an opinion. I did not say it was a fact. Opinions are subjective, facts are not.

Re: 1Password for Linux beta

#153

Post by mekster »

dyingkneepad wrote: post #97

The reasonable person inside me wants to use a password manager, yet the paranoid in my brain is terrified. I read all those texts explaining why password managers are better, yet I am still afraid. I keep thinking in attack vectors such as someone compromising the Play Store and submitting a malicious app or other similar stuff. I even have a Bitwarden account and have some passwords stored on it. I also considered…

You could use Enpass just on your own computer. You can also sync it online to have it synched to your mobile device too.

Re: 1Password for Linux beta

#155

Post by eightails »

mooman219 wrote: post #91
dastx wrote: post #81

Earlier quoted context omitted.

Bitwarden is great, but I'm getting frustrated at their ridiculous excuses for not implementing fixes. For the longest time bitwarden has been broken in the firefox's private browsing after mozilla deprecated some apis due to security concerns. They've given alternatives but they are just refusing to fix it, to the point of basically saying mozilla needs to fix the issue. What's sad is a similar mechanism is used in…

+1 on 1Password's dedication to fixing issues. I had an obscure field selection issue on their web view and pinged the support email. It was fixed a few days later and they updated me on it. I switched to 1Password from KeePass after 5 or so years because I just got tired of maintaining the data locally and keeping it in sync on my devices that I need the passwords on. I just backup the 1Password database locally now…

Is there any reason not to host a Keepass database on any generic cloud service? That's what I'm doing at the moment. I've never encountered any sync issues or conflicts, and take backups every now and then in case that happens.

Re: 1Password for Linux beta

#156

Post by gilrain »

ed25519FUUU wrote: post #147

I still can’t bring myself to pay $5 a month in perpetuity for a password manager. None of these saas companies ever price single user licenses below $5, even though $1 or $2 would be much more reasonable.

Listening to music costs $10 per month. Netflix is $15. Surely securing the keys to your digital life is worth at least $5.

Re: 1Password for Linux beta

#157

Post by mekster »

TheDong wrote: post #33
stefan_ wrote: post #7

Oh good it's another Electron app and since there are only about 50 random dependencies mentioned in the package.json maintained by about 25 random people, exfiltration of all your passwords is only one of those being compromised away at any given point. And that is just the direct dependencies, I don't even want to look at the tree of it all. If you trust 1password with your passwords, really you are also trusting w…

> exfiltration of all your passwords is only one of those being compromised away at any given point No, that's absolutely not true. Those dependencies will not automatically update in your local app. The 1password developers should be auditing all updates to those dependencies too, and if you trust the 1Password developers to be competent, then you don't have to trust 25 random developers. Furthermore, this isn't uni…

> The 1password developers should be auditing all updates to those dependencies too

This is just wishful thinking unless there's a public security audit against a specific version.

Funny you bring about blind trust when talking about a security sensitive app.

Re: 1Password for Linux beta

#158

Post by jerieljan »

copperx wrote: post #117
satysin wrote: post #34

Earlier quoted context omitted.

Agreed. I have been using Bitwarden for over 3 years now, paid premium user as well. No big issues, the odd bug a few times but all fixed promptly and didn't impact my ability to access my data. While the Bitwarden apps are not as "pretty" as 1Password's I find them a little simpler to use. Obviously UI design is highly subjective though so your thoughts may be very different :) Anyway yes I highly recommend Bitwarde…

While almost everything is great about Bitwarden, the 5-8 second delay when performing a search is ridiculous (considering I have about 100 records), and I'm considering paying for a better maintained alternative.

This is very strange. I have over 480 and never experienced delays in anywhere (MacOS, Android, iOS). Searches only take a second or two once you've started typing in two characters in the search box.

Re: 1Password for Linux beta

#159

Post by thamer »

shmerl wrote: post #132
dyingkneepad wrote: post #89

Earlier quoted context omitted.

It's not a very direct alternative. 1password uses a server and keeps everything in sync for you automagically, while on KeepassXC you have to sync your devices yourself (with some help from them). The more open source alternative would be the aforementioned Bitwarden.

I think managing your devices sync yourself is an upside, since you can establish yourself to where you sync and how. But it is more complicated to set up as a downside.

Having to sync passwords manually sounds like a hassle.

With 1Password all my credentials are on all my devices, always up to date. It integrates with the password management APIs on iOS so I can create an account on a computer and log in using this same service's app on my phone seconds later and the password will already be there, I just have to stare at the device for a second and I'm logged in.

It's all incredibly seamless and I can't imagine having to go back to managing passwords manually.

Re: 1Password for Linux beta

#160

Post by eigenspace »

29athrowaway wrote: post #152
luhn wrote: post #68

Earlier quoted context omitted.

You still haven't substantiated your opinion in any way.

Because it's a service many things can happen. Hacking aside... these are many ways in which it can go wrong: - There can be an outage and you get locked out of your keys. You can have a connectivity issue to the service. - The service can be discontinued or they could randomly terminate your account based on some automated system decision by mistake, sometimes with no right to appeal... - They can change leadership…

Regarding outages, services such as 1Password allow you to locally save your keys. An outage might interrupt synchronization, but you won't lose access.

As far as the other concerns, I'd say these concerns are all present in the 'single password re-use' strategy as well, except instead of choosing one single company to trust over your stuff, you now have to trust every single website you log into to safeguard your passwords, lest a malicious actor gets access to everything.

I agree there are downsides to services, but I disagree very strongly that the situation with services are no better than just re-using a password.

Post reply on HN