Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evaluation of five password managers

medium.com

Post reply on HN
Print view View original

171–180 of 216 posts

Re: Evaluation of five password managers

#171

Post by cassianoleal »

callalex wrote: post #147
faitswulff wrote: post #105

Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub: > ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later , and just a few days after that the fix was released to the public.

That tells me that their testing is either extremely excellent , or extremely nonexistent. Rumors seem to point towards the latter, which is concerning for security software.

I don't know about the rumours, but "a few days" is a long time to test a bug fix.

It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice.

More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about.

EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place.

An issue was opened about 6 weeks ago asking where the tests are and it received zero responses from the maintainers: https://github.com/bitwarden/core/issues/399

Re: Evaluation of five password managers

#172

Post by h1d »

yinyang_in wrote: post #162

No mention of enpass.io, i found their method to be completely safe. Encrypted sqlite files, shared across Dropbox/onedrive/Google-drive. Apps used for Mac, Linux, windows, browser integration also works fine. All boxes are checked, don't know why isn't it popular among masses or nerd community.

Enpass is not sexy but got things right.

But do note that backing up on cloud means, 1 password combination and you'll let your encrypted files infinite local crack attempt.

Re: Evaluation of five password managers

#173

Post by h1d »

sakisv wrote: post #167

I only found out about Bitwarden a few weeks ago and it got me to change from KeepassXC and I'm overall very happy with the change. The main selling points for me were that it's open source and they allow you to host it yourself. Apart from these, I really enjoy the browser addons which don't require any jumping through hoops[1] and that they provide their own Android client and you don't have to play Play Store Colu…

> they allow you to host it yourself.

This is better than a hosted version in a way you don't reveal the URL of your login screen but yet letting anyone open up the entire vault with 1 password combination is a deal breaker for me.

Why don't online services provide unique URL for their logins for each users, so that no lucky breach happens?

(Like https://unique-id.service.domain)

I'd rather stick with an offline one.

Re: Evaluation of five password managers

#174

Post by StavrosK »

tialaramex wrote: post #155
sebazzz wrote: post #150

Earlier quoted context omitted.

Isn't that WebAuthn suppport? That is different from U2F.

Yes and no. U2F is basically the MVP of WebAuthn. If you're doing this today you should ignore U2F and just implement WebAuthn. Firefox has WebAuthn out of the box, and there's a hack behind a pref to half-arse U2F if you still need that.

It doesn't, though. I've been trying to implement WebAuthn and, as far as I know, CTAP 2 doesn't work on any browser yet.

Re: Evaluation of five password managers

#175

Post by xte »

My personal password manager: GNUPG-encrypted text file (org-mode). No extra fuss.

Reason? I have too much code to look/trust to add more and I do not keep log-in anywhere during my day, I do my best to avoid web-(cr)app as much as I can and try to live asynchronously connects via Emacs, being capable of operate as much as I can offline...

Re: Evaluation of five password managers

#176

Post by h1d »

amanzi wrote: post #85

Glad to see Bitwarden up on top. They tick all the boxes for me - open source, transparent security (including recently published audit), feature-rich, optional self-hosted, and easy to use.

Except there isn't much info on who 8 bit solutions is. It seems like a 1 man effort and apparently he doesn't want to reveal much.

A few requests aren't exactly answered.

https://github.com/bitwarden/website/issues/12

https://community.bitwarden.com/t/who-is-hosting-bitwarden/1...

Re: Evaluation of five password managers

#177

Post by h1d »

vbezhenar wrote: post #56

For me an important selling point of 1Password was that their software looks like native Windows software and native iOS software while Bitwarden is just Chrome wrapper or something like that for desktop and C# for mobile and I don't want to support that kind of cross-platform software.

Are you just concerning the "look" or some technical disadvantage of such cross platform apps.

Re: Evaluation of five password managers

#178

Post by nickjj »

zmmmmm wrote: post #52

In the end I've just been using the Unix pass password manager [1]. It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand. [1] https://www.passwordstore.org/

This is what I've been using for a long time too.

Currently have over 250+ passwords in it, and it's great.

I like it because of its multi-line ability too, which makes it useful for storing blobs of text (such as API keys).

I wrote a bit about that at https://nickjanetakis.com/blog/managing-your-passwords-on-th....

Re: Evaluation of five password managers

#179

Post by cassianoleal »

com2kid wrote: post #73
Avery3R wrote: post #5

No keepass? Disappointed.

The one issue I had with Keepass is that on iOS (and this is Apple's fault!) it is not possible to choose different cloud storage providers to keep the password database file on. This silly thing alone would preclude me ever buying an iOS device! (My wife ran into it when I tried to get her up and running with Keepass, she gave up...) I love keepass's simplicity, no browser plugins with pop up dialog boxes or UIs tha…

Plenty of iOS apps offer multiple cloud storage solutions.

In fact, iOS's own Files app can be used to access different cloud providers (I have iCloud, Dropbox and Google drive set up).

Do you have any good references pointing to Apple limiting Keepass in that regard?

Re: Evaluation of five password managers

#180

Post by tejado »

As I want to protect all my passwords offline at one place but have them also available mobile, I developed Authorizer.

It is an Android password manager based on PasswdSafe with USB HID keyboard support to enter paaawords automatically on any device. Also stores TOTP/HOTP.

The idea is, to have a complete offline device (hardend android without network stack/always flight mode on, baseband overwritten, ...).

https://github.com/tejado/Authorizer

Post reply on HN