Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Evaluation of five password managers

medium.com

Post reply on HN
Print view View original

181–190 of 216 posts

Re: Evaluation of five password managers

#181

Post by zapzupnz »

pietroglyph wrote: post #90
hkri wrote: post #54

Earlier quoted context omitted.

For developers/tech-savvy people it is more or less perfect. I love the fact that it is based on git giving you a history and great control over synchronization. I use it to store all kinds of things such as passwords and files containing environment variables that can be sourced directly from the output of pass (source https://github.com/mssun/passforios

I love the iOS app, but things like this concern me (not quite a dealbreaker though): https://github.com/mssun/passforios/issues/223

It's insane that people working on a password manager thought it was a good idea to put passwords in UserDefaults. Apple expressly states in its documentation that sensitive information should be stored in Keychain; how does someone setting out to make a password manager miss that?

Re: Evaluation of five password managers

#182

Post by PuffinBlue »

humantiy wrote: post #67
notatoad wrote: post #60

What did you find changed in lastpass after the logmein acquisition? We've been using lastpass since before the acquisition, and i can't say i've noticed any substantial changes (either positive or negative)

Not sure if its related to the acquisition, but if you're a firefox user the app has gotten very slow in past few years. I think the issue is related to the move to chrome extensions but really that shouldn't be an excuse. Lots of add-on have done this move and haven't had a problem.

In the last few days it's had a good improvement. Copy username/password directly from the window is back (had to previously edit and view password, then copy) and speed is just as good as I see on chrome.

I'm using Windows an Linux and these improvements have come in the past week or so for me. Perhaps they recently updated, I haven't checked.

Worth taking another look if you can.

Re: Evaluation of five password managers

#183

Post by tyingq »

paul167 wrote: post #156
tyingq wrote: post #44

Earlier quoted context omitted.

Interesting. Browser plugins, by nature, include source code. I wonder if there's an easy fix. Can you describe the issue in a little more detail?

I took a shot at building a browser plugin for 1pass [1] a little while back. Turns out, the hardest thing is not the crypto or the browser to app communication, but parsing the HTML to accurately find the login forms. If I remember correctly, the browser plugin on Mac actually sends the entire HTML to the app for parsing. The parser is probably quite complicated and they avoid reimplementing it in extensions that wa…

Of course that also protects the IP :)

Also, great post. I love reading reverse engineering stories.

Re: Evaluation of five password managers

#184

Post by dbrgn »

village-idiot wrote: post #144
dmoy wrote: post #141

Earlier quoted context omitted.

No u2f support? :(

U2f support is badly hampered by half-assed browser support. Only chrome enables it by default, Firefox disables it by default, and no love from safari. Even LastPass in the browser uses yubico’s proprietary otp algorithm rather than u2f.

U2F support in Firefox should work out of the box if the developers use the WebAuthn API and not the old JS library: https://hacks.mozilla.org/2018/01/using-hardware-token-based...

Re: Evaluation of five password managers

#185

Post by notatcomputer68 »

abrowne wrote: post #104
zmix wrote: post #102

I wonder, why not a single word has been spoken about Keepass/X, which is available on all platforms (not sure about iOS, though), can work with UbiKeys, afaik, has huge im- and export support and is free from any corporate interests.

If you want the Qt one, make sure to use KeyPassX C , the active fork of KeePassX. https://keepassxc.org/

What I like about keypass is that it's not networked and not running in the browser, making the attack surface a lot smaller.

Keypassxc having such features(and apparently the old network protocol was vulnerable lol) is for me a strike against it.

Re: Evaluation of five password managers

#186

Post by jik »

faitswulff wrote: post #105

Just idle curiosity, but I'd be curious to see BitWarden's commit on GitHub: > ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later , and just a few days after that the fix was released to the public.

https://github.com/bitwarden/web/issues/303#issuecomment-446...

Re: Evaluation of five password managers

#187

Post by jik »

cassianoleal wrote: post #171
callalex wrote: post #147

Earlier quoted context omitted.

That tells me that their testing is either extremely excellent , or extremely nonexistent. Rumors seem to point towards the latter, which is concerning for security software.

I don't know about the rumours, but "a few days" is a long time to test a bug fix. It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice. More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about. EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place.…

It was a cosmetic, not a security-critical bug, so there's really no reason why it needed to be released right away.

Also "a few days" was just a guess. I noticed that it was a problem, then I noticed a few days later that the fix had been release. I don't actually know exactly how long it took to release the fix after it was committed.

Re: Evaluation of five password managers

#188

Post by jik »

yinyang_in wrote: post #162

No mention of enpass.io, i found their method to be completely safe. Encrypted sqlite files, shared across Dropbox/onedrive/Google-drive. Apps used for Mac, Linux, windows, browser integration also works fine. All boxes are checked, don't know why isn't it popular among masses or nerd community.

We did not set out to evaluate every single password management product. We set out to evaluate the products which where enough "in the ballpark" of what our company needed that there was a chance we would end up using them.

There was never any chance that we would use a product which required every user to set up their own cross-device synchronization. Turnkey synchronization across devices as a first-class feature is a hard requirement for us.

Also, as far as I can tell, Enpass doesn't support sharing credentials between users, another hard requirement for us.

The family of password managers like KeePass and Enpass have their place, but they aren't good solutions to password management for businesses.

Re: Evaluation of five password managers

#189

Post by jik »

vhost- wrote: post #30
mithr wrote: post #8

> Mac OS, Windows, Linux, Android, and iOS ... full functionality can’t be dependent on an app which is only available on Mac OS and/or Windows. In other words, lack of full Linux support is a show-stopper for us. This ruled out 1Password... ...Huh? 1Password supports all of those platforms (including Linux) https://1password.com/downloads/linux/

It really doesn't. I'm a full time linux user and I can tell you the support from both lastpass and 1password is abysmal. I have to copy and paste my passwords from both of those platforms using their half-baked browser plugins that rarely work with linux clipboards.

You're correct that the Linux support for 1Password is severely lacking, which is why I called that out in my evaluation.

LastPass, on the other hand, is in a different category. It _claims_ to have full Linux support, and for a long time they did, but more recently -- as you point out -- copy/paste in their browser plugins stopped working properly when the binary component of the plugin is enabled on Linux. Since the binary plugin component is required to work with attachments, Linux users have been forced to choose between working copy/paste and the ability to manipulate attachments. They've known about this bug for many months and have not fixed it. In fact, this is one of the unfixed bugs which drove us to finally evaluate alternatives to LastPass.

Re: Evaluation of five password managers

#190

Post by jik »

loeg wrote: post #91
vhost- wrote: post #30

Earlier quoted context omitted.

It really doesn't. I'm a full time linux user and I can tell you the support from both lastpass and 1password is abysmal. I have to copy and paste my passwords from both of those platforms using their half-baked browser plugins that rarely work with linux clipboards.

Both Lastpass and 1password browser plugins worked totally fine for me on Linux. My only complaint re: 1pass is the lack of native Linux app — you can't do mildly complicated things in the browser extension like edit credentials. On the other hand, LastPass doesn't have a native app.

LastPass doesn't have a native app because it doesn't need one -- when the browser plugin and web vault are working properly, they provide all available functionality on every platform. The problem is that the plugin does not always work properly; see my other comment about copy/paste problems on Linux, a bug which LastPass has known about for many months and not fixed.
Post reply on HN