Evaluation of five password managers • Hacker News Board

Re: Evaluation of five password managers

#191

Post by jik » Sat, Dec 22, 2018, 4:28 PM UTC

mithr wrote: post #75

SloopJon wrote: post #14

Earlier quoted context omitted.

That page says, "Requires Google Chrome or Firefox," and the download link takes you to the Chrome web store. I'm not sure the poster considers that full support.

That's somewhat fair, although the 1Password X page (which is what AgileBits calls their in-browser version) describes it as being comparable to the native versions, which to me goes against OP's statement that > full functionality can’t be dependent on an app which is only available on Mac OS and/or Windows. The existence of 1Password X means that full functionality is not _dependent_ on a MacOS/Windows app. The arg…

There is substantial functionality which is only available in the native app, not in 1Password X, and therefore completely unavailable on Linux.

If the 1Password X claims that its functionality is comparable to the native version, then it is lying.

Re: Evaluation of five password managers

#192

Post by [deleted] » Sat, Dec 22, 2018, 4:31 PM UTC

scndthe2nd wrote: post #148

This SAAS bias is untenable. "Use a big target" they say. "Store them with a big company" they say. "Give your data to someone, let them worry about it" they say. Meanwhile, breach after breach tells us that regardless of security, the likelihood of successful attack comes closer and closer to 1 as the size and exposure increases. It's likely that these services have already been zerodayed, and we're just waiting for…

[deleted]

Re: Evaluation of five password managers

#193

Post by otachack » Sat, Dec 22, 2018, 4:31 PM UTC

zapzupnz wrote: post #181

pietroglyph wrote: post #90

Earlier quoted context omitted.

I love the iOS app, but things like this concern me (not quite a dealbreaker though): https://github.com/mssun/passforios/issues/223

It's insane that people working on a password manager thought it was a good idea to put passwords in UserDefaults. Apple expressly states in its documentation that sensitive information should be stored in Keychain; how does someone setting out to make a password manager miss that?

What's crazy is Apple makes it super easy to use Keychain. APIs are great and there are good examples of how to use them.

Re: Evaluation of five password managers

#194

Post by jik » Sat, Dec 22, 2018, 4:34 PM UTC

redwards510 wrote: post #2

> Yubikey support in browser (Personal) BitWarden: no huh? I use my yubikey in the Bitwarden browser extension. Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.

Yes, my initial evaluation was flawed because I was looking at the free version of Bitwarden, but supports neither U2F nor attachments, but the evaluation grid said that it didn't support U2F but did support attachments. I've updated the grid to fix this. It now says that YubiKey is supported for Bitwarden and has a separate pricing line for personal use without attachments or YubiKey vs. with them.

Re: Evaluation of five password managers

#195

Post by otachack » Sat, Dec 22, 2018, 4:35 PM UTC

n4r9 wrote: post #161

faitswulff wrote: post #125

Earlier quoted context omitted.

> synced through my free Dropbox account I was always a bit paranoid about this, even though I did it myself.

The decentralised alternative is to use something like SyncThing[0]. It's what I use and is only slightly more involved. [0] https://syncthing.net

What about Resilio Sync? They have a discount for one-time license. And it was formerly BitTorrent Sync. I'll have to check out Sync Thing.

Re: Evaluation of five password managers

#196

Post by jik » Sat, Dec 22, 2018, 4:48 PM UTC

e40 wrote: post #119

notatoad wrote: post #60

What did you find changed in lastpass after the logmein acquisition? We've been using lastpass since before the acquisition, and i can't say i've noticed any substantial changes (either positive or negative)

More bugs and the support was horrible. I moved my entire company from LP to 1Password. I'm impressed with the quality of 1Password. They get huge props from me for telling me, in the upgrade dialog, what the changes are, before I agree to upgrade.

>More bugs and the support was horrible.

^^^Yes, this.

In 2018, we reported nine different substantive security holes to LastPass. At least two of them were security issues. All of them took far too long to fix; some of them still aren't fixed.

There's a tenth bug which impacts many of our users on a regular basis which we haven't bothered to report to them because by the time we started running into it, our users were like, "Meh, whatever, that's just LastPass being LastPass." It's not good when you stop reporting bugs to a vendor because you've become convinced that they just don't care.

They've had 12 outages of varying severities and lengths in the past six months.

Pretty much every time I reported a bug to them -- and believe me, most of my bug reports were extremely detailed and often included videos or screenshots demonstrating them -- their first response was, "Try uninstalling and reinstalling your plugin." I hate that. HATE, HATE, HATE it.

Re: Evaluation of five password managers

#197

Post by jik » Sat, Dec 22, 2018, 4:57 PM UTC

CiPHPerCoder wrote: post #143

tptacek wrote: post #120

Earlier quoted context omitted.

I think Scott knows that most of these other password managers have been audited, and I know he knows audits are of varying quality and are virtually never conclusive, so I'm not sure what he's trying to say by pointing Bitwarden's audit out.

I thought the checklist was aiming to be comprehensive and that the omission of the audits was an oversight. The one for bitwarden being, as you said, disquieting, makes its omission a little suspicious.

We didn't use the word "comprehensive", "complete", or "thorough", and obviously we didn't include every password manager in our evaluation, so I'm not sure what reason you have to believe that we were aiming to be "comprehensive."

We were aiming to evaluate the features / issues we care about against the password managers we were most likely to want to use. We published the results of our evaluation because we thought it might be useful to some people, not because we thought or intended for it to be all things to all people.

We didn't include security audits in our evaluation because, we are skeptical of their value and do not consider them a significant differentiator.

For example, in our experience trying to keep our own application secure, our HackerOne bug-bounty program has identified far more issues than the white-box security audits we've commissioned, at far lower cost.

Re: Evaluation of five password managers

#198

Post by rrdharan » Sat, Dec 22, 2018, 7:19 PM UTC

eridius wrote: post #129

rrdharan wrote: post #70

Earlier quoted context omitted.

Same. I recently purchased an upgrade and consider it well worth the price, although I'm considering switching to the subscription model / family plan to make it easier to support my parents and in-laws. However my main concern is that you can't disable browser access when using ay of the subscription plans: https://discussions.agilebits.com/discussion/80105/cant-disa...

I'm confused as to what the security issue is here. > Limiting the access of unencrypted passwords to only properly setup 1PW applications would seem to eliminate the possible (probable?) web based attack vector to a 1password.com account. This doesn't make sense. What's a "properly setup 1PW application"? Presumably that's an instance of 1Password that has been given both the master password and account key for the…

Right - I don't want 1Password to handle syncing and I don't want Dropbox handling / offering decryption of the encrypted store.

I trust the local 1Password apps enough to supply them my master password to unlock vaults locally.

I trust Dropbox enough to not sync the encrypted store somewhere I don't want it ending up.

It's a separation of concerns argument. I likely won't hold up to any targeted attack on my personal property given how careless I am with local devices but I should be somewhat protected against a your typical dragnet / mass attack against either service remotely.

Re: Evaluation of five password managers

#199

Post by slim » Sat, Dec 22, 2018, 7:34 PM UTC

zmmmmm wrote: post #52

In the end I've just been using the Unix pass password manager [1]. It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand. [1] https://www.passwordstore.org/

And since it's just gpg+git you can share some passwords using a git repo. We use this with my team at work

Re: Evaluation of five password managers

#200

Post by n4r9 » Sat, Dec 22, 2018, 8:35 PM UTC

otachack wrote: post #195

n4r9 wrote: post #161

Earlier quoted context omitted.

The decentralised alternative is to use something like SyncThing[0]. It's what I use and is only slightly more involved. [0] https://syncthing.net

What about Resilio Sync? They have a discount for one-time license. And it was formerly BitTorrent Sync. I'll have to check out Sync Thing.

Well, SyncThing is open source as well as being free.