351–360 of 443 posts
Only one person mentioned it, so I'll pitch in - Dashlane [1] is a great password manager, and it's communication with their customers is top notch (customer service and security wise [1]). Speaking as a humble premium user which thinks they don't get enough credit. [1] https://www.dashlane.com/download/Dashlane-Security-Whitepap...
Earlier quoted context omitted.
Are you saying that you remember a unique and sufficiently random password for every website/app/etc you use? If so, you've got a far better memory that me.
Not the GP, but yes, and it doesn't require a good memory. The main things I do: 1. "Salt" my email usernames with the name of the service (johndoe+reddit@example.com) 2. Use multiple (long) password bases depending on the type of service (eg website vs app) 3. Combine the password bases with a cipher/salt based on the service name and my username I'm guilty of not rotating passwords on a regular basis, however.
Earlier quoted context omitted.
Disclaimer: I work for AgileBits, makers of 1Password Yea, we hear you there. I (and others on the team) wish we could make this happen, but priorities are a tough one. Linux in general didn't fit all that great in our standalone license model before, along with being closed source. Now with the subscription option for individuals (new today), families and teams we have made the payment side a little less of a concer…
Is there a feature comparrison or reasoning you may have about why 1password may be better than Keepass? I have been using Keepass as I use Linux, Windows, and Phone for accessing my passwords. I am wondering if 1password has some neat helpful features that Keepass doesn't. I am considering switching to a new password manager.
I can tell you one thing that is indisputably better about 1Password though.
Support.
Quite literally. We have a team of over 30 customer support personnel (in addition to myself and other developers who pitch in for a part of our day). We're here to help if you run into problems, encounter a bug, have feature requests, or generally just want questions answered about how we do things or why something is done the way it's done.
Keepass, as noble as it is to have an open source and free product, is run and improved by volunteers. I realize that not many people on hacker news really care that much about support since we're all typically very capable people, but as someone who has been with AgileBits for nearly 5 years now and seen a whole lot of the weird edge cases that can exist because some webpage is doing something incredibly weird or some particular computer setup is causing problems. It can be really helpful to know that there are people who can look into these things for you instead of having to know it yourself.
1Password does have a 30 day trial (both for our standalone product and for our individual/family/team subscriptions). You can try it yourself and see how it works for you. And as always, if you have questions during this time you're welcome to get in touch (support at agilebits.com, mention my name if you want and it'll notify me) and we'll help you get things setup. We think the product speaks for itself and we're happy to fill in any gaps if you need more :)
Kyle
AgileBits
Earlier quoted context omitted.
Disclosure: I work for AgileBits, makers of 1Password. If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)
How easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.
The hardest part of the migration for my parents were 1) demystifying the spaghetti mishmash my Dad had in place to manage his passwords, 2) getting Dropbox set up correctly between Mom & Dad for vault sharing, 3) training my Mom how to use, and 4) educating Data on how to manage website edge cases.
I would hope that 1PW has a LP migration tool, but if they don't, Dad was able to clean up his historical garbage one by one. The password capturing process in 1PW is good enough that this worked nearly seemlessly.
Finally, I've had nothing but positive results from posting questions in the 1PW forum.
Running as a separate application outside the browser is 95% as easy thanks to auto-type.
Earlier quoted context omitted.
I want an alternative, got a good one?
If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)
Earlier quoted context omitted.
I think you could do a lot worse than lastpass. You could also do better, by sacrificing some usability. On the extreme side, you could use a separate, offline device, just for password storage. But I don't think it's worth getting excited about a single lastpass bug. Everything is vulnerable. There will be more of them. Chrome itself had 105 security issues, just this year ( https://www.cvedetails.com/product/15031/…
>Everything is vulnerable. Well, that put it in perspective for me. I just googled the vulnerabilities in offline password managers like Keepass/X and 1Password. And oh man, I was pretty shocked to see even the offline ones could be broken into. I think I just had a crisis of faith. >you'll be more secure than 99% of people Thanks. I guess since I don't store very sensitive info (financial, etc.), and the important s…
Earlier quoted context omitted.
I'd say some of the points could be easily covered by something like KeePass which, unlike cloud, doesn't have to depend on questionable security of third-party services. For example. I use KeePass to store all my password. I keep my KeePass database in Google Drive, so any change to the file will be updated. because of that I can use KeePass on any machine that has access to Google Drive (I also keep executables for…
It's not really very much more effort. I use KeeFox (Firefox) and Keepass2Android (you can guess). I love both tools, they've made password management trivial, and I used to be a die-hard "one password for everything is just so much more convenient" fan.
Integrating with the browser is probably a bad idea, it shortens the exploit path from a webpage to your password store.
Using a standalone application and using the clipboard would require a malicious website to break out of the browser and then break into the password store process, which could in principle run under a different user and interact with the clipboard through some broker process.
Earlier quoted context omitted.
Coincidentally, a bunch of Dropboxers are working on a version of 1Password for Linux written in Rust (it's Dropbox's "Hack Week" right now). Hopefully we can open source it soon. Looking good so far!
Hi there! If you have any questions that we might be able to answer, please shoot me an email. kyle at agilebits.com, or support at agilebits.com. I work on our Mac/iOS teams and security teams. I can probably answer most of your questions and at least get them in front of people who can answer them. I really hope you're not making this work with AgileKeychain, we've put that one out to pasture. :) Kyle AgileBits
We've got pretty good OPVault support going, but your guys' RPC protocol is not open, right? Between mini and the browser plugins?
I've been using LastPass for about 3 years, and now I'm seriously thinking about all the times people told me about how storing passwords in someone else's cloud is bad. I've been defending LastPass and recommending it to everyone till today. Now I'm thinking about how I might have to 'pay' for a software vulnerability in some private (read:unauditable by me) code. All the comments about offline, local backups make s…
I do not use LastPass exactly because of what you describe. I use a KeePass Password safe without autofill. I use other software to sync the file. It used to be Dropbox, later I was using BitTorrent Sync, but what tool sync shouldn't really matter. As I see it: the tool only gets to see and sync an encrypted file. You could even use a USB stick and not sync at all. Or only sync on LANs. I love it how I get to decide…