check out https://pwdsafe.com It's not as convenient as many other options, but somewhat pure, fast and does all the basics well without sacrificing security for convenience.
Introducing Remembear, new password manager
61–70 of 98 posts
Re: Introducing Remembear, new password manager
#62From the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes. Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors…
> This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before.
Yes, and it's getting really old. I'm tired of seeing security consulting firms wax poetic about how good the client's security is in their reports, then bend over backwards to frame obviously serious findings in the best possible light. That's not their job, their job is to report security vulnerabilities objectively, with sufficient coherence, context and reproduction steps so as to make the problem evident and motivate a solution.
Naturally, as soon as Cure53 decided to politely categorize what are clearly critical vulnerabilities as high severity, Remembear took to Twitter to crow about how much of a success the security audit was - "No critical findings!" I have serious reservations about the incentives at play between companies and the consultants paid to (security) review their products, especially when the report is publicized.
In my opinion, companies should not be using security consulting firms as a component in a press release. It encourages a mischaracterization of the state of the company's security and the severity of findings, and it puts a pressure on other security consulting firms to "play ball" and gush about their clients' products in publicized reports.
Re: Introducing Remembear, new password manager
#63Earlier quoted context omitted.
I would like to see a version of 1Password that 1) did only passwords - no fishing licenses and secure notes, which adds UX complexity 2) did not distinguish between passwords and logins, which causes endless confusion for my users 3) knew and managed the text requirements for the top 1000 websites so the app could generate legitimate passwords and not ask users to manage password complexity
Ohh I like the idea of knowing the password requirements for the top 1000 websites!
Would it be wrong to wish this could (or should?) be standardized? That is, for example, one upper case letter, same special characters, etc. The lack of a standard seems to hurts users more than hackers. The hackers know it and adjust. User just get confused and default to overly simplistic and common PWs.
Re: Introducing Remembear, new password manager
#64I'm currently using LastPass and their macOS app seriously annoys me (why do I have to click an OK button every time I save a new password?). They seem to get their UI right at least. Plus, bears are cute. Edit: No support for folders/categories it seems. That sucks a bit.
Is there a reason you don't use the browser extension?
Re: Introducing Remembear, new password manager
#65I use 1Password, and the only incentive which make me switch is completely open source good quality UX solution.
I'm working on that (https://passit.io) and I'm curious what your opinion of good UX is. Many here mention vulnerabilities from web extension autofill (domain matching issues, etc). Do you have any opinion between:
A) No autofill. Copy and paste (but good simple shortcuts). Least attack vectors, but least convenient.
B) Autofill but only when user prompts (with shortcut). This avoids having to inject js into web pages. The web extension needs less overall permissions this way. It avoids certain attack vectors. Features would be less discoverable - you have to know to hit the shortcuts or click a browser icon.
C) Prompts to Autofill in the page. This is the most common technique, lastpass does it. Vulnerable against domain matching misparsing. It's a big attack vector but there are plenty of common password manager vulnerabilities that can be studied and mitigated against.
Or something else? Also what issues do you have with current open source password managers?
Re: Introducing Remembear, new password manager
#66What differentiates RememBear from other password managers? After looking through the blog and website it's not immediately clear to me. What makes (or will make) RememBear better than, say, 1password, which appears to have the same features, is also easy to use, and has a long history with which to work out issues?
I feel the company's modus operandi is to have easy and cute UX to simplify using security tools. Their VPN software is apparently very easy to use (from reddit comments). The same will probably apply to the password manager. They also seem to have a good marketing and PR team since I see them around quite a bit in youtube videos (Linus' being the most prominent one) and ads thinly veiled as articles. These two point…
I use TunnelBear, and I can say it works beautifully. It really is just turn on, turn off.
Re: Introducing Remembear, new password manager
#67I'm currently using LastPass and their macOS app seriously annoys me (why do I have to click an OK button every time I save a new password?). They seem to get their UI right at least. Plus, bears are cute. Edit: No support for folders/categories it seems. That sucks a bit.
Bears are very cute. Can't go wrong with that!
Jokes aside, this would be interesting to compare to 1Password once it matures a little. So far it looks very similar.
Re: Introducing Remembear, new password manager
#68From the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes. Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors…
What password manager do you recommend?
Bitwarden is open-source and has been working well for me as a LastPass replacement so far.
Re: Introducing Remembear, new password manager
#69I use 1Password, and the only incentive which make me switch is completely open source good quality UX solution.
I'm working on that ( https://passit.io ) and I'm curious what your opinion of good UX is. Many here mention vulnerabilities from web extension autofill (domain matching issues, etc). Do you have any opinion between: A) No autofill. Copy and paste (but good simple shortcuts). Least attack vectors, but least convenient. B) Autofill but only when user prompts (with shortcut). This avoids having to inject js into web pa…
Personally, I prefer no autofill. I always turn it off.