Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for Linux beta

blog.1password.com

Post reply on HN
Print view View original

81–90 of 254 posts

Re: 1Password for Linux beta

#81

Post by dastx »

bilal4hmed wrote: post #6

I would like to throw out Bitwarden out there. Cross platforms, works on everything and can be self hosted if you so desire.

Bitwarden is great, but I'm getting frustrated at their ridiculous excuses for not implementing fixes.

For the longest time bitwarden has been broken in the firefox's private browsing after mozilla deprecated some apis due to security concerns. They've given alternatives but they are just refusing to fix it, to the point of basically saying mozilla needs to fix the issue. What's sad is a similar mechanism is used in their chrome extension. Someone even raised a working PR that the CTO wasn't fully happy with, and asked for changes (which is fair), but the PR hasn't moved since, so I'd have expected the Bitwarden employees to take it and fix it up.

It's absolutely ridiculous to still not have this fixed years later.

By contrast, I was a 1Password customer at the time this change got introduced, and they'd pushed out a fix not long after.

I will be trying to Linux client, and if it's good enough, I'm certainly switch away.

Re: 1Password for Linux beta

#82

Post by dylan604 »

luhn wrote: post #68
29athrowaway wrote: post #56

Earlier quoted context omitted.

Using a password manager is a good idea. Using a password manager as a service is my point of contention.

You still haven't substantiated your opinion in any way.

What if service goes away?

Even if stand alone app vendor goes away, the app still works. There are things that I see are okay as a monthly service like Netflix or other content provider where the content is literally changing month to month.

Stand alone software that rarely changes, like 1Pass, does not warrant a monthly service fee from me. I am self-hosting the content, so I don't need their cloud services.

Re: 1Password for Linux beta

#83

Post by gilrain »

aaronfc wrote: post #45

I have been using LasPass since many years ago. There's an extension for Chrome and for Firefox. On Android I use the app and even though experience is not that "automatic" it works. I am surprised nobody mentioned LastPass is there any reason I should know?

LastPass was bought by LogMeIn, which raised some eyebrows. More recently, LogMeIn was bought by private equity vultures. That raises alarm bells for more people.

It was that plus experiencing a lot of bugginess in their apps that got me to switch to 1Password. It's been a huge improvement.

Re: 1Password for Linux beta

#84

Post by Zizizizz »

aaronfc wrote: post #45

I have been using LasPass since many years ago. There's an extension for Chrome and for Firefox. On Android I use the app and even though experience is not that "automatic" it works. I am surprised nobody mentioned LastPass is there any reason I should know?

Nah you're fine. There are other good alternatives but Lastpass does the job and that's fine. They do have a lastpass-cli which is quite nice to have as well. It operates somewhat like pass.

Re: 1Password for Linux beta

#85

Post by drdaeman »

TheDong wrote: post #33
stefan_ wrote: post #7

Oh good it's another Electron app and since there are only about 50 random dependencies mentioned in the package.json maintained by about 25 random people, exfiltration of all your passwords is only one of those being compromised away at any given point. And that is just the direct dependencies, I don't even want to look at the tree of it all. If you trust 1password with your passwords, really you are also trusting w…

> exfiltration of all your passwords is only one of those being compromised away at any given point No, that's absolutely not true. Those dependencies will not automatically update in your local app. The 1password developers should be auditing all updates to those dependencies too, and if you trust the 1Password developers to be competent, then you don't have to trust 25 random developers. Furthermore, this isn't uni…

Trust is non-binary.

It is a perfectly legitimate concern that npm dependencies are a threat vector. Obviously, at build time - but we've all heard stories how less security conscious developers let malicious code slip through with just `npm update`.

And compared to, e.g., C++ tooling (npm) makes it somewhat easier to slip a malicious update through. So it's not like that's strictly incorrect.

The concern is that is not exactly clear what processes AgileBits have in place and how they manage those dependencies. They could - and probably do - things the proper way (private registry for all dependencies, etc), but the concern is that they're accidentally missing something is perfectly valid - albeit voiced incorrectly (as a statement that it is insecure, not a question whenever they do things in a secure manner).

Brain farts just happen, even to the very best developers and teams.

Re: 1Password for Linux beta

#86

Post by sroussey »

TheDong wrote: post #33
stefan_ wrote: post #7

Oh good it's another Electron app and since there are only about 50 random dependencies mentioned in the package.json maintained by about 25 random people, exfiltration of all your passwords is only one of those being compromised away at any given point. And that is just the direct dependencies, I don't even want to look at the tree of it all. If you trust 1password with your passwords, really you are also trusting w…

> exfiltration of all your passwords is only one of those being compromised away at any given point No, that's absolutely not true. Those dependencies will not automatically update in your local app. The 1password developers should be auditing all updates to those dependencies too, and if you trust the 1Password developers to be competent, then you don't have to trust 25 random developers. Furthermore, this isn't uni…

It’s worse in C++ as you probably don’t get a list of those dependencies.

Re: 1Password for Linux beta

#87

Post by alschwalm »

mapgrep wrote: post #69
bilal4hmed wrote: post #6

I would like to throw out Bitwarden out there. Cross platforms, works on everything and can be self hosted if you so desire.

Not knocking the project, which sounds cool, but the absolute last thing I want to self host is a password database exposed to the internet. Hard pass on that element. 1password used to have a peer to peer sync mode that I loved. No need for a server anywhere. You would open it on your Mac and then open it on your phone and if they were on the same network they would self discover. Too inconvenient, perhaps, for most…

I'm concerned about self hosting a service like this as well, so I put mine behind an nginx reverse proxy that requires a client cert for auth. That way, an attacker won't even be able to reach the bitwarden server to try to get in (unless there's a vulnerability in nginx).

Re: 1Password for Linux beta

#88

Post by ssully »

29athrowaway wrote: post #60
NikolaeVarius wrote: post #58

Earlier quoted context omitted.

I dont think my yubikey receives SMS

Yubikeys are secure, but the most popular second factor is SMS, followed by authenticators, which are better than SMS in my opinion. MFA does not imply bulletproof security.

Well since this discussion is in a thread about 1password I think it's worth pointing out that 1password doesn't even support SMS as an MFA option [1].

[1]: https://support.1password.com/two-factor-authentication/

Re: 1Password for Linux beta

#89

Post by dyingkneepad »

shmerl wrote: post #23

KeepassXC is packaged in most distros and is open source.

It's not a very direct alternative. 1password uses a server and keeps everything in sync for you automagically, while on KeepassXC you have to sync your devices yourself (with some help from them). The more open source alternative would be the aforementioned Bitwarden.

Re: 1Password for Linux beta

#90

Post by cytzol »

SparkyMcUnicorn wrote: post #29
beckler wrote: post #19

Does anyone know if this supports standalone licenses, or is it strictly subscription only?

1Password supports standalone licenses, but they don't really advertise that or have pricing for it on the main website. https://support.1password.com/cs/migrate-standalone/ (note the text near the end regarding licensing)

> 1Password supports standalone licenses

The 1Password macOS and Windows clients can be bought stand-alone, but their newer clients (such as the command-line client, for some reason) are subscription-only. It's confusing, and it looks like this Linux client is also subscription-only.

Post reply on HN