Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password 4 for Mac is here

blog.agilebits.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: 1Password 4 for Mac is here

#81

Post by induscreep »

CountSessine wrote: post #55

Maybe they can make a decent Android version one of these days. If they had a good Android version, I'd update to v4 for OSX in a heartbeat. I own an OSX license for v3, a Windows license for v3 (or whatever its at right now), and iOS licenses for iPad and iPhone - even though I don't have an iPhone or iPad anymore. I have a big investment in this program, but their slipshod Android version has me re-evaluating this…

Doesn't the android version sync with the others using dropbox? It says so here:

https://agilebits.com/onepassword/android

Re: 1Password 4 for Mac is here

#83

Post by adestefan »

GotNothing wrote: post #77
x03 wrote: post #72

Earlier quoted context omitted.

"— All Mac App Store customers get 1Password 4 for free. Yes, all of them — All website customers who purchased 1Password for Mac in 2013 get v4 for free. Yes, that’s a nine-month free upgrade window — Launch sale price for new customers: $39.99 – that’s 20% off the regular price of $49.99 — Launch upgrade sale price for website customers who bought before 2013: $24.99 – that’s $10 off our regular upgrade price of $3…

Not sure why you're quoting this. I read this when I visited the page... I just find it ridiculous that if I pay the $24.99 to upgrade, I will have put close to $100 into an app that basically stores passwords for me conveniently.

They can do what they want with their pricing, but I agree. I just don't see the value at the current price points, especially the $18 iOS app. I'd be more inclined to upgrade at around $20 and $10. At $18 and $7 I'd already have pulled the trigger.

Re: 1Password 4 for Mac is here

#84

Post by Groxx »

Osmium wrote: post #80
Groxx wrote: post #79

Earlier quoted context omitted.

One domain flaw: dropbox.com used to be getdropbox.com and probably others. Unless you remember and/or changed your password when that happened, it might now be unrecoverable. One password flaw: some sites have weird restrictions (probably your bank, for instance). A hashing solution is unlikely to meet those requirements, meaning you have to store the value securely somewhere, so why not store them all? On the other…

Anecdotally, the "one domain flaw" has only ever happened for me for two websites over long time I've been using this system: getdropbox.com and amazon.com (using international amazon sites). Worst case scenario, you can request a password reset if the domain changes, because it's not the sort of thing that happens often. The "one password flaw" has never been an issue, but my bank uses proper two-factor authenticati…

Use any Google properties? Google.com and youtube.com (can) use the same password across two domains. I think there are others within google too. Or do they redirect to google.com for all logins? Meh. Like you said, it's a rare problem.

Thought of another problem: when you're forced to change your password. How do you encode that? Just add a version-N marker to the site name (which you have to remember)?

I'm not trying to sell you on 1Password, just point out problems with hash-only approaches :) And the storage-less nature is certainly a (big) plus when it works out, you're right.

--

And one possibly-significant danger you should be aware of: assuming you do something simple (which has the advantage of being buildable from scratch on any system, and easy to remember how), if your password is not globally unique then your security partly relies on the security of whoever else uses your password. If they lose it, anyone who knows that and guesses your username anywhere gets proof that you use the same password, so they can go test a bajillion sites immediately and with perfect success rates.

The standard technique for mitigating this is to salt the hash... but this is just another secret you have to store somewhere or memorize, so we're back where we started.

Re: 1Password 4 for Mac is here

#85

Post by lvh »

Osmium wrote: post #73

Hmm, 1Password always seemed like an overly-complicated (though polished) solution to a basic problem to me. Personally, I just use a variant of: one-way-hash(master-password + site-domain) Seems to work really well, doesn't require special software, allows me to replicate all my passwords on any computer, and passwords are unique to each website and seemingly-random. Use a strong master password and it seems like an…

As long as by one-way-hash you actually mean "key derivation function" and not actually hash, otherwise one leaked password means I get your master password, and hence all of your passwords, as long as your master password has an impossibly huge amount of entropy. (It probably doesn't.)

Seriously, use cryptographically random passwords.

Re: 1Password 4 for Mac is here

#86

Post by michaelx »

GotNothing wrote: post #69

Supported this company with the first version of 1Password. Then paid again for a family version of v3 last year, as well as the paid version for the iPhone which has been somewhat of a let down... now they want more money. All so I can store/use passwords. I've spent less money on other apps that I actually spend more time using daily. Guess I'll start searching for some alternatives before they start dropping suppo…

The guys of Binarynights (ForkLift) are working on an alternative called Locko: http://www.binarynights.com/blog/

It's available as an early beta and pretty promising. Competition is always good and Apple will pushing AgileBits further when they release Mavericks with the iCloud Keychain.

Re: 1Password 4 for Mac is here

#87

Post by crimcrom »

Osmium wrote: post #73

Hmm, 1Password always seemed like an overly-complicated (though polished) solution to a basic problem to me. Personally, I just use a variant of: one-way-hash(master-password + site-domain) Seems to work really well, doesn't require special software, allows me to replicate all my passwords on any computer, and passwords are unique to each website and seemingly-random. Use a strong master password and it seems like an…

I'd be interested in peeping your script just as a blueprint of how to set something like this up for myself. I'll likely end up ponying up for 1Password v4 anyway, but I fantasize about going lower-fi/simpler all the time, and this seems like a nice step in that direction. Are you doing this on OS X?

Re: 1Password 4 for Mac is here

#88

Post by Osmium »

lvh wrote: post #85
Osmium wrote: post #73

Hmm, 1Password always seemed like an overly-complicated (though polished) solution to a basic problem to me. Personally, I just use a variant of: one-way-hash(master-password + site-domain) Seems to work really well, doesn't require special software, allows me to replicate all my passwords on any computer, and passwords are unique to each website and seemingly-random. Use a strong master password and it seems like an…

As long as by one-way-hash you actually mean "key derivation function" and not actually hash, otherwise one leaked password means I get your master password, and hence all of your passwords, as long as your master password has an impossibly huge amount of entropy. (It probably doesn't.) Seriously, use cryptographically random passwords.

SuperGenPass uses MD5 or SHA512 (so they do use hashes). Personally, I use bcrypt with a cryptographically random and long master password, which is something at least.

I appreciate the input and advice anyway. Security being a system of compromises, my current stance is that the security offered by a system like this, despite its flaws, is greater than a password database system (with truly random passwords) because then both I need to keep the database physically secure and trust that e.g. 1Password have designed it properly (or that my cloud provider is capable of keeping it secure). Since 1Password has apparently had potential issues in the past I don't have too much faith, but perhaps I'm being overly cynical.

Comments like yours and Groxx's help me re-evalute what I'm doing though, so maybe I will switch to proper random passwords in future. So thanks again for the input!

Re: 1Password 4 for Mac is here

#89

Post by Osmium »

crimcrom wrote: post #87
Osmium wrote: post #73

Hmm, 1Password always seemed like an overly-complicated (though polished) solution to a basic problem to me. Personally, I just use a variant of: one-way-hash(master-password + site-domain) Seems to work really well, doesn't require special software, allows me to replicate all my passwords on any computer, and passwords are unique to each website and seemingly-random. Use a strong master password and it seems like an…

I'd be interested in peeping your script just as a blueprint of how to set something like this up for myself. I'll likely end up ponying up for 1Password v4 anyway, but I fantasize about going lower-fi/simpler all the time, and this seems like a nice step in that direction. Are you doing this on OS X?

Yep. Doing this on OS X and launching it via Alfred. I'd rather not share the script solely because I don't want to be responsible for some bug or bad idea that could cause you or anybody else problems.

However, I can share some inspiration to get started:

SuperGenPass (the original place I saw the idea): http://supergenpass.com

A fork of SuperGenPass using bcrypt/base85: https://github.com/cmcnulty/SuperGenPass

I wouldn't use either of the above because they're JavaScript-based, but someone has implemented it in Python: https://github.com/gfxmonk/supergenpass

I took that script as inspiration, modified it to use bcrypt, and then used the Python "keyring" module for access to the OS X keychain, and calling "osascript" to use an AppleScript one-liner to get Safari's front-most URL as an input.

It does potentially have the side-benefit of protecting against phishing attacks too, since if the domain is different, the password is different, so you can't be fooled into giving your password to the wrong website.

Re: 1Password 4 for Mac is here

#90

Post by Terretta »

pretz wrote: post #52

Watch out, the browser plugin upgrade instructions at http://learn.agilebits.com/1Password4/Mac/en/KB/v3-extension... require you to launch 1Password 3 to sync your browser, something I can't do after upgrading to 4 via the App Store. I guess I'll go dig it out of Time Machine ....

That's only if your browser widget hadn't sync'd.
Post reply on HN