Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

1Password for Linux beta

blog.1password.com

Post reply on HN
Print view View original

91–100 of 254 posts

Re: 1Password for Linux beta

#91

Post by mooman219 »

dastx wrote: post #81
bilal4hmed wrote: post #6

I would like to throw out Bitwarden out there. Cross platforms, works on everything and can be self hosted if you so desire.

Bitwarden is great, but I'm getting frustrated at their ridiculous excuses for not implementing fixes. For the longest time bitwarden has been broken in the firefox's private browsing after mozilla deprecated some apis due to security concerns. They've given alternatives but they are just refusing to fix it, to the point of basically saying mozilla needs to fix the issue. What's sad is a similar mechanism is used in…

+1 on 1Password's dedication to fixing issues. I had an obscure field selection issue on their web view and pinged the support email. It was fixed a few days later and they updated me on it.

I switched to 1Password from KeePass after 5 or so years because I just got tired of maintaining the data locally and keeping it in sync on my devices that I need the passwords on. I just backup the 1Password database locally now to calm some paranoia.

Re: 1Password for Linux beta

#92

Post by zwayhowder »

gilrain wrote: post #83
aaronfc wrote: post #45

I have been using LasPass since many years ago. There's an extension for Chrome and for Firefox. On Android I use the app and even though experience is not that "automatic" it works. I am surprised nobody mentioned LastPass is there any reason I should know?

LastPass was bought by LogMeIn, which raised some eyebrows. More recently, LogMeIn was bought by private equity vultures. That raises alarm bells for more people. It was that plus experiencing a lot of bugginess in their apps that got me to switch to 1Password. It's been a huge improvement.

I started moving the day LogMeIn acquired them. Lastpass used to have a very open policy of notification for potential security issues and I trusted them as much as one can trust a SaaS vendor. IIRC LogMeIn completely ignored a number of security issues in their applications and refused to acknowledge vulnerabilities.

Re: 1Password for Linux beta

#93

Post by kitsunesoba »

pekim wrote: post #44
stefan_ wrote: post #7

Oh good it's another Electron app and since there are only about 50 random dependencies mentioned in the package.json maintained by about 25 random people, exfiltration of all your passwords is only one of those being compromised away at any given point. And that is just the direct dependencies, I don't even want to look at the tree of it all. If you trust 1password with your passwords, really you are also trusting w…

The article says that it's written in rust, and also implies that it is a gtk app. That doesn't sound like an electron app to me. Did I miss something?

I believe it's an electron UI on top of a Rust core.

Re: 1Password for Linux beta

#94

Post by ohazi »

heavymark wrote: post #62
_zaqs wrote: post #41

In my opinion, it should be a bare minimum for something as important as a password manager to be free software. Others have mentioned Bitwarden and Keepass in this thread, both of which meet that criteria, but personally I'll stick with pass since I don't need a GUI.

Huh, you are saying that something that is so important you want for free, and that the company building this product for you should forgo money and work simply for free? Wouldn't the opposite make far more sense that something that is so important you should pay 'more' for? They are free options that you are welcome to, but for people who want more they pay for it.

The only way to guarantee that your keyring is secure long-term is for the source code (and change history) of your password manager to be inspectable and verifiable. A promise made by a corporation is not sufficient.

You can pay a corporation to buy a product with more features or better service. But you can't pay a corporation to hold or maintain a principle. There will always be someone who can offer them more money to hold the opposing principle. Principled people who work for a corporation eventually leave and are replaced with apethetic or differently principled people.

In this case, the principle is the privacy and security of the credentials in your keyring. How much money do you think a bad actor would be willing to pay for these? How much money do you think a bad actor would be able to pay to a corporation that secures credentials for a huge number of users, and who can push arbitrary updates without pesky source code validation getting in the way? You and I don't have enough money to win this game.

Look at another high value target for comparison -- browser extensions that have a large installed userbase. Browser extensions are frequently bought for tens to hundreds of thousands of dollars by ad/tracking/malware vendors in order to quietly replace the extension with one that does their bidding, without the users' knowledge.

What's the solution to this problem? Open-source, inspectable, verifyable software that is maintained by a person or a community that shares your principles. I trust the work of Jason Donenfeld (pass, wireguard) and Raymond Hill (uBlock Origin) more than the work of any corporation selling a similar product at any price.

The incentive structure of corporations in general precludes them from being given the level of trust required for certain products.

Re: 1Password for Linux beta

#95

Post by tialaramex »

_jal wrote: post #64
lomex123 wrote: post #52

Earlier quoted context omitted.

What does that even mean? There is free alternatives. I use 1password because it does a good job.

...as in freedom, not beer. It means the gp considers the problem space sensitive enough that the source should be available for inspection and modification.

The latter in particular means that if there's a thing you wish the software did and it doesn't you can fix that.

The more central to your everyday life something is, the more important that is. We take this for granted elsewhere in our lives.

You buy a refrigerator, the fridge company doesn't get to tell you that too bad you're only allowed to keep soda in their $80 dedicated "Soda rack" and that little shelf is only for vegetables - you can just put your soda there anyway, and if you want you can even make or buy a gizmo that dispenses cans just the way you want, screw their $80 plastic garbage, you made one from stainless steel scrap at community college.

You can take Free Software like pass to pieces to understand how it works too.

The thing I keep coming back to is how it uses 'tr' to get random passwords, because it's so simple and yet when you step back it's obviously the correct design. The method goes like this:

Unix 'tr' has a mode where it just ignores all input except the character classes you selected which pass through. So e.g. you can say you want passwords with just A-Z0-9. Hook it up to /dev/urandom and the device spews random bytes into it. All the ones that aren't acceptable are just thrown away. Then you catch the desired length of output from 'tr' and you're done.

I've seen software attempt to try to bodge a budget of random bits into a fixed character set, which is very difficult to do safely and correctly - but 'pass' just doesn't try to do that at all, why bother when you can make as many random bytes as you want anyway?

Re: 1Password for Linux beta

#96

Post by piaste »

mapgrep wrote: post #69
bilal4hmed wrote: post #6

I would like to throw out Bitwarden out there. Cross platforms, works on everything and can be self hosted if you so desire.

Not knocking the project, which sounds cool, but the absolute last thing I want to self host is a password database exposed to the internet. Hard pass on that element. 1password used to have a peer to peer sync mode that I loved. No need for a server anywhere. You would open it on your Mac and then open it on your phone and if they were on the same network they would self discover. Too inconvenient, perhaps, for most…

Bitwarden only ever decrypts the password database on the client, and the login credentials you send to the server are only a hash of your actual encryption key.

In principle, you could store your Bitwarden database on a public torrent at no risk to your security :)

So, if you do trust the Bitwarden software in the first place, self-hosting it shouldn't be any more dangerous than using the managed service, because the server security isn't really a critical part of the defence model. And self-hosting allows you to build from source, if you're inclined to paranoia (Even though the worst a malicious server could do is delete your database).

That said, I have still bothered to set up strict fail2ban rules on my BW instance, because why not.

Re: 1Password for Linux beta

#97

Post by dyingkneepad »

The reasonable person inside me wants to use a password manager, yet the paranoid in my brain is terrified. I read all those texts explaining why password managers are better, yet I am still afraid. I keep thinking in attack vectors such as someone compromising the Play Store and submitting a malicious app or other similar stuff.

I even have a Bitwarden account and have some passwords stored on it.

I also considered "offline" managers like KeepassXC, but synchronization gets way worse, and there's also the issue about trusting someone else with your mobile apps.

I will probably end up convincing myself and keep using Bitwarden more at some point, but I will also probably do some kind of password peppering/salting along with it.

Am I really the only one here?

Re: 1Password for Linux beta

#98

Post by domano »

dyingkneepad wrote: post #97

The reasonable person inside me wants to use a password manager, yet the paranoid in my brain is terrified. I read all those texts explaining why password managers are better, yet I am still afraid. I keep thinking in attack vectors such as someone compromising the Play Store and submitting a malicious app or other similar stuff. I even have a Bitwarden account and have some passwords stored on it. I also considered…

I have keepass and sync via google drive to Mac, Windows, Ubuntu, iPad and Android. No issues at all and i still have the file physically.

Re: 1Password for Linux beta

#99

Post by Erwin »

aaronfc wrote: post #45

I have been using LasPass since many years ago. There's an extension for Chrome and for Firefox. On Android I use the app and even though experience is not that "automatic" it works. I am surprised nobody mentioned LastPass is there any reason I should know?

I moved from LastPass due to various security concerns, but in Chrome/Linux 1Password is a worse experience. LastPass is just smarter about creating accounts and assigning new passwords, or updating if you change them.

Re: 1Password for Linux beta

#100

Post by dyingkneepad »

greatgib wrote: post #66

It blows my mind how you can be smart enough to use Linux and still use a proprietary closed source "password manager" on it. If it was something unimportant, like a game, ok. But a password manager? The key to all your digital life and secrets... And in addition from an American company that will upload your (encrypted) passwords to a cloud in US? And in addition, I find it deceptive that they try to confuse the pot…

It is worth mentioning that even if you're using an open source manager like Bitwarden, unless you're compiling your own apps and servers you're not really guarenteed to be running the code they host on github.
Post reply on HN