7 ms·

This really rubs me the wrong way. Do not like the idea of my password manager bouncing around owners. Or infrastructure changes that new owners often push on t

This really rubs me the wrong way. Do not like the idea of my password manager bouncing around owners. Or infrastructure changes that new owners often push on the acquired company. If there's one business I REALLY do not want to be moving about, and I want as little churn as possible for, it's a password manager. The thing I liked about LastPass was that it seemed like the highly geeky, less startupy approach to password managers, more likely to be run for the long-term, less likely to be at risk of an acquisition. Going to look into Dashlane.

coldpie 11y ago
So, use an open source one.
- baldfat 11y ago
  What Open Source one was a convenient or as feature complete? Serious I love LastPass and I use it for everything BUT my banking. I just install the plugin on any device or open the webpage and I am all set with all my passwords.
  - coldpie 11y ago
    I don't know what features you like or find important. But you have to consider the licensing model as a feature when choosing your software. What happens if the software is sold or no longer maintained? For me, I use a plaintext file in a Truecrypt archive because I'm a massive dweeb.
    - baldfat 11y ago
      Truecrypt appears to be compromised. http://www.zdnet.com/article/truecrypt-critical-flaws-revealed-its-time-to-jump-ship/ http://www.zdnet.com/article/truecrypt-critical-flaws-reveal...
      - coldpie 11y ago
        I don't use Windows and that exploit isn't relevant to my use-case anyway (requires an evil local user). I'll move to another encryption program sometime, but it hasn't been a priority.
    - skrowl 11y ago
      You should be using VeraCrypt (https://veracrypt.codeplex.com/ https://veracrypt.codeplex.com/) rather than TrueCrypt. The authors of TrueCrypt even said to stop using it when they stopped maintaining it.
      - coldpie 11y ago
        Yeah, I should. But Arch doesn't provide packages for it yet and there's no realistic attack vector against my usage of TrueCrypt, so meh. It's good enough until Arch starts shipping packages.
        discreditable 11y ago
        You can use Linux's own cryptsetup to mount TrueCrypt volumes. No TrueCrypt needed. There's documentation on the ArchWiki. https://wiki.archlinux.org/index.php/TrueCrypt https://wiki.archlinux.org/index.php/TrueCrypt
        coldpie 11y ago
        Cool, thanks!
        baldfat 11y ago
        https://aur.archlinux.org/packages/veracrypt/ https://aur.archlinux.org/packages/veracrypt/
        coldpie 11y ago
        Sure, but at that point, why is maintaining my own package better than just using Truecrypt?
  - signal11 11y ago
    I used Lastpass for random web passwords (everything except banking/shopping) but moved to 1Password, mainly because they could sync between desktop and mobile without using the cloud.
- colinplamondon 11y ago
  Pretty key to have high quality mobile apps. Another big use case is having my teams be able to share passwords. Highly useful to be able to have access groups like "team" (everyone, things like Zendesk) "team-secure" (stuff with CC's, like Amazon), "dev" (general dev accounts), and "dev-secure" (compose.io access and the like). Makes it way faster to onboard new folks, and when people leave, to cleanly strip access and change passwords. The open source tools don't solve for those kinds of use cases, as far as I know. Just "I have one computer, and want to store my passwords on that one computer."
  - coldpie 11y ago
    Sure, but now you're trusting your entire infrastructure to a black box which can be passed around to anyone with enough money. There are trade-offs, and you have to consider everything when comparing features, including the license. Also, no way I would do anything important on my phone. These things seem to be about as secure as sieves.
  - TimJRobinson 11y ago
    We're looking for the exact same thing, mobile apps and team management. I've yet to find any open source software that does team management. Even multiple open source tools that work together to create this functionality would be great.
  - Keats 11y ago
    Doesn't solve the mobile apps part but we run https://passopolis.com/ https://passopolis.com/, a continuation of Mitro (https://www.mitro.co/ https://www.mitro.co/) that shutdown a couple of days ago. The server and the chrome/firefox extensions that are opensource (https://github.com/WeAreWizards/passopolis-server https://github.com/WeAreWizards/passopolis-server, https://github.com/WeAreWizards/passopolis-extensions https://github.com/WeAreWizards/passopolis-extensions). Right now it's mostly for us and other mitro escapees to continue using it so we didn't bother with the site design or the mobile apps. The exact feature you mention would be the first one to be done if we decide to monetize it though ! It would say opensource as well.
  - WorldMaker 11y ago
sri_cyberdude 11y ago
I use opensource keepass. Sync my password db via dropbox. Totally works for me.
- baldfat 11y ago
  Using Dropbox for Security seems like a oxymoron? I fail to see that as anything I am willing to use.
  - pixard 11y ago
    Why? The database itself is encrypted. Dropbox is just a easy way to sync it between devices.
  - zipperhead 11y ago
    I store the private keyfile outside of Dropbox. To me it's a very acceptable tradeoff.
  - sri_cyberdude 11y ago
    "Using Dropbox for sync". It's just an option. Password db is already encrypted, so it does not matter which service is used for sync :)
  - 746F7475 11y ago
    What makes you trust LastPass to spread your database to your devices more? And what makes Dropbox so bad?
    - MichaelGG 11y ago
      Dropbox runs a binary on your machine; that's enough to suspect them. Stick with an open source password manager and an open sync service (S3 plus a script? Or a third party client like Arq).
      - 746F7475 11y ago
        Yeah... I'm not in the RMS camp
ntpeters 11y ago
Dashlane looks really promising. Does anyone here have experience with it? Does it work as smoothly everywhere as LastPass did?
- quantumfoam 11y ago
  I'm not affiliated with Dashlane in any manner but I thought I'd chime in with my experience as a user. I used to use LastPass but lost a bit of confidence in them when they asked users to reset their master password [1] when an anomaly was found present in network traffic from one of their DBs. Prior to this I was looking at open source alternatives but the syncing and add-ons for each browser (which made logging in and generating passwords easier offered by Dashlane) really caught my attention. These features aren't unique to Dashlane, I'm sure. New sign-ups reap the benefits of premium features for a month or so, then you could send an invite to a friend and accrue 6 free months of premium service when they sign up (which is what I did) for free. They also offer a public password generator [2] page. They support the major browsers (Safari, Chrome, Firefox). Dashlane also has a "security dashboard" which keeps track of password expiration, reuse, and weak password usage, with a base analysis score that gets presented to you when action on a site is required. If you want something for offline use and that is hardware based, I'd recommend checking out the Mooltipass [3]. I hope this helps. [1] - https://www.duosecurity.com/blog/breaking-down-the-probable-lastpass-breach https://www.duosecurity.com/blog/breaking-down-the-probable-... [2] - https://www.dashlane.com/password-generator https://www.dashlane.com/password-generator [3] - http://www.themooltipass.com/ http://www.themooltipass.com/
  - fapjacks 11y ago
    I'm a happy user of Mooltipass! Definitely a great alternative.
- carlf79 11y ago
  I used Dashlane at a previous company. It felt like a much buggier LastPass. I avoided it to the extent possible. Most of the problems seemed to be the usual non-standard HTML / Javascript hijinks breaking things but LastPass was pretty good at dealing with that whereas Dashlane seemed to get confused much more often. They may have improved since then. This was about a year ago.

coldpie 11y ago

So, use an open source one.

baldfat 11y ago
What Open Source one was a convenient or as feature complete? Serious I love LastPass and I use it for everything BUT my banking. I just install the plugin on any device or open the webpage and I am all set with all my passwords.
- coldpie 11y ago
  I don't know what features you like or find important. But you have to consider the licensing model as a feature when choosing your software. What happens if the software is sold or no longer maintained? For me, I use a plaintext file in a Truecrypt archive because I'm a massive dweeb.
  - baldfat 11y ago
    Truecrypt appears to be compromised. http://www.zdnet.com/article/truecrypt-critical-flaws-revealed-its-time-to-jump-ship/ http://www.zdnet.com/article/truecrypt-critical-flaws-reveal...
    - coldpie 11y ago
      I don't use Windows and that exploit isn't relevant to my use-case anyway (requires an evil local user). I'll move to another encryption program sometime, but it hasn't been a priority.
  - skrowl 11y ago
    You should be using VeraCrypt (https://veracrypt.codeplex.com/ https://veracrypt.codeplex.com/) rather than TrueCrypt. The authors of TrueCrypt even said to stop using it when they stopped maintaining it.
    - coldpie 11y ago
      Yeah, I should. But Arch doesn't provide packages for it yet and there's no realistic attack vector against my usage of TrueCrypt, so meh. It's good enough until Arch starts shipping packages.
      - discreditable 11y ago
        You can use Linux's own cryptsetup to mount TrueCrypt volumes. No TrueCrypt needed. There's documentation on the ArchWiki. https://wiki.archlinux.org/index.php/TrueCrypt https://wiki.archlinux.org/index.php/TrueCrypt
        coldpie 11y ago
        Cool, thanks!
      - baldfat 11y ago
        https://aur.archlinux.org/packages/veracrypt/ https://aur.archlinux.org/packages/veracrypt/
        coldpie 11y ago
        Sure, but at that point, why is maintaining my own package better than just using Truecrypt?
- signal11 11y ago
  I used Lastpass for random web passwords (everything except banking/shopping) but moved to 1Password, mainly because they could sync between desktop and mobile without using the cloud.
colinplamondon 11y ago
Pretty key to have high quality mobile apps. Another big use case is having my teams be able to share passwords. Highly useful to be able to have access groups like "team" (everyone, things like Zendesk) "team-secure" (stuff with CC's, like Amazon), "dev" (general dev accounts), and "dev-secure" (compose.io access and the like). Makes it way faster to onboard new folks, and when people leave, to cleanly strip access and change passwords. The open source tools don't solve for those kinds of use cases, as far as I know. Just "I have one computer, and want to store my passwords on that one computer."
- coldpie 11y ago
  Sure, but now you're trusting your entire infrastructure to a black box which can be passed around to anyone with enough money. There are trade-offs, and you have to consider everything when comparing features, including the license. Also, no way I would do anything important on my phone. These things seem to be about as secure as sieves.
- TimJRobinson 11y ago
  We're looking for the exact same thing, mobile apps and team management. I've yet to find any open source software that does team management. Even multiple open source tools that work together to create this functionality would be great.
- Keats 11y ago
  Doesn't solve the mobile apps part but we run https://passopolis.com/ https://passopolis.com/, a continuation of Mitro (https://www.mitro.co/ https://www.mitro.co/) that shutdown a couple of days ago. The server and the chrome/firefox extensions that are opensource (https://github.com/WeAreWizards/passopolis-server https://github.com/WeAreWizards/passopolis-server, https://github.com/WeAreWizards/passopolis-extensions https://github.com/WeAreWizards/passopolis-extensions). Right now it's mostly for us and other mitro escapees to continue using it so we didn't bother with the site design or the mobile apps. The exact feature you mention would be the first one to be done if we decide to monetize it though ! It would say opensource as well.
- WorldMaker 11y ago

sri_cyberdude 11y ago

I use opensource keepass. Sync my password db via dropbox. Totally works for me.

baldfat 11y ago
Using Dropbox for Security seems like a oxymoron? I fail to see that as anything I am willing to use.
- pixard 11y ago
  Why? The database itself is encrypted. Dropbox is just a easy way to sync it between devices.
- zipperhead 11y ago
  I store the private keyfile outside of Dropbox. To me it's a very acceptable tradeoff.
- sri_cyberdude 11y ago
  "Using Dropbox for sync". It's just an option. Password db is already encrypted, so it does not matter which service is used for sync :)
- 746F7475 11y ago
  What makes you trust LastPass to spread your database to your devices more? And what makes Dropbox so bad?
  - MichaelGG 11y ago
    Dropbox runs a binary on your machine; that's enough to suspect them. Stick with an open source password manager and an open sync service (S3 plus a script? Or a third party client like Arq).
    - 746F7475 11y ago
      Yeah... I'm not in the RMS camp

ntpeters 11y ago

Dashlane looks really promising. Does anyone here have experience with it? Does it work as smoothly everywhere as LastPass did?

quantumfoam 11y ago
I'm not affiliated with Dashlane in any manner but I thought I'd chime in with my experience as a user. I used to use LastPass but lost a bit of confidence in them when they asked users to reset their master password [1] when an anomaly was found present in network traffic from one of their DBs. Prior to this I was looking at open source alternatives but the syncing and add-ons for each browser (which made logging in and generating passwords easier offered by Dashlane) really caught my attention. These features aren't unique to Dashlane, I'm sure. New sign-ups reap the benefits of premium features for a month or so, then you could send an invite to a friend and accrue 6 free months of premium service when they sign up (which is what I did) for free. They also offer a public password generator [2] page. They support the major browsers (Safari, Chrome, Firefox). Dashlane also has a "security dashboard" which keeps track of password expiration, reuse, and weak password usage, with a base analysis score that gets presented to you when action on a site is required. If you want something for offline use and that is hardware based, I'd recommend checking out the Mooltipass [3]. I hope this helps. [1] - https://www.duosecurity.com/blog/breaking-down-the-probable-lastpass-breach https://www.duosecurity.com/blog/breaking-down-the-probable-... [2] - https://www.dashlane.com/password-generator https://www.dashlane.com/password-generator [3] - http://www.themooltipass.com/ http://www.themooltipass.com/
- fapjacks 11y ago
  I'm a happy user of Mooltipass! Definitely a great alternative.
carlf79 11y ago
I used Dashlane at a previous company. It felt like a much buggier LastPass. I avoided it to the extent possible. Most of the problems seemed to be the usual non-standard HTML / Javascript hijinks breaking things but LastPass was pretty good at dealing with that whereas Dashlane seemed to get confused much more often. They may have improved since then. This was about a year ago.