3 ms·

So, use an open source one.

by coldpie 11y ago

baldfat 11y ago
What Open Source one was a convenient or as feature complete? Serious I love LastPass and I use it for everything BUT my banking. I just install the plugin on any device or open the webpage and I am all set with all my passwords.
- coldpie 11y ago
  I don't know what features you like or find important. But you have to consider the licensing model as a feature when choosing your software. What happens if the software is sold or no longer maintained? For me, I use a plaintext file in a Truecrypt archive because I'm a massive dweeb.
  - baldfat 11y ago
    Truecrypt appears to be compromised. http://www.zdnet.com/article/truecrypt-critical-flaws-revealed-its-time-to-jump-ship/ http://www.zdnet.com/article/truecrypt-critical-flaws-reveal...
    - coldpie 11y ago
      I don't use Windows and that exploit isn't relevant to my use-case anyway (requires an evil local user). I'll move to another encryption program sometime, but it hasn't been a priority.
  - skrowl 11y ago
    You should be using VeraCrypt (https://veracrypt.codeplex.com/ https://veracrypt.codeplex.com/) rather than TrueCrypt. The authors of TrueCrypt even said to stop using it when they stopped maintaining it.
    - coldpie 11y ago
      Yeah, I should. But Arch doesn't provide packages for it yet and there's no realistic attack vector against my usage of TrueCrypt, so meh. It's good enough until Arch starts shipping packages.
      - discreditable 11y ago
        You can use Linux's own cryptsetup to mount TrueCrypt volumes. No TrueCrypt needed. There's documentation on the ArchWiki. https://wiki.archlinux.org/index.php/TrueCrypt https://wiki.archlinux.org/index.php/TrueCrypt
        coldpie 11y ago
        Cool, thanks!
      - baldfat 11y ago
        https://aur.archlinux.org/packages/veracrypt/ https://aur.archlinux.org/packages/veracrypt/
        coldpie 11y ago
        Sure, but at that point, why is maintaining my own package better than just using Truecrypt?
- signal11 11y ago
  I used Lastpass for random web passwords (everything except banking/shopping) but moved to 1Password, mainly because they could sync between desktop and mobile without using the cloud.
colinplamondon 11y ago
Pretty key to have high quality mobile apps. Another big use case is having my teams be able to share passwords. Highly useful to be able to have access groups like "team" (everyone, things like Zendesk) "team-secure" (stuff with CC's, like Amazon), "dev" (general dev accounts), and "dev-secure" (compose.io access and the like). Makes it way faster to onboard new folks, and when people leave, to cleanly strip access and change passwords. The open source tools don't solve for those kinds of use cases, as far as I know. Just "I have one computer, and want to store my passwords on that one computer."
- coldpie 11y ago
  Sure, but now you're trusting your entire infrastructure to a black box which can be passed around to anyone with enough money. There are trade-offs, and you have to consider everything when comparing features, including the license. Also, no way I would do anything important on my phone. These things seem to be about as secure as sieves.
- TimJRobinson 11y ago
  We're looking for the exact same thing, mobile apps and team management. I've yet to find any open source software that does team management. Even multiple open source tools that work together to create this functionality would be great.
- Keats 11y ago
  Doesn't solve the mobile apps part but we run https://passopolis.com/ https://passopolis.com/, a continuation of Mitro (https://www.mitro.co/ https://www.mitro.co/) that shutdown a couple of days ago. The server and the chrome/firefox extensions that are opensource (https://github.com/WeAreWizards/passopolis-server https://github.com/WeAreWizards/passopolis-server, https://github.com/WeAreWizards/passopolis-extensions https://github.com/WeAreWizards/passopolis-extensions). Right now it's mostly for us and other mitro escapees to continue using it so we didn't bother with the site design or the mobile apps. The exact feature you mention would be the first one to be done if we decide to monetize it though ! It would say opensource as well.
- WorldMaker 11y ago

So, use an open source one.

by coldpie 11y ago

So, use an open source one.

What Open Source one was a convenient or as feature complete? Serious I love LastPass and I use it for everything BUT my banking. I just install the plugin on any device or open the webpage and I am all set with all my passwords.

coldpie 11y ago
I don't know what features you like or find important. But you have to consider the licensing model as a feature when choosing your software. What happens if the software is sold or no longer maintained? For me, I use a plaintext file in a Truecrypt archive because I'm a massive dweeb.
- baldfat 11y ago
  Truecrypt appears to be compromised. http://www.zdnet.com/article/truecrypt-critical-flaws-revealed-its-time-to-jump-ship/ http://www.zdnet.com/article/truecrypt-critical-flaws-reveal...
  - coldpie 11y ago
    I don't use Windows and that exploit isn't relevant to my use-case anyway (requires an evil local user). I'll move to another encryption program sometime, but it hasn't been a priority.
- skrowl 11y ago
  You should be using VeraCrypt (https://veracrypt.codeplex.com/ https://veracrypt.codeplex.com/) rather than TrueCrypt. The authors of TrueCrypt even said to stop using it when they stopped maintaining it.
  - coldpie 11y ago
    Yeah, I should. But Arch doesn't provide packages for it yet and there's no realistic attack vector against my usage of TrueCrypt, so meh. It's good enough until Arch starts shipping packages.
    - discreditable 11y ago
      You can use Linux's own cryptsetup to mount TrueCrypt volumes. No TrueCrypt needed. There's documentation on the ArchWiki. https://wiki.archlinux.org/index.php/TrueCrypt https://wiki.archlinux.org/index.php/TrueCrypt
      - coldpie 11y ago
        Cool, thanks!
    - baldfat 11y ago
      https://aur.archlinux.org/packages/veracrypt/ https://aur.archlinux.org/packages/veracrypt/
      - coldpie 11y ago
        Sure, but at that point, why is maintaining my own package better than just using Truecrypt?
signal11 11y ago
I used Lastpass for random web passwords (everything except banking/shopping) but moved to 1Password, mainly because they could sync between desktop and mobile without using the cloud.

colinplamondon 11y ago

Pretty key to have high quality mobile apps. Another big use case is having my teams be able to share passwords. Highly useful to be able to have access groups like "team" (everyone, things like Zendesk) "team-secure" (stuff with CC's, like Amazon), "dev" (general dev accounts), and "dev-secure" (compose.io access and the like). Makes it way faster to onboard new folks, and when people leave, to cleanly strip access and change passwords. The open source tools don't solve for those kinds of use cases, as far as I know. Just "I have one computer, and want to store my passwords on that one computer."

coldpie 11y ago
Sure, but now you're trusting your entire infrastructure to a black box which can be passed around to anyone with enough money. There are trade-offs, and you have to consider everything when comparing features, including the license. Also, no way I would do anything important on my phone. These things seem to be about as secure as sieves.
TimJRobinson 11y ago
We're looking for the exact same thing, mobile apps and team management. I've yet to find any open source software that does team management. Even multiple open source tools that work together to create this functionality would be great.
Keats 11y ago
Doesn't solve the mobile apps part but we run https://passopolis.com/ https://passopolis.com/, a continuation of Mitro (https://www.mitro.co/ https://www.mitro.co/) that shutdown a couple of days ago. The server and the chrome/firefox extensions that are opensource (https://github.com/WeAreWizards/passopolis-server https://github.com/WeAreWizards/passopolis-server, https://github.com/WeAreWizards/passopolis-extensions https://github.com/WeAreWizards/passopolis-extensions). Right now it's mostly for us and other mitro escapees to continue using it so we didn't bother with the site design or the mobile apps. The exact feature you mention would be the first one to be done if we decide to monetize it though ! It would say opensource as well.
WorldMaker 11y ago