4 ms·

Self hosting is my way to go. Had enough of this. > My wife uses a password manager. If your significant other doesn't (and I'm assuming you do by virtue of be

• thomasahle 10y ago
  > Self hosting is the way to go. Because you can secure it better than them? Or because you'll be less of a target?
  • danieldk 10y ago
    It's not clear to me whether the grandparent is referring to self-hosting password management or file synchronisation. However, one obvious security advantage of self-hosting is that you can use end-to-end encryption (which most cloud sync services don't support). E.g., I use Resilio Sync (formerly Bittorrent Sync) for file sync with encryption-only keys on my cloud peer. The cloud peer participates in the mesh, providing bandwidth, but if it gets hacked, no one can read the data. (Of course, I would prefer an open source solution. SyncThing does not have the right sharing model for me. So I was thrilled to hear about LibreVault on HN, which provides functionality similar to BTSync 1.x: https://librevault.com https://librevault.com)
    • whyagaindavid 10y ago
      Why not use firefox sync or chrome password sync? All data is locally encrypted before uploading.
    • aluhut 10y ago
      Both.
    • m0nty 10y ago
      > Resilio Sync (formerly Bittorrent Sync) Good job they changed their name. Couldn't get the product adopted in a corporate environment because of all the cries of "Witch! Witch!" when the suits saw the word Bittorrent in there.
      • danieldk 10y ago
        Indeed. And they spun out of Bittorrent Inc. completely, which is known for doing scammy things: https://en.wikipedia.org/wiki/ΜTorrent#Ads_and_malware https://en.wikipedia.org/wiki/ΜTorrent#Ads_and_malware
  • cm2187 10y ago
    Arguably, this leak seems to have been the result of password reuse. If you store your data with millions of people and 200 employees have a way to access it, your are exposed to 1. An interesting phishing target for a hacker 2. Lots of employees who can fuck up, a hacker only needs one, one time I'd say the probability you will be hacked is probably less if you use like a Synology with a reasonably strong password and automatic system updates.
  • loup-vaillant 10y ago
    For me, that would be most probably both if I were serious. Less of a target of course (I'm only one dude), but also much less attack surface. Basically install a trusty GNU/Linux or Open BSD, set up automatic updates, and block everything but SSH. Oh, and disable password based logins —use a public/private key pair of appropriate strength. Or better yet, ask actual security experts about that setup, they're likely to come up with something better (just as simple and more secure).
    • aluhut 10y ago
      Exactly my thoughts and I'm not alone here. There is a growing attitude against cloud infrastructure which together with the industries hype for it will lead to a interesting clash at some point. I hope this will bring out even more cloudless solutions in the future.
    • softawre 10y ago
      This sounds like a simple setup the average HN spouse would have no trouble with at all.
• cel1ne 10y ago
  I trust 1Password more than lastpass or keypassx.
  • tonyedgecombe 10y ago
    Why?
    • cel1ne 10y ago
      They are a company focussing on just one commercial product. Also I find there's some kind of pride in quality amongst mac-developers. Plus the lastpass vulnerability that was disclosed a couple of month ago seemed pretty basic and I haven't heard from serious vulnerabilities in 1password for a while. And that 1Password is local. All of that is just a feeling though, of course.
      • aluhut 10y ago
        > They are a company focussing on just one commercial product. Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Try keepass for excample. It's local too and it's open source.
        • cel1ne 10y ago
          Keepass doesn't even serve it's updates over HTTPS, so who knows what i'm getting. This fact alone make me lose all trust in it's developers.
          • aluhut 10y ago
            There have been some articles about automatic KeePass updates being vulnerable. This section clarifies the situation and its resolution. First of all, we would like to note that KeePass cannot update itself. KeePass does support checking for updates (optional; by downloading a version information file, comparing the available with the installed version number, and displaying a notification if necessary). However, it neither downloads nor installs any new version automatically. Users have to do this manually. KeePass can be downloaded from many servers (SourceForge with its many mirror servers, FossHub, etc.). In order to make sure that the downloaded file is official, users should check whether the file is digitally signed (Authenticode; all KeePass binaries are signed, including the installer, KeePass.exe and all other EXE and DLL files). The digital signature can be checked using Windows Explorer by right-clicking the file -> 'Properties' -> tab 'Digital Signatures' (the expected signer name is 'Open Source Developer, Dominik Reichl'). When running the installer, the UAC dialog displays the digital signature information, i.e. users who carefully read the UAC dialog do not have to inspect the file properties separately. This is recommended for all users, independent of where you download KeePass from. The KeePass website links to SourceForge for downloading KeePass. However, even if SourceForge (or the KeePass website) is compromised and serves a malicious download, users who check the digital signature will notice the attack and will not run the malware. Note that HTTPS cannot prevent an attack via a compromise of the download server; checking the digital signature does. The version information file is downloaded from the KeePass website over HTTP. Thus a man in the middle (someone who can intercept your connection to the KeePass website) could have returned an incorrect version information file, possibly making KeePass display a notification that a new KeePass version is available. However, the next steps (downloading and installing the new version) must be carried out by the user manually, and here users who check the digital signature will notice the attack. Resolution. In order to prevent a man in the middle from making KeePass display incorrect version information (even though this does not imply a successful attack, see above), the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS. http://keepass.info/help/kb/sec_issues.html#updsig http://keepass.info/help/kb/sec_issues.html#updsig
• rickycook 10y ago
  that's true, but 1p is far better than the open source options. it also has wifi sync between devices, so your fault never leaves your devices via anything but trusted, local connections if that's what you want
  • aluhut 10y ago
    How is this "far better"? It's just some additional feature you've described here. I wouldn't need it. So it does nothing better for me as far as I can see it.
• 10011100 10y ago
  a subscription service for $3 a month and you get the first 6 months for free. ...and now, a word from our sponsors.
  • danieldk 10y ago
    And that puts your data in a (password) silo.