5 ms·

I trust 1Password more than lastpass or keypassx.

by cel1ne 10y ago

tonyedgecombe 10y ago
Why?
- cel1ne 10y ago
  They are a company focussing on just one commercial product. Also I find there's some kind of pride in quality amongst mac-developers. Plus the lastpass vulnerability that was disclosed a couple of month ago seemed pretty basic and I haven't heard from serious vulnerabilities in 1password for a while. And that 1Password is local. All of that is just a feeling though, of course.
  - aluhut 10y ago
    > They are a company focussing on just one commercial product. Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Try keepass for excample. It's local too and it's open source.
    - cel1ne 10y ago
      Keepass doesn't even serve it's updates over HTTPS, so who knows what i'm getting. This fact alone make me lose all trust in it's developers.
      - aluhut 10y ago
        There have been some articles about automatic KeePass updates being vulnerable. This section clarifies the situation and its resolution. First of all, we would like to note that KeePass cannot update itself. KeePass does support checking for updates (optional; by downloading a version information file, comparing the available with the installed version number, and displaying a notification if necessary). However, it neither downloads nor installs any new version automatically. Users have to do this manually. KeePass can be downloaded from many servers (SourceForge with its many mirror servers, FossHub, etc.). In order to make sure that the downloaded file is official, users should check whether the file is digitally signed (Authenticode; all KeePass binaries are signed, including the installer, KeePass.exe and all other EXE and DLL files). The digital signature can be checked using Windows Explorer by right-clicking the file -> 'Properties' -> tab 'Digital Signatures' (the expected signer name is 'Open Source Developer, Dominik Reichl'). When running the installer, the UAC dialog displays the digital signature information, i.e. users who carefully read the UAC dialog do not have to inspect the file properties separately. This is recommended for all users, independent of where you download KeePass from. The KeePass website links to SourceForge for downloading KeePass. However, even if SourceForge (or the KeePass website) is compromised and serves a malicious download, users who check the digital signature will notice the attack and will not run the malware. Note that HTTPS cannot prevent an attack via a compromise of the download server; checking the digital signature does. The version information file is downloaded from the KeePass website over HTTP. Thus a man in the middle (someone who can intercept your connection to the KeePass website) could have returned an incorrect version information file, possibly making KeePass display a notification that a new KeePass version is available. However, the next steps (downloading and installing the new version) must be carried out by the user manually, and here users who check the digital signature will notice the attack. Resolution. In order to prevent a man in the middle from making KeePass display incorrect version information (even though this does not imply a successful attack, see above), the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS. http://keepass.info/help/kb/sec_issues.html#updsig http://keepass.info/help/kb/sec_issues.html#updsig
    - cel1ne 10y ago
      > Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Actually it does. They depend on selling their product to security-savy users, so they will ensure it's quality.
      - aluhut 10y ago
        > They depend on selling their product to security-savy users No they don't. They just need some good advertising and they can sell to people who didn't even know they need it (fear works very well here). Really tech savy users will just move on if they don't like something or won't even come in because it's not open source or because of data thrift. The untechy customer will stick to what he has. On the other side: if there is just one company better then them, with better advertising they'll have to see how they can get money with just this product. There are many creative solutions out there. A sheer endless horizon of possibilities I don't even want to think about.
      - randac 10y ago
        > They depend on selling their product to security-savy users, so they will ensure it's quality. This is a dangerously naive attitude.
- guitarbill 10y ago
  For me, it's that 1Password runs locally and doesn't need to phone home, whereas LastPass is "cloud". Also, LastPass being owned by LogMeIn doesn't sit right with me, but that's definitely personal. No idea about Keepass(x), although I found that ecosystem to be confusing, with different apps for different platforms you might accidentally download a rouge one on e.g. your phone. I know, paranoia.
  - aluhut 10y ago
    My mother is able to run keepass and she still has a problem with double clicking. But sure. Looking for yourself is not easy. You have to do something for yourself and not just throw money on some company that is depending on this one product. Not sure if your paranoia is directed the right way here though.
    - Karzyn 10y ago
      Just because the thing that works for another person isn't the same as what you do doesn't mean that you need to be insulting towards them.
  - moonshinefe 10y ago
    LastPass is only "cloud" in the sense that it takes the AES encrypted files your browser encrypts locally, then allows you to access them from multiple locations if you have the right pw (and 2 factor auth if you use it).
  - cel1ne 10y ago
    Keepass isn't served over HTTPS. http://www.lifehacker.com.au/2016/06/keepass-vulnerability-lets-attackers-steal-passwords-but-dont-expect-it-to-be-patched/ http://www.lifehacker.com.au/2016/06/keepass-vulnerability-l...
    - aluhut 10y ago
      http://keepass.info/help/kb/sec_issues.html#updsig http://keepass.info/help/kb/sec_issues.html#updsig There have been some articles about automatic KeePass updates being vulnerable. This section clarifies the situation and its resolution. First of all, we would like to note that KeePass cannot update itself. KeePass does support checking for updates (optional; by downloading a version information file, comparing the available with the installed version number, and displaying a notification if necessary). However, it neither downloads nor installs any new version automatically. Users have to do this manually. KeePass can be downloaded from many servers (SourceForge with its many mirror servers, FossHub, etc.). In order to make sure that the downloaded file is official, users should check whether the file is digitally signed (Authenticode; all KeePass binaries are signed, including the installer, KeePass.exe and all other EXE and DLL files). The digital signature can be checked using Windows Explorer by right-clicking the file -> 'Properties' -> tab 'Digital Signatures' (the expected signer name is 'Open Source Developer, Dominik Reichl'). When running the installer, the UAC dialog displays the digital signature information, i.e. users who carefully read the UAC dialog do not have to inspect the file properties separately. This is recommended for all users, independent of where you download KeePass from. The KeePass website links to SourceForge for downloading KeePass. However, even if SourceForge (or the KeePass website) is compromised and serves a malicious download, users who check the digital signature will notice the attack and will not run the malware. Note that HTTPS cannot prevent an attack via a compromise of the download server; checking the digital signature does. The version information file is downloaded from the KeePass website over HTTP. Thus a man in the middle (someone who can intercept your connection to the KeePass website) could have returned an incorrect version information file, possibly making KeePass display a notification that a new KeePass version is available. However, the next steps (downloading and installing the new version) must be carried out by the user manually, and here users who check the digital signature will notice the attack. Resolution. In order to prevent a man in the middle from making KeePass display incorrect version information (even though this does not imply a successful attack, see above), the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.
the_other 10y ago
I use them too, and like how they operate. They have the best update notes of any company I've seen (on Apple's App store) - enthusiastic, entertaining, detailed, consistent. None of this guarantees quality, but it certainly paints a picture of a committed team.

I trust 1Password more than lastpass or keypassx.

by cel1ne 10y ago

I trust 1Password more than lastpass or keypassx.

tonyedgecombe 10y ago

Why?

cel1ne 10y ago
They are a company focussing on just one commercial product. Also I find there's some kind of pride in quality amongst mac-developers. Plus the lastpass vulnerability that was disclosed a couple of month ago seemed pretty basic and I haven't heard from serious vulnerabilities in 1password for a while. And that 1Password is local. All of that is just a feeling though, of course.
- aluhut 10y ago
  > They are a company focussing on just one commercial product. Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Try keepass for excample. It's local too and it's open source.
  - cel1ne 10y ago
    Keepass doesn't even serve it's updates over HTTPS, so who knows what i'm getting. This fact alone make me lose all trust in it's developers.
    - aluhut 10y ago
      There have been some articles about automatic KeePass updates being vulnerable. This section clarifies the situation and its resolution. First of all, we would like to note that KeePass cannot update itself. KeePass does support checking for updates (optional; by downloading a version information file, comparing the available with the installed version number, and displaying a notification if necessary). However, it neither downloads nor installs any new version automatically. Users have to do this manually. KeePass can be downloaded from many servers (SourceForge with its many mirror servers, FossHub, etc.). In order to make sure that the downloaded file is official, users should check whether the file is digitally signed (Authenticode; all KeePass binaries are signed, including the installer, KeePass.exe and all other EXE and DLL files). The digital signature can be checked using Windows Explorer by right-clicking the file -> 'Properties' -> tab 'Digital Signatures' (the expected signer name is 'Open Source Developer, Dominik Reichl'). When running the installer, the UAC dialog displays the digital signature information, i.e. users who carefully read the UAC dialog do not have to inspect the file properties separately. This is recommended for all users, independent of where you download KeePass from. The KeePass website links to SourceForge for downloading KeePass. However, even if SourceForge (or the KeePass website) is compromised and serves a malicious download, users who check the digital signature will notice the attack and will not run the malware. Note that HTTPS cannot prevent an attack via a compromise of the download server; checking the digital signature does. The version information file is downloaded from the KeePass website over HTTP. Thus a man in the middle (someone who can intercept your connection to the KeePass website) could have returned an incorrect version information file, possibly making KeePass display a notification that a new KeePass version is available. However, the next steps (downloading and installing the new version) must be carried out by the user manually, and here users who check the digital signature will notice the attack. Resolution. In order to prevent a man in the middle from making KeePass display incorrect version information (even though this does not imply a successful attack, see above), the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS. http://keepass.info/help/kb/sec_issues.html#updsig http://keepass.info/help/kb/sec_issues.html#updsig
  - cel1ne 10y ago
    > Or: "they are a company depending on just one commercial product". Doesn't look that good anymore hm? Actually it does. They depend on selling their product to security-savy users, so they will ensure it's quality.
    - aluhut 10y ago
      > They depend on selling their product to security-savy users No they don't. They just need some good advertising and they can sell to people who didn't even know they need it (fear works very well here). Really tech savy users will just move on if they don't like something or won't even come in because it's not open source or because of data thrift. The untechy customer will stick to what he has. On the other side: if there is just one company better then them, with better advertising they'll have to see how they can get money with just this product. There are many creative solutions out there. A sheer endless horizon of possibilities I don't even want to think about.
    - randac 10y ago
      > They depend on selling their product to security-savy users, so they will ensure it's quality. This is a dangerously naive attitude.
guitarbill 10y ago
For me, it's that 1Password runs locally and doesn't need to phone home, whereas LastPass is "cloud". Also, LastPass being owned by LogMeIn doesn't sit right with me, but that's definitely personal. No idea about Keepass(x), although I found that ecosystem to be confusing, with different apps for different platforms you might accidentally download a rouge one on e.g. your phone. I know, paranoia.
- aluhut 10y ago
  My mother is able to run keepass and she still has a problem with double clicking. But sure. Looking for yourself is not easy. You have to do something for yourself and not just throw money on some company that is depending on this one product. Not sure if your paranoia is directed the right way here though.
  - Karzyn 10y ago
    Just because the thing that works for another person isn't the same as what you do doesn't mean that you need to be insulting towards them.
- moonshinefe 10y ago
  LastPass is only "cloud" in the sense that it takes the AES encrypted files your browser encrypts locally, then allows you to access them from multiple locations if you have the right pw (and 2 factor auth if you use it).
- cel1ne 10y ago
  Keepass isn't served over HTTPS. http://www.lifehacker.com.au/2016/06/keepass-vulnerability-lets-attackers-steal-passwords-but-dont-expect-it-to-be-patched/ http://www.lifehacker.com.au/2016/06/keepass-vulnerability-l...
  - aluhut 10y ago
    http://keepass.info/help/kb/sec_issues.html#updsig http://keepass.info/help/kb/sec_issues.html#updsig There have been some articles about automatic KeePass updates being vulnerable. This section clarifies the situation and its resolution. First of all, we would like to note that KeePass cannot update itself. KeePass does support checking for updates (optional; by downloading a version information file, comparing the available with the installed version number, and displaying a notification if necessary). However, it neither downloads nor installs any new version automatically. Users have to do this manually. KeePass can be downloaded from many servers (SourceForge with its many mirror servers, FossHub, etc.). In order to make sure that the downloaded file is official, users should check whether the file is digitally signed (Authenticode; all KeePass binaries are signed, including the installer, KeePass.exe and all other EXE and DLL files). The digital signature can be checked using Windows Explorer by right-clicking the file -> 'Properties' -> tab 'Digital Signatures' (the expected signer name is 'Open Source Developer, Dominik Reichl'). When running the installer, the UAC dialog displays the digital signature information, i.e. users who carefully read the UAC dialog do not have to inspect the file properties separately. This is recommended for all users, independent of where you download KeePass from. The KeePass website links to SourceForge for downloading KeePass. However, even if SourceForge (or the KeePass website) is compromised and serves a malicious download, users who check the digital signature will notice the attack and will not run the malware. Note that HTTPS cannot prevent an attack via a compromise of the download server; checking the digital signature does. The version information file is downloaded from the KeePass website over HTTP. Thus a man in the middle (someone who can intercept your connection to the KeePass website) could have returned an incorrect version information file, possibly making KeePass display a notification that a new KeePass version is available. However, the next steps (downloading and installing the new version) must be carried out by the user manually, and here users who check the digital signature will notice the attack. Resolution. In order to prevent a man in the middle from making KeePass display incorrect version information (even though this does not imply a successful attack, see above), the version information file is now digitally signed (using RSA-4096 and SHA-512). KeePass 2.34 and higher only accept such a digitally signed version information file. Furthermore, the version information file is now downloaded over HTTPS.

the_other 10y ago

I use them too, and like how they operate. They have the best update notes of any company I've seen (on Apple's App store) - enthusiastic, entertaining, detailed, consistent. None of this guarantees quality, but it certainly paints a picture of a committed team.