4 ms·

Feedback for the author: You have copied LastPass, however LastPass isn't a good design to copy. Passwords and sensitive info isn't only for "Sites". You also

Feedback for the author: You have copied LastPass, however LastPass isn't a good design to copy. Passwords and sensitive info isn't only for "Sites". You also have Wifi networks, routers, credit cards, etc, not to mention many people need custom fields, like for Apple's stupid secret questions, or for recovery codes, etc. You've also taken the name Site too literally. Throwing an error if the URL is empty is a mistake. Don't assume the user doesn't know what he's doing and I doubt this app needs URLs to function. I never liked LastPass because it's rigid on how you can store data. Surely username+password+ website is common enough, but give the user the opportunity to add custom fields. This is how KeePass and 1Password work, it's a proved design ;-) On Android, when using the password generator on editing a new site, in order to complete the process I had to copy/paste the new password. This is bad, on Android at least, as the clipboard on Android is public and any app can register a listener for clipboard events. And again, on viewing the password, it got truncated, so the user is forced to copy/paste it. I'm also uneasy about having my data uploaded to your servers. I realize data is encrypted before that, but given this is supposed to be open source, it would have been better if the apps were able to work offline or with Dropbox, then add the server stuff as an add-on.

zokier 10y ago
> On Android, when using the password generator on editing a new site, in order to complete the process I had to copy/paste the new password. This is bad, on Android at least, as the clipboard on Android is public and any so can listen to it. And again, on viewing the password, it got truncated, so the user is forced to copy/paste it. I think KeePass circumvents this by having a virtual keyboard that is used to deliver the passwords securely to the destination application/form. I haven't heard of any better solutions, or any serious attacks against the virtual keyboard method.
- synotna 10y ago
  LastPass does this
  - mivv 10y ago
    Only for apps it doesn't support natively or can't find the form fields for. For most apps it will autofill the fields if it can find them. Sometimes your only option is copy/paste tho.
- camiller 10y ago
  This clipboard vulnerability is new to me, but after some research it appears the keepass2android doesn't use the clipboard, but keepassdroid does.
mordocai 10y ago
> I never liked LastPass because it's rigid on how you can store data. Surely username+password+ website is common enough, but give the user the opportunity to add custom fields. This is how KeePass and 1Password work, it's a proved design ;-) While it isn't quite as nice as KeePass and 1password, lastpass does have secure notes for things that aren't sites.
CharlesW 10y ago
> I never liked LastPass because it's rigid on how you can store data. I'm not sure when you last checked it out, but the current version of LastPass allows you to create as many custom templates as you like.
- bad_user 10y ago
  I try it out from time to time. Yes, it now allows creating custom templates, but that doesn't work in the mobile apps or in the OS X app, it is clumsy and because it isn't a website, the forms you create won't auto-complete AFAIK.
xxkylexx 10y ago
Thanks for the feedback! I agree that the whole site model may have been taken too far. I have plans for adding other "types" that will support other models. As a first simple step, we can add a free-form notes entry that you can put in whatever you want along with a descriptive name. For android, there is a issue that is being tracked for adding autofill support. iOS already supports this, I just did not have time to get it in for the 1.0.0 release on Android (see https://github.com/bitwarden/mobile/issues/1 https://github.com/bitwarden/mobile/issues/1). Also, I am an iOS user so I do not have a lot of experience with how android "should work" so that makes things a bit slower for me doing development there.
MaKleSoft 10y ago
> You have copied LastPass, however LastPass isn't a good design to copy. > I never liked LastPass because it's rigid on how you can store data. Surely username+password+ website is common enough, but give the user the opportunity to add custom fields. This is how KeePass and 1Password work, it's a proved design I agree 100%. For an open source alternative that offers the same flexibility while still trying to be as easy to use as possible, check out https://padlock.io https://padlock.io! (Disclaimer: I'm the author)

zokier 10y ago

> On Android, when using the password generator on editing a new site, in order to complete the process I had to copy/paste the new password. This is bad, on Android at least, as the clipboard on Android is public and any so can listen to it. And again, on viewing the password, it got truncated, so the user is forced to copy/paste it. I think KeePass circumvents this by having a virtual keyboard that is used to deliver the passwords securely to the destination application/form. I haven't heard of any better solutions, or any serious attacks against the virtual keyboard method.

synotna 10y ago
LastPass does this
- mivv 10y ago
  Only for apps it doesn't support natively or can't find the form fields for. For most apps it will autofill the fields if it can find them. Sometimes your only option is copy/paste tho.
camiller 10y ago
This clipboard vulnerability is new to me, but after some research it appears the keepass2android doesn't use the clipboard, but keepassdroid does.

mordocai 10y ago

> I never liked LastPass because it's rigid on how you can store data. Surely username+password+ website is common enough, but give the user the opportunity to add custom fields. This is how KeePass and 1Password work, it's a proved design ;-) While it isn't quite as nice as KeePass and 1password, lastpass does have secure notes for things that aren't sites.

CharlesW 10y ago

> I never liked LastPass because it's rigid on how you can store data. I'm not sure when you last checked it out, but the current version of LastPass allows you to create as many custom templates as you like.

bad_user 10y ago
I try it out from time to time. Yes, it now allows creating custom templates, but that doesn't work in the mobile apps or in the OS X app, it is clumsy and because it isn't a website, the forms you create won't auto-complete AFAIK.

xxkylexx 10y ago

Thanks for the feedback! I agree that the whole site model may have been taken too far. I have plans for adding other "types" that will support other models. As a first simple step, we can add a free-form notes entry that you can put in whatever you want along with a descriptive name. For android, there is a issue that is being tracked for adding autofill support. iOS already supports this, I just did not have time to get it in for the 1.0.0 release on Android (see https://github.com/bitwarden/mobile/issues/1 https://github.com/bitwarden/mobile/issues/1). Also, I am an iOS user so I do not have a lot of experience with how android "should work" so that makes things a bit slower for me doing development there.

MaKleSoft 10y ago

> You have copied LastPass, however LastPass isn't a good design to copy. > I never liked LastPass because it's rigid on how you can store data. Surely username+password+ website is common enough, but give the user the opportunity to add custom fields. This is how KeePass and 1Password work, it's a proved design I agree 100%. For an open source alternative that offers the same flexibility while still trying to be as easy to use as possible, check out https://padlock.io https://padlock.io! (Disclaimer: I'm the author)