5 ms·

Looks neat. What's the elevator pitch on why to use this, over and above existing solutions like 1Password or LastPass?

by nixgeek 10y ago

jrcii 10y ago
Why use anything over the OS X keychain?
thirdsun 10y ago
That was my first question as well. Why use something other than 1Password? And one answer may be the one time expense (Secrets) vs subscription plan (1Password). Personally I prefer the web access and rock solid reputation of 1Password and gladly pay for it. Other than that Secrets looks fine.
- K0nserv 10y ago
  AFAIK 1Password still has a one time purchase option, but it's slightly harder to find. See https://agilebits.com/store https://agilebits.com/store
  - thirdsun 10y ago
    I see, but it seems to be on its way out.
    - mathgeek 10y ago
      It's been de-emphasized for a while now, but so far hasn't been completely eliminated.
- pfandrade 10y ago
  We need a chance to build a reputation :)
pfandrade 10y ago
By using an open standard to store your data besides being as transparent as possible on the storage format which you can verify on your own using third party tools (we have a post about that https://outercorner.com/2016/08/01/storage_format.html https://outercorner.com/2016/08/01/storage_format.html) we also benefit for the scrutiny OpenPGP as been through. We also wanted to make a simpler and safer option (and in our eyes, more pleasant to look at) to existing password managers.
- nixgeek 10y ago
  Are you able to go into details about implementation, particularly around libraries used in building the iOS and macOS applications, and their pedigrees? I'd argue that the implementation (or library) matters just as much as the standard (OpenPGP) when considering trust.
  - pfandrade 10y ago
    We've built our own solution (OpenPGP as per RFC 4880) on top of OpenSSL.
- codebeaker 10y ago
  1Password's format is also documented [1], though I'm not aware of any 3rd party clients to parse/work with it. That's actually a thing I was thinking about writing (I commented about trying to write something in C++14 in another front page thread, this was it) 1Password also uses standard encryption, from the link [1]: > We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. > In this document we will refer to “blocks of data”. Unless otherwise stated, blocks are the length of AES blocks, 128 bits (16 bytes). Edit: apparently Github lists [2] four libraries for reading OPVault, one each in Python, Haskell, Go and Ruby [1]: https://support.1password.com/opvault-design/ https://support.1password.com/opvault-design/ [2]: https://github.com/search?q=opvault&ref=opensearch https://github.com/search?q=opvault&ref=opensearch

Looks neat. What's the elevator pitch on why to use this, over and above existing solutions like 1Password or LastPass?

by nixgeek 10y ago

Looks neat. What's the elevator pitch on why to use this, over and above existing solutions like 1Password or LastPass?

jrcii 10y ago

Why use anything over the OS X keychain?

thirdsun 10y ago

That was my first question as well. Why use something other than 1Password? And one answer may be the one time expense (Secrets) vs subscription plan (1Password). Personally I prefer the web access and rock solid reputation of 1Password and gladly pay for it. Other than that Secrets looks fine.

K0nserv 10y ago
AFAIK 1Password still has a one time purchase option, but it's slightly harder to find. See https://agilebits.com/store https://agilebits.com/store
- thirdsun 10y ago
  I see, but it seems to be on its way out.
  - mathgeek 10y ago
    It's been de-emphasized for a while now, but so far hasn't been completely eliminated.
pfandrade 10y ago
We need a chance to build a reputation :)

pfandrade 10y ago

By using an open standard to store your data besides being as transparent as possible on the storage format which you can verify on your own using third party tools (we have a post about that https://outercorner.com/2016/08/01/storage_format.html https://outercorner.com/2016/08/01/storage_format.html) we also benefit for the scrutiny OpenPGP as been through. We also wanted to make a simpler and safer option (and in our eyes, more pleasant to look at) to existing password managers.

nixgeek 10y ago
Are you able to go into details about implementation, particularly around libraries used in building the iOS and macOS applications, and their pedigrees? I'd argue that the implementation (or library) matters just as much as the standard (OpenPGP) when considering trust.
- pfandrade 10y ago
  We've built our own solution (OpenPGP as per RFC 4880) on top of OpenSSL.
codebeaker 10y ago
1Password's format is also documented [1], though I'm not aware of any 3rd party clients to parse/work with it. That's actually a thing I was thinking about writing (I commented about trying to write something in C++14 in another front page thread, this was it) 1Password also uses standard encryption, from the link [1]: > We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. > In this document we will refer to “blocks of data”. Unless otherwise stated, blocks are the length of AES blocks, 128 bits (16 bytes). Edit: apparently Github lists [2] four libraries for reading OPVault, one each in Python, Haskell, Go and Ruby [1]: https://support.1password.com/opvault-design/ https://support.1password.com/opvault-design/ [2]: https://github.com/search?q=opvault&ref=opensearch https://github.com/search?q=opvault&ref=opensearch