7 ms·

Sigh. I can't ignore the red flags anymore. Time to switch off. Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I n

Sigh. I can't ignore the red flags anymore. Time to switch off. Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I need something like lastpass. Don't suppose there's anything out there that can import the lastpass db?

k_sh 10y ago
Dashlane does! Been using it for a year or so. Good experience. https://csdashlane.zendesk.com/hc/en-us/articles/202699141-How-to-Import-from-LastPass https://csdashlane.zendesk.com/hc/en-us/articles/202699141-H...
- Blackthorn 10y ago
  I will fully investigate Dashlane. I turned a lot of my non-technical friends onto password managers, and will need to update my recommendation for them with something that can both import the LastPass DB and be as convenient to use.
- smrq 10y ago
  I switched away from Dashlane after several years because their software has been getting progressively more unstable. Force-killing the Dashlane executable because the browser plugin has locked up got pretty old.
- cypherpunks01 10y ago
  I love Dashlane, it's pretty magical and a massive timesaver. I use it on OSX primarily but it syncs to my Android very well. There's an unfixed bug in the OSX client where it crashes rarely (every couple months for me) and I have to kill the process manually and restart, but it has very minor impact. Is there any security analysis or consensus on Dashlane security vs. other password managers?
  - k_sh 10y ago
    I have this problem every couple weeks as well. Killing DashlaneMASService solves it.
icc97 10y ago
Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me. Autofills my logins and fully integrates with Firefoxes password manager so that you don't get conflicts between the browser and your password manager trying to save the same password. Also doesn't add the stupid CSS hacking that LastPass does to add their logo into the password fields breaking various site's styles. [0]: http://keepass.info/help/base/importexport.html
- sillysaurus3 10y ago
  Clickable: http://keepass.info/help/base/importexport.html http://keepass.info/help/base/importexport.html
- ac29 10y ago
  Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox. Sounds like a huge pain compared to LastPass, as well as increasing attack surface.
  - tscs37 10y ago
    It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.
  - icc97 10y ago
    LastPass is a Cloud password program + browser plugin So the extra layer is the plugin that is written by the same developer as the browser plugin. Which is a drop in plugin. It's all open source so it's much easier for people to check the vulnerabilities. It's also easier to raise issues and other people to help fix them. Separately Keepass is an offline database, so you have total control over access to it. The overhead of course is using something like Dropbox, plus probably Boxcryptor to ensure it's encrypted before it gets to Dropbox. I've commented elsewhere here - it's similar to the Keepass bazaar vs the LastPass cathedral. Keepass might look uglier, but I trust it more.
- 10y ago
cube2222 10y ago
Check out 1Password.
pwenzel 10y ago
If you're open to a paid option, 1Password for Teams/Families a good one. You can transfer from LastPass via CSV (https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/).
- stephen123 10y ago
  I recently switched to 1pass, it's much better
- WhitneyLand 10y ago
  I felt like they weren't above board previously with pricing. It wasn't fraud but IIRC prices got a big jump that was timed to be in combination with some kind of defacto mandatory upgrade. It had a bait and switch feel to it and at the time the family price across multiple devices seemed too high.
  - xeromal 10y ago
    I'm still on 4.* which was a 1 time fee. I never felt like I was forced to upgrade.
    - WhitneyLand 10y ago
      That's cool, but the problem is most software is not safe to use unless it's actively maintained and offering updates from at least a security perspective. So I don't consider that a realistic approach for most people, especially for something as mission critical as password management.
      - tripzilch 10y ago
        You just can't really expect proprietary software to be actively maintained indefinitely for a one-time fee. Add to the financial (and ego-) incentives to downplay security issues, I really don't think people should consider anything but open source password managers.
  - 10y ago
zaneyard 10y ago
See the beauty of using program + cloud-provider is that all the cloud provider sees is an encrypted file. If one were to gain access to my Google Drive they would still have to crack an encrypted file which will take a while. I feel like with lastpass the attack vector is bigger with all the fancy features.
- Blackthorn 10y ago
  It's encrypted on the lastpass "cloud" too. The point of it being integrated is the user doesn't have to take action to download the encrypted DB; the software does it for you.
  - tripzilch 10y ago
    But you don't want the software that is capable of decrypting the DB to also be responsible for uploading to a fixed cloud service!
danjoc 10y ago
passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to use a Yubikey Neo with Android Password Store. PassFF is the Firefox plugin. Usage: It's a git repo with passwords stored in encrypted text files. Syncing is done by push/pull the git repo. Since it is git, you have a record of every password you ever generated. Unlocking a password with a Yubikey requires a pin entry and a physical touch. Once entered, the key is available for further passwords without pin, but a Yubikey 4 can be configured to require a touch every time if you're worried about compromised hardware stealing your entire password database. There's no import from other managers that I'm aware of, but it might exist. Googling stuff about 'pass' is tedious. Google for 'zx2c4 pass' and you'll have better results.
- ricardobeat 10y ago
  Does using PGP make it any safer than, say, simple password-based SHA-512 encryption?
  - danjoc 10y ago
    It does. Using PGP in conjunction with a Yubikey means even if someone obtains your password repo, they still can't get in without your physical private key. Without using a Yubikey, an attacker would still need to obtain the private key. They couldn't just grab the vault from the cloud store and start running offline password cracking on it.
  - scott_karana 10y ago
    How do you encrypt using a hash function?...
    - tripzilch 10y ago
      While it can be done (use the secure hash to generate a key stream--but first google it because I bet there are some pitfalls to keep an eye on), I assume that the parent poster meant to indicate a symmetric encryption algorithm like AES (as opposed to asymmetric PGP), instead of a hash algorithm like SHA.
croon 10y ago
I use bitwarden. It's open source and works in browser and on phone. I haven't done any auditing myself, so I guess it's a leap of faith in that regard, but it's working great thus far. It can import from a lastpass file. Even though it's open source, there is a hosted instance (so the experience is much like lastpass). There was a kickstarter a while back that failed though, so I'm unsure how it's funded.
- sndean 10y ago
  > There was a kickstarter a while back that failed though, so I'm unsure how it's funded. The lead developer answered that here: https://news.ycombinator.com/item?id=13926031 https://news.ycombinator.com/item?id=13926031
Rudism 10y ago
I switched from Keepass to Enpass a while ago (enpass.io). It does use 3rd party cloud accounts for synchronization, but it's fully integrated into the apps. Has android/ios/blackberry/windows mobile clients, desktop clients for mac/win/linux/chromebook (including portable versions), and browser addons. It's not a subscription service---the desktop versions are free, and the mobile versions cost a 1-time purchase to unlock all the features. I'm very happy with it.
MaKleSoft 10y ago
> Don't suppose there's anything out there that can import the lastpass db? Padlock does: https://padlock.io/howto/lastpass/ https://padlock.io/howto/lastpass/ Disclaimer: I'm the developer

k_sh 10y ago

Dashlane does! Been using it for a year or so. Good experience. https://csdashlane.zendesk.com/hc/en-us/articles/202699141-How-to-Import-from-LastPass https://csdashlane.zendesk.com/hc/en-us/articles/202699141-H...

Blackthorn 10y ago
I will fully investigate Dashlane. I turned a lot of my non-technical friends onto password managers, and will need to update my recommendation for them with something that can both import the LastPass DB and be as convenient to use.
smrq 10y ago
I switched away from Dashlane after several years because their software has been getting progressively more unstable. Force-killing the Dashlane executable because the browser plugin has locked up got pretty old.
cypherpunks01 10y ago
I love Dashlane, it's pretty magical and a massive timesaver. I use it on OSX primarily but it syncs to my Android very well. There's an unfixed bug in the OSX client where it crashes rarely (every couple months for me) and I have to kill the process manually and restart, but it has very minor impact. Is there any security analysis or consensus on Dashlane security vs. other password managers?
- k_sh 10y ago
  I have this problem every couple weeks as well. Killing DashlaneMASService solves it.

icc97 10y ago

Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me. Autofills my logins and fully integrates with Firefoxes password manager so that you don't get conflicts between the browser and your password manager trying to save the same password. Also doesn't add the stupid CSS hacking that LastPass does to add their logo into the password fields breaking various site's styles. [0]: http://keepass.info/help/base/importexport.html

sillysaurus3 10y ago
Clickable: http://keepass.info/help/base/importexport.html http://keepass.info/help/base/importexport.html
ac29 10y ago
Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox. Sounds like a huge pain compared to LastPass, as well as increasing attack surface.
- tscs37 10y ago
  It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.
- icc97 10y ago
  LastPass is a Cloud password program + browser plugin So the extra layer is the plugin that is written by the same developer as the browser plugin. Which is a drop in plugin. It's all open source so it's much easier for people to check the vulnerabilities. It's also easier to raise issues and other people to help fix them. Separately Keepass is an offline database, so you have total control over access to it. The overhead of course is using something like Dropbox, plus probably Boxcryptor to ensure it's encrypted before it gets to Dropbox. I've commented elsewhere here - it's similar to the Keepass bazaar vs the LastPass cathedral. Keepass might look uglier, but I trust it more.
10y ago

cube2222 10y ago

Check out 1Password.

pwenzel 10y ago

If you're open to a paid option, 1Password for Teams/Families a good one. You can transfer from LastPass via CSV (https://support.1password.com/import-lastpass/ https://support.1password.com/import-lastpass/).

stephen123 10y ago
I recently switched to 1pass, it's much better
WhitneyLand 10y ago
I felt like they weren't above board previously with pricing. It wasn't fraud but IIRC prices got a big jump that was timed to be in combination with some kind of defacto mandatory upgrade. It had a bait and switch feel to it and at the time the family price across multiple devices seemed too high.
- xeromal 10y ago
  I'm still on 4.* which was a 1 time fee. I never felt like I was forced to upgrade.
  - WhitneyLand 10y ago
    That's cool, but the problem is most software is not safe to use unless it's actively maintained and offering updates from at least a security perspective. So I don't consider that a realistic approach for most people, especially for something as mission critical as password management.
    - tripzilch 10y ago
      You just can't really expect proprietary software to be actively maintained indefinitely for a one-time fee. Add to the financial (and ego-) incentives to downplay security issues, I really don't think people should consider anything but open source password managers.
- 10y ago

zaneyard 10y ago

See the beauty of using program + cloud-provider is that all the cloud provider sees is an encrypted file. If one were to gain access to my Google Drive they would still have to crack an encrypted file which will take a while. I feel like with lastpass the attack vector is bigger with all the fancy features.

Blackthorn 10y ago
It's encrypted on the lastpass "cloud" too. The point of it being integrated is the user doesn't have to take action to download the encrypted DB; the software does it for you.
- tripzilch 10y ago
  But you don't want the software that is capable of decrypting the DB to also be responsible for uploading to a fixed cloud service!

danjoc 10y ago

passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to use a Yubikey Neo with Android Password Store. PassFF is the Firefox plugin. Usage: It's a git repo with passwords stored in encrypted text files. Syncing is done by push/pull the git repo. Since it is git, you have a record of every password you ever generated. Unlocking a password with a Yubikey requires a pin entry and a physical touch. Once entered, the key is available for further passwords without pin, but a Yubikey 4 can be configured to require a touch every time if you're worried about compromised hardware stealing your entire password database. There's no import from other managers that I'm aware of, but it might exist. Googling stuff about 'pass' is tedious. Google for 'zx2c4 pass' and you'll have better results.

ricardobeat 10y ago
Does using PGP make it any safer than, say, simple password-based SHA-512 encryption?
- danjoc 10y ago
  It does. Using PGP in conjunction with a Yubikey means even if someone obtains your password repo, they still can't get in without your physical private key. Without using a Yubikey, an attacker would still need to obtain the private key. They couldn't just grab the vault from the cloud store and start running offline password cracking on it.
- scott_karana 10y ago
  How do you encrypt using a hash function?...
  - tripzilch 10y ago
    While it can be done (use the secure hash to generate a key stream--but first google it because I bet there are some pitfalls to keep an eye on), I assume that the parent poster meant to indicate a symmetric encryption algorithm like AES (as opposed to asymmetric PGP), instead of a hash algorithm like SHA.

croon 10y ago

I use bitwarden. It's open source and works in browser and on phone. I haven't done any auditing myself, so I guess it's a leap of faith in that regard, but it's working great thus far. It can import from a lastpass file. Even though it's open source, there is a hosted instance (so the experience is much like lastpass). There was a kickstarter a while back that failed though, so I'm unsure how it's funded.

sndean 10y ago
> There was a kickstarter a while back that failed though, so I'm unsure how it's funded. The lead developer answered that here: https://news.ycombinator.com/item?id=13926031 https://news.ycombinator.com/item?id=13926031

Rudism 10y ago

I switched from Keepass to Enpass a while ago (enpass.io). It does use 3rd party cloud accounts for synchronization, but it's fully integrated into the apps. Has android/ios/blackberry/windows mobile clients, desktop clients for mac/win/linux/chromebook (including portable versions), and browser addons. It's not a subscription service---the desktop versions are free, and the mobile versions cost a 1-time purchase to unlock all the features. I'm very happy with it.

MaKleSoft 10y ago

> Don't suppose there's anything out there that can import the lastpass db? Padlock does: https://padlock.io/howto/lastpass/ https://padlock.io/howto/lastpass/ Disclaimer: I'm the developer