4 ms·

Whenever a product like this shows up here, I find myself waiting for the security guys to show up and explain why it's terrible.

• urld 9y ago
  Lets wait together then. In the meantime i suggest this link: https://team-sik.org/trent_portfolio/password-manager-apps/ https://team-sik.org/trent_portfolio/password-manager-apps/ Almost everything seems to be terrible.
  • Semiapies 9y ago
    Well, there's "has bugs" and there's "terrible and worse than useless", which is what seems to be the verdict, more often than not.
  • j88439h84 9y ago
    "Update 2017-03-01: All reported vulnerabilities are fixed by the vendors"
• mrb 9y ago
  A cursory look at the code (10min on my phone) shows nothing obviously wrong. They use a secure source of entropy, and scrypt with decent parameters for generating the key from the passphrase. They use unique salts and nonces of decent lengths. That alone is better than 90% of the crypto code I review. I would still prefer https://www.passwordstore.org/ https://www.passwordstore.org/ though. I like the ability to insert a new passwd without having to type a passphrase. And it's more robust because updating 1 password only rewrites 1 file, whereas with passmgr the whole file is rewritten. This also mean the passwordstore data base is easier to revision-control and sync across multiple machines. Finally with passwordstore I can update my passphrase by simply changing it on my PGP key ("gpg --edit-key $id" and use the "passwd" command.) But with passmgr there is no mechanism to change it (every entry would have to be decrypted and re-encrypted.)