9 ms·
Introducing Remembear, new password manager
- satysin 9y agoLooks nice but only has a Chrome extension at the moment. Also the browser extension requires the desktop app be installed.
- Veen 9y agoIt has a Safari extension too. The blog article says it doesn't, but it's available via the install process. The Apple Keychain import needs some work though - it didn't pick up the vast majority of the logins I have stored in there.
- yegle 9y agoSo it's not possible on ChromeOS?
- ehxcaet 9y agohttps://chrome.google.com/webstore/detail/1password-x/aeblfdkhhhdcdjpifhhbdiojplfjncoa https://chrome.google.com/webstore/detail/1password-x/aeblfd... 1Pass X seems to be available on just Chrome? I'm actually quite interested to learn how it works - from my knowledge it's the only standalone PM extension right now.
- ramidarigaz 9y agoIf any of the Remembear developers read this, I'd love to put in a request for a Linux client!
- craftyguy 9y agoSeems to be yet another proprietary walled garden. No thanks.
- pault 9y agoCan you recommend any reputable open source password managers?
- Dado1995 9y agoKeePassX?
- sdfin 9y agoWhy is this downvoted? is there something wrong with KeePassX?
- Santosh83 9y agoIt hasn't been receiving improvements or maintenance for almost two years, and as a result, it has been forked and is actively developed by a different team under the name of KeePassXC. So nothing inherently wrong with KeePassX but you need to be aware that it is almost abandoned at this point and that there is a better alternative
- H1t 9y agoKeePassX is not actively maintained, as already mentioned but the original KeePass project (https://keepass.info/ https://keepass.info/) that KeePassX was based off and the new cross-platform fork KeePassXC (https://keepassxc.org/ https://keepassxc.org/) are both active and highly recommended.
- bertman 9y agohttps://passwordstore.org https://passwordstore.org
- TheDong 9y agohttps://www.passwordstore.org/ https://www.passwordstore.org/ (windows, android, and ios clients exist in addition to the better known linux/osx cli client) Keepass (and keepassX and keepassC) https://bitwarden.com/ https://bitwarden.com/
- residude 9y agoIt is from tunnelbear. If you are releasing it for free, why isn't the code public?
- wpietri 9y agoOoh, what a great example of a brand extension. When I saw "new password manager" in the headline, my first thought was "those guys are fucked". What people want with a password manager is trust and stability, two things not associated with startups. But these folks have millions of users, strong app store ratings, and solid reviews. Going from "trust us with your data and privacy" to "trust us with your passwords" is not a big step. I'd give my current password manager, LastPass, a C- on usability, so I'll be keeping an eye on this. I'd love to have something better to recommend to novices, and might even switch myself.
- dwg 9y agoWhat differentiates RememBear from other password managers? After looking through the blog and website it's not immediately clear to me. What makes (or will make) RememBear better than, say, 1password, which appears to have the same features, is also easy to use, and has a long history with which to work out issues?
- azinman2 9y agoI disagree that 1Password is easy to use. It’s easy enough for me to use, but trying to get my parents through the setup and UI has not been an easy task. It could be far more simple and straightforward.
- hmahncke 9y agoI would like to see a version of 1Password that 1) did only passwords - no fishing licenses and secure notes, which adds UX complexity 2) did not distinguish between passwords and logins, which causes endless confusion for my users 3) knew and managed the text requirements for the top 1000 websites so the app could generate legitimate passwords and not ask users to manage password complexity
- azinman2 9y agoOhh I like the idea of knowing the password requirements for the top 1000 websites!
- chiefalchemist 9y agoWould it be wrong to wish this could (or should?) be standardized? That is, for example, one upper case letter, same special characters, etc. The lack of a standard seems to hurts users more than hackers. The hackers know it and adjust. User just get confused and default to overly simplistic and common PWs.
- cmer 9y ago
- solomatov 9y agoI use 1Password, and the only incentive which make me switch is completely open source good quality UX solution.
- hyperbovine 9y agoRaise your hand if you want to spend your free time writing that
- solomatov 9y agoNo, but I am sure that there're people who do.
- Nullabillity 9y agoSo.. KeePassXC?
- awinder 9y agohttps://keepassxc.org/images/screenshots/macos/screen_003.png https://keepassxc.org/images/screenshots/macos/screen_003.pn... This is not really an acceptable UI for OSX
- nerdponx 9y agoNo? Looks fine to me. I use it every day. There is also the Mac-first versiom, MacPass: https://github.com/mstarke/macpass https://github.com/mstarke/macpass
- tw04 9y agoBrowser integration is poor at best. I've given it multiple goes and walked away disappointed every time.
- Nullabillity 9y agoI'm not having any issues with https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-connector/ https://addons.mozilla.org/en-US/firefox/addon/keepasshttp-c... and https://chrome.google.com/webstore/detail/chromeipass/ompiailgknfdndiefoaoiligalphfdae https://chrome.google.com/webstore/detail/chromeipass/ompiai.... My only annoyance is that KeepShare's autofill doesn't pick up Firefox Android's password fields, but Chrome works fine there. KeePassXC has a KeePassHTTP server built-in, so no plugins needed on that side.
- tptacek 9y agoFrom the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes. Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors complain about. You really want to see a password manager get the basics right. Notice also that the end of the Cure53 report complains about the project scope and the amount of time given. This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before.
- bearbearbear 9y agoThe trouble I had with 1password is that it's secure in stupid ways. Every time I log on a new device in there's SIX factor authentication and that's just too much work to get into my fap sites on my wankbook.
- ktta 9y agoThey also had 3 'Critical' vulnerabilities reported by Cure53 in their extension VPN offering last year. https://cure53.de/summary-report_tunnelbear.pdf https://cure53.de/summary-report_tunnelbear.pdf
- mxstbr 9y agoTo be fair though, as per the report all of these "Critical" vulnerabilities were fixed by mid-2017. So they're listening, at least.
- deleted 9y ago[deleted]
- ktta 9y agoAnd I bet the critical sub-domain vulnerability was fixed too. The problem is that they are going to keep adding code, but won't get a security audit with every update. So all it takes is a slight mistake for it to be vulnerable again. What you need is a strong in-house pentesting team to be sure about there not being any new vulnerabilities with each release. Or atleast a bug bounty starting with beta releases, and let them bake before releasing them publicly. The fact that such serious vulnerabilities come up at the time of an audit shows that they don't have one.
- Dado1995 9y agoIt isn't open source, it doesn't support Linux, it doesn't have new features compared to KeepassX, why the hell I've to use it instead of other alternatives and why the hell they put lot of efforts developing it?
- bearbearbear 9y agoTunnelbear's user agreement makes me uneasy.
- jedisct1 9y agoIt might be a good alternative to Enpass. They use Rust and libsodium, which is a good sign. But browser integration is the trickiest part in a modern password manager, yet what makes a password manager actually usable for most people. So, give it some time before using the browsers (currently only Chrome) extension. Virtually all other password managers had security issues here. Making these extensions smart (able to guess where login and password fields are, when passwords are being updated, etc) is also far from trivial. It's actually way more complex than password storage. Gonna stick with Enpass for now, but that's definitely a project to watch.
- wntrmt 9y ago> So, give it some time before using the browsers (currently only Chrome) extension. Virtually all other password managers had security issues here. Do you have a source for that? We are currently using teampasswordmanager.com and I was wondering if there are any known security issues I have not heard about. Altgough the author refused to provide the sourcee, I had a look at the Chrome Extension anyway, but any additional info would be great.
- arkadiyt 9y agoHere's one example - LastPass had remote code execution as a result of their browser extension: https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&can=1&q=lastpass&desc=6 https://bugs.chromium.org/p/project-zero/issues/detail?id=12...
- nbzs 9y agoI don't get it at all. How on earth i will give someone (encrypted or not) my passwords? If you want to give convenience, make it local and secure with easy interface and charge money for your work. I will buy instantly well designed and secured product. This no.
- DonHopkins 9y agoGreat name! So much more evocative than "Remembr". Let's hope they succeed, and inspire other companies to append a penultimate "a" after the penultimate "e", instead of just removing the penultimate "e".
- ehxcaet 9y agoI'm glad that that fad is... mostly(?) over.
- 0xmohit 9y agoI <3 pass [1]. Earlier discussion [2] on pass here. [1] https://www.passwordstore.org/ https://www.passwordstore.org/ [2] https://news.ycombinator.com/item?id=14819136 https://news.ycombinator.com/item?id=14819136
- WillPostForFood 9y agoI think they are burying the lede, and being a little disingenuous with the big "Get Started, It's Free" button. we will be introducing subscription-based pricing when RememBear leaves the public beta phase. https://help.remembear.com/customer/en/portal/articles/2890744-how-much-does-remembear-cost- https://help.remembear.com/customer/en/portal/articles/28907... A non-subscription product would be one thing that would get me to move off 1password.
- throwasway39048 9y agoHighlights for me: - Written in Rust. Cool. - Cool marketing. - Cool name. - Online only. Not gonna trust my passwords with anyone, sorry (even encrypted). - Good (upcoming) crossplatform support. Looks like they are competing with LastPass and not the 1Password (Desktop) and Keepasses of the world.
- phnofive 9y ago>Where does RememBear store my passwords and how are they protected? >RememBear encrypts your passwords using both your Master Password and a unique device key generated by the application. It stores your passwords in an encrypted file on your device and on our secure servers for sync and backup purposes. However, RememBear will only encrypt and decrypt the items on your physical device. This means that your passwords and other items are always encrypted during syncing and remain encrypted when in storage on our secure servers. You and ONLY you are ever able to access your items as long as you keep your master password private. Proprietary sync, no thanks.
- dom96 9y agoI'm currently using LastPass and their macOS app seriously annoys me (why do I have to click an OK button every time I save a new password?). They seem to get their UI right at least. Plus, bears are cute. Edit: No support for folders/categories it seems. That sucks a bit.
- chiefalchemist 9y agoIs there a reason you don't use the browser extension?
- perryprog 9y agoBears are very cute. Can't go wrong with that! Jokes aside, this would be interesting to compare to 1Password once it matures a little. So far it looks very similar.
- 5_minutes 9y ago"Subscription pricing"... if anyone is looking for an actual good business model, is for the upcoming "1password refugees"... and all we want is the same stuff, but not subscription based.
- snizelxl 9y agocheck out https://pwdsafe.com https://pwdsafe.com It's not as convenient as many other options, but somewhat pure, fast and does all the basics well without sacrificing security for convenience.
- m3kw9 9y agoIt would be great if they can clearly tell how they differentiate from 1Password.
- Rjevski 9y agoElectron?