5 ms·

I'll stay with www.enpass.io . No need to have it running in chrome, support for windows, Linux and Android aaand it works offline without a subscription model.

I'll stay with www.enpass.io . No need to have it running in chrome, support for windows, Linux and Android aaand it works offline without a subscription model. I can sync my enpass instances over multiple ways like Google drive, Dropbox, one drive, webdav or by my very own way to sync a single file. I use it now for 4 years and had never any problem with syncing or loosing a single password.

Mister_Snuggles 9y ago
The best thing about Enpass, in my opinion, is how they approach syncing. I don't want another cloud sync service in my life, I already use one that I like. Enpass is smart to let me use the service I already have instead of forcing me into their own service.
- axman6 9y ago
  So does 1Password and it has done so for much longer than they have offered their own service.
woolvalley 9y ago
What do you use for sync?
- SeriousM 9y ago
  Google drive. That's what I use for my stuff and it's 2FA secured
bradknowles 9y ago
I've been a satisfied 1Password customer for many years, and so far as I know, they have always supported the "bring your own" method for doing password database synchronization via some other cloud service. DropBox was the first obvious solution in this space, but they should work with any of the others. And they've also always supported the local wifi-only solution, where you have to be on the same network, and physically authorize both devices to talk to each other, before they can sync the password database. If enpass.io works for you, that's great. I'm glad you're happy with it. But this feature isn't unique to enpass.io.
- SeriousM 9y ago
  Well, it's not unique to sync but different to 1password as my passwords were never on central server!
  - mrunkel 9y ago
    Neither are 1password’s if you don’t use their sync service. And honestly your passwords aren’t on their servers. An encrypted blob is. Encrypted with a password only you know.
    - bad_user 9y ago
      The problem is that same password is required in the web interface for administrative settings. And a web interface can always be compromised, as it can always inject some extra JS code in one of your sessions, without you having any way to verify that the JS blob you got served is the same you got the last time or that it’s the same blob that all the other users are getting. This is actually an important attack vector and AgileBits themselves admitted the possibility. Imagine that a compromised HTTPS root certificate can open the door to a huge man-in-the-middle attack, which is totally within the reach of governments or of well funded crime syndicates. Also the cloud sync is no longer optional. The standalone version is no longer available anywhere on their website and Google doesn’t help either. At this point the standalone version is still available only for those in the know, being on life support probably to not piss old timers off. At least they are thinking about us, I’ll grant them that.
      - wool_gather 9y ago
        This is a fair point, but it's worth noting that the password you memorize and enter is only a part of the encryption key. There's another component -- I think they call it the "master key" -- which is generated locally when you set up your database and must be transferred out-of-band to other devices. It doesn't go over a network, not even a local one. So losing control of your password via the web interface still does not constitute a complete breach.
Humphrey 9y ago
1Password user here. I only use the manual sync option. And I use Resillo Sync to kept all my devices in sync... Which means, most of the time, it's only syncing on my local network. Works great, and was a one off cost, not subscription model.
brynjolf 9y ago
I'm very uneasy with how much astroturfing enpass has done in the past so I will stay far away from them. Track record means a lot when dealing with such sensitive information.
- SeriousM 9y ago
  Could you give more information about your concerns?

Mister_Snuggles 9y ago

The best thing about Enpass, in my opinion, is how they approach syncing. I don't want another cloud sync service in my life, I already use one that I like. Enpass is smart to let me use the service I already have instead of forcing me into their own service.

axman6 9y ago
So does 1Password and it has done so for much longer than they have offered their own service.

woolvalley 9y ago

What do you use for sync?

SeriousM 9y ago
Google drive. That's what I use for my stuff and it's 2FA secured

bradknowles 9y ago

I've been a satisfied 1Password customer for many years, and so far as I know, they have always supported the "bring your own" method for doing password database synchronization via some other cloud service. DropBox was the first obvious solution in this space, but they should work with any of the others. And they've also always supported the local wifi-only solution, where you have to be on the same network, and physically authorize both devices to talk to each other, before they can sync the password database. If enpass.io works for you, that's great. I'm glad you're happy with it. But this feature isn't unique to enpass.io.

SeriousM 9y ago
Well, it's not unique to sync but different to 1password as my passwords were never on central server!
- mrunkel 9y ago
  Neither are 1password’s if you don’t use their sync service. And honestly your passwords aren’t on their servers. An encrypted blob is. Encrypted with a password only you know.
  - bad_user 9y ago
    The problem is that same password is required in the web interface for administrative settings. And a web interface can always be compromised, as it can always inject some extra JS code in one of your sessions, without you having any way to verify that the JS blob you got served is the same you got the last time or that it’s the same blob that all the other users are getting. This is actually an important attack vector and AgileBits themselves admitted the possibility. Imagine that a compromised HTTPS root certificate can open the door to a huge man-in-the-middle attack, which is totally within the reach of governments or of well funded crime syndicates. Also the cloud sync is no longer optional. The standalone version is no longer available anywhere on their website and Google doesn’t help either. At this point the standalone version is still available only for those in the know, being on life support probably to not piss old timers off. At least they are thinking about us, I’ll grant them that.
    - wool_gather 9y ago
      This is a fair point, but it's worth noting that the password you memorize and enter is only a part of the encryption key. There's another component -- I think they call it the "master key" -- which is generated locally when you set up your database and must be transferred out-of-band to other devices. It doesn't go over a network, not even a local one. So losing control of your password via the web interface still does not constitute a complete breach.

Humphrey 9y ago

1Password user here. I only use the manual sync option. And I use Resillo Sync to kept all my devices in sync... Which means, most of the time, it's only syncing on my local network. Works great, and was a one off cost, not subscription model.

brynjolf 9y ago

I'm very uneasy with how much astroturfing enpass has done in the past so I will stay far away from them. Track record means a lot when dealing with such sensitive information.

SeriousM 9y ago
Could you give more information about your concerns?