7 ms·
1Password for Open Source Projects
- gshakir 9y agoLooks like a good alternative to AWS Secret manager https://aws.amazon.com/secrets-manager/ https://aws.amazon.com/secrets-manager/
- dmlittle 9y agoAWS Secret Manager is for application code to retrieve secrets for different services (e.g. API Keys, DBs, etc). You can't use 1Password for that. Similarly, you wouldn't store your Twitter, Facebook, NPM, Hex, etc. accounts in AWS Secret Manager. You'd use 1Password for that use case.
- roustem 9y agoAWS Secret Manager is a password manager for servers. Just like HashiCorp's Vault: https://www.vaultproject.io/ https://www.vaultproject.io/ 1Password is a password manager for humans :)
- Cub3 9y agoFree 1 year membership membership only? Am i reading that correctly
- ReverseCold 9y ago"Memberships can be renewed each year if your project still meets the requirements. Email us at ______ 30 days prior to renewal." Presumably free.
- aaronpk 9y agoNo > Memberships can be renewed each year if your project still meets the requirements.
- ryanmccullagh 9y agoCan't trust passwords being stored in the cloud.
- jupp0r 9y agoMay I ask what your gripes with the cloud are, especially in situations where you encrypt the data to be stored and the cloud provider has no knowledge of the encryption keys?
- ryanmccullagh 9y agoDoes the cloud provider have knowledge of the encryption keys? Do you generate the key in the provider's application, or is it import? Do they send the key to their servers? Can you verify all of this?
- benchaney 9y agoThe encryption keys are supposed to be generated client side. Obviously you can’t verify this since 1password is closed source, but if your threat model involves the client misbehaving, then you should be using any proprietary password manager. Cloud vs not Cloud is irrelevant.
- roustem 9y agoThere is no way we would want to know your keys. There are several million 1Password accounts and 1Password a huge attack target. All keys are generated on the client side and encrypted with a PBKDF2-hardened combination of Master Password + Secret Key. Details are here: https://1password.com/security/ https://1password.com/security/ Whitepaper (PDF): https://1password.com/teams/white-paper/ https://1password.com/teams/white-paper/
- dbg31415 9y agoWhich is a fine mentality for personal passwords -- at least I get where the distrust comes from. But for an enterprise team (or just a team), you need to be able to share passwords with various team members. Without a system, you're left with each of those people having to use their own (often insecure) personal methodology. Without a password manager, people resort to very simple passwords, or reusing passwords across multiple systems, or writing passwords down on PostIt notes next to their monitors. Without the convenience of a cloud-based system, you don't have an easy way to back up your passwords -- what happens if someone gets hit by a bus? And you can't easily have someone run compliance to verify when the last time was you updated your password, or how complex your passwords are -- at least not without showing them the raw passwords in all systems. I get paranoia... but any team that runs a password manager service consistently for all users will be much more secure than any team that doesn't. * Most Private And Secure Password Managers - Secured.fyi - Alpha || https://secured.fyi/password.html https://secured.fyi/password.html * Best Password Manager 2018 - Lastpass vs. Dashlane vs. 1Password || https://www.tomsguide.com/us/best-password-managers,review-3785.html https://www.tomsguide.com/us/best-password-managers,review-3...
- kcmastrpc 9y agoconsidering using and supporting the open source bitwarden project instead. https://bitwarden.com/ https://bitwarden.com/
- throwaway84742 9y agoWhy does it need me to create an account? What's the technical reason? My ye olde 1Password (pre-cloud) doesn't need an account, and stores its database in iCloud or on Dropbox using the accounts I already have there.
- 1pfdthrow 9y agoIt's a web service. You can host it yourself.
- deleted 9y ago[deleted]
- deleted 9y ago[deleted]
- davidcuddeback 9y agoI've been interested in migrating to bitwarden for a while, but I've been hesitant because I don't know how much I can trust it. Mostly, I was looking for an independent security audit. I took another look today and found a GitHub issue on the subject [1] and they're working with researchers on HackerOne [2]. [1] https://github.com/bitwarden/core/issues/27 https://github.com/bitwarden/core/issues/27 [2] https://hackerone.com/bitwarden https://hackerone.com/bitwarden
- bdz 9y agoHow I roll: KeePassXC + browser plugin + MiniKeePass + Dropbox https://keepassxc.org/ https://keepassxc.org/ https://itunes.apple.com/us/app/minikeepass/id451661808 https://itunes.apple.com/us/app/minikeepass/id451661808
- paulryanrogers 9y agoGlad it's working for you as a trust no one solution. But does it concern you that you're telling the world your op sec?
- cdancette 9y agoAnd for android : Keepass2Android is very good
- supreme_sublime 9y agoInstead of dropbox, I'd recommend using something decentralized like Syncthing. I have a similar setup and recently changed to using Syncthing to keep my password database synced on all my devices.
- bdz 9y agoThanks! Actually never heard about Syncthing, looks really good!
- 5_minutes 9y agoI do find $36/yearly for a single licence quite alot for this kind of tool. This is the kind of product that's so feature rich already, I would not need real new features built in. And storing a few passwords takes no diskspace either. I'm using the non-cloud version, that sync with Dropbox, but suspect 1password of deliberately having it syncing poorly to push us to the cloud version.
- caiob 9y agoI'm on the opposite end of the spectrum. I find $36/yearly a bargain for the value their product provides. 1Password is one of those tools I couldn't imagine my life without. And $36 is a small price to pay to have my online identity a little safer and more manageable.
- 5_minutes 9y agoFor me the product is quite feature finished as it is (even before their cloud option came), and in general I dislike subscriptions. I don't mind paying for software upgrades, and new versions. But all these companies counting on sleepwalking subscription models, oh hey, call me oldschool. Bitwarden's pricings seem much more reasonable, going to check it out.
- roustem 9y agoThere is still an option to purchase a license. However, I have to disagree about the "feature finished". We had a lot of customer feedback over the years and 1Password Teams is based on it.
- woolvalley 9y agoI want to pay the $36 a year and not use their cloud.
- roustem 9y agoIn this case you can still purchase a license. It is less convenient but the option is there.
- elorm 9y agoLast month i gave up my dinosaur status (using a ciphered pen and paper notebook for managing my passwords) and started using Lastpass. To be honest, i still feel a bit wary about keeping my password in the cloud, but LastPass has been so amazingly convenient, it's well worth the risk. To be extra certain incase of an undisclosed breach, I 2FA everything that has a 2FA option. I know i'm very late to the ballpark, but i'd rather corporate organizations add Password Managers to their policies instead of forcing everyone to change ever so often and worsening the situation.
- elliottcarlson 9y agoAs long as PCI, or ISO 27001, continue to require password rotation policies, it will be hard to implement for some companies, depending on the infrastructure and who has access to what. Hopefully we will see more things following the NIST guidelines, since it's a pretty ineffective way of ensuring security.
- mrunkel 9y agoHacker news, never change. Company gives away product for free to opensource teams... and almost all of the comments are complaints. :) I get it. For some this will never be an acceptable solution. As a happy subscriber of the family plan, I can only say that this has appreciably improved the security of my family online. I'm happy to pay the subscription fee because I think that's the most sustainable business model for a software company. In any case: "Hey 1Password, thanks for giving away free licenses to opensource projects."
- an_d_rew 9y agoCould not have said it better myself! Thank you, AgileBits - much appreciated!