8 ms·
I have such great respect for Troy and all the work he's done/is continuing to do to promote good security practices. I just went on HIPB though and noticed the
by 2T1Qka0rEiPr 8y ago
I have such great respect for Troy and all the work he's done/is continuing to do to promote good security practices. I just went on HIPB though and noticed the advise for better security is "use 1Password" (after checking your email for compromises).
This just seems a little too commercial to me and I'm not sure I like the phrasing. I fully understand the need for Troy to be sponsored and it's great that 1Password works well with his tooling, but it's not the only solution. I'd feel a little less uneasy if it was phrased in such a way as "Use a password manager, like 1Password".
- BartBoch 8y agoThis. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is "on demand" fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.
- Cynddl 8y agoBitwarden has auto-fill disabled by default, and only enables it with a warning (“Use at your own risk”).
- BartBoch 8y agoGood to know, the more alternatives the better.
- jplatte 8y agoThe KeePassXC browser integration also does it the way you describe where you choose a profile instead of having the firm already filled in when the page loads.
- joshvm 8y agoIs this new behaviour? In the version of 1Password I have (6.8.8, Mac) it detects the website, but I have to click on the specific login using 1Password Mini to fill the fields. It's never done it automatically as far as I can tell. It tends to be browsers which are gung-ho about automatically filling in login details.
- BartBoch 8y agoNope, I have used 1Password most of last year, maybe they changed it after the data harvesting attack from a few months ago, but for me, the tool was very aggressive in submitting data without me interacting with the website. At the time LastPass was the only major player with "click to launch" feature.
- have_faith 8y ago> data harvesting attack Think I missed that, what happened? I don't enable 1Password autofill or any of it's browser extensions, I just see it as additional attack vectors waiting to be compromised.
- BartBoch 8y agohttps://www.howtogeek.com/338209/you-should-turn-off-autofill-in-your-password-manager/ https://www.howtogeek.com/338209/you-should-turn-off-autofil...
- BonesJustice 8y agoFrom your link: > 1Password isn’t affected by this problem because it doesn’t include an automatic autofill feature. Are you sure we’re talking about the same app? I’ve used 1Password for years, and it’s never autofilled for me. Maybe it was actually your browser’s built-in keyring?
- notheguyouthink 8y agoI think they're confusing the 1Password browser extension. 1Password has a native app, which I use on both windows and osx, and I just don't install their browser extension for autofill features. Though, given that I avoid autofill like the plague, I could easily be misunderstanding the issue too. I'm speaking of a subject I don't use, I don't think anyone should haha.
- dzhiurgis 8y agoLastPass have a horrible security track record. I’ve even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.
- BartBoch 8y agoYeah, by no means I am an ambassador of them. For me, it was so-so vs bad really.
- izietto 8y agoNot-so-happy LastPass user here: I evaluated alternatives, but LastPass is the only one which somehow works on Linux/Firefox. I have even tried to make pressure to 1password about that, without much success: https://discussions.agilebits.com/discussion/comment/410603/#Comment_410603 https://discussions.agilebits.com/discussion/comment/410603/...
- philliphaydon 8y agoI’m using Bitwarden on budgie / Firefox. Works great.
- izietto 8y agoThank you! I'll evaluate it
- pluma 8y agoBitWarden works fine. I'm using Linux/Firefox as well, the rest of the time is on Windows/Chrome. It's 100% open source: https://bitwarden.com/ https://bitwarden.com/
- spanishgum 8y agoI stopped using browser based password managers and switched to KeePass. It's a bit more work to pull passwords and back them up, but for me it beats trusting cloud services with security critical data.
- cricalix 8y agoThe most 1Password has ever done (in my experience) is submit after I select the login to use, even on sites with only one login. I disabled that aspect, and I always have to toggle the helper via ctrl/cmd-\. It has never pre-filled a login field without me asking it to, and that's across v4, v5, v6, and v7.
- liamfd 8y agoI've never seen last password auto fill, I've always had to use cmd+\. What browser were you using?
- toxik 8y agoFWIW Apple's Web browser Safari recently switched to this approach, both on iOS and macOS.
- akvadrako 8y agoFor reference: https://www.cultofmac.com/538447/ios-11-3-safari-security/ https://www.cultofmac.com/538447/ios-11-3-safari-security/
- nvr219 8y agoMy 1password only autofills if I do ctrl+\, otherwise it does nothing.
- notheguyouthink 8y agoNote, that's if you use autofill at all. I use an installed 1Password app, and avoid browser autofill extensions like the plague. Browser extensions don't have a good track record I believe, regardless of company. I don't blame the companies, I blame browser extensions. I see little benefit in autofill integration, I just click the button in my task bar, click copy, and paste. LastPass has been pretty sketchy in the past too, I don't trust them. I've been quite happy with 1Password, fwiw.
- djsumdog 8y agoI still use a pretty complex password algorithm: https://penguindreams.org/blog/password-algorithms/ https://penguindreams.org/blog/password-algorithms/ I like not having my passwords tied to a device, private key I could lose, etc. With an algorithm, I can still avoid credential stuffing, since all my account use totally different secure passwords, but I can derive them without having to look them up. I realize someone could figure out my algorithm, but they'd probably need several of my passwords and at that point you're talking about a targeted attack.
- ISL 8y agoWhat do you do when you're asked to rotate your password every ninety days?
- michaelmior 8y agoNot the parent, but I've haven't been asked this in years. I do periodically change important passwords, but I can't recall being forced to.
- djsumdog 8y agoMost normal websites don't make you rotate password. When a site has a breech and forces me to change it, I do have an addition to my algorithm for that. I use Keepass to store passwords that violate my algorithm (sites that don't allow my special chars, or that say my password is too long, etc.) I'm on my third iteration of password algorithms. I use my password manager to store which algorithm I'm using for which site and try to update old ones to new ones as I encounter/use them. There aren't that many exceptions to my rules, so I can usually remember those exceptions if I use them frequently enough. Machine accounts that require rotation get their own special secure password that I don't use anywhere else.
- Lazare 8y agoThat's....simply not true? I've been using 1password for many years, and that's not how 1password works for me. There might be a setting to enable that behaviour somewhere, but by default, it doesn't autofill without prompting. That's true for every version, OS, browser plugin, desktop app, mobile, etc. Edit: I just saw your comment that it was actually Dashlane that autofilled! Nevermind then. :)
- chrisper 8y agoHe is also sponsored by cloudflare.
- auslander 8y agoIt does sounds like he is. On password managers - KeepassXC, open source.
- andrepd 8y agoAbsolutely. I myself don't trust closed source and for-profit on such a sensitive matter. It's a matter of time before you have to deal with some bullshit. I'm leaning towards bitwarden, seems very nice.
- philliphaydon 8y agoI switched maybe 3 weeks ago. Love it. Highly recommended.
- hmhrex 8y agoI'll be checking out bitwarden for sure. It looks great. I'm ready to move away from Dashlane. While I haven't had any issues with it, I'd feel more comfortable having the data stored on my own servers. And the cost difference is pretty huge.
- koffiezet 8y agoTheir file format specs are open, and there are opensource implementations of it. Sure - closed source isn't ideal - but this is as good as it gets. The 'opensource' alternatives have a way worse security trackrecord. I tried quite a few options - but always went back to 1pass...
- akoshodi 8y agoI recently discovered Enpass password manager (a mostly free alternative to 1password, only the mobile app has a pro version) also integrates HIBP into its desktop app. https://www.enpass.io/docs/desktop-windows/pwned.html?highlight=pwned#check-if-pwned https://www.enpass.io/docs/desktop-windows/pwned.html?highli...
- IOT_Apprentice 8y agoYou are "uneasy" about something provided by Troy for free? Which other password management products have integrated HIBP into their product?
- cricalix 8y agoRight on the HIBP page, it says "Why 1Passsword?" where you can read his reasoning for why he recommends the service. You, as an informed consumer, are free to research the things you find in that link, like "what is a password manager?", and decide whether to accept his recommendation or not. What, precisely, makes you uneasy that he advocates the product of a particular company that he has experience with, trusts, and discloses as having a partnership?
- 2T1Qka0rEiPr 8y agoGood response. Specifically I was objecting to this response after submitting your email address - https://imgur.com/toJaSYW https://imgur.com/toJaSYW. It's not clearly an advert, but also feels a little too commercial for the average user who's probably just been sent the HIBP link but isn't necessarily technical.
- meko 8y agoEspecially considering 1Password is not technically supported on linux.