5 ms·

I use Android, Linux (at home), and Mac (at work). I switched from KeePass because the UI was really bad, it seemed dead, and I really didn't want to move to Ke

by awill 8y ago

I use Android, Linux (at home), and Mac (at work). I switched from KeePass because the UI was really bad, it seemed dead, and I really didn't want to move to KeePass 2 (with Mono on Linux). I switched to enpass, and it's been great. It has native Linux/Mac/Windows apps, a solid Android app (with fingerprint support), and there's no subscription. It's perfect for my needs.

jeena 8y ago
The newest kid on the block is KeePassXC https://keepassxc.org https://keepassxc.org
- bubblethink 8y ago
  The browser extension leaves a lot to be desired though. I feel that there are a lot of good standalone password managers, but the ones with good browser extensions are far fewer. I'm using bitwarden right now, which so far seems to be the best of the open source ones in terms of usability.
jeena 8y ago
Hm, enpass seems to be closed source which makes it unusable for me to store all my passwords basically because of the same as someone wrote in their forum: "The fact that Enpass isn't submitting all my passwords to enpass.io right now doesn't mean anything. I'm currently using iptables to restrict Enpass from doing so, but I don't know yet how to archive the same thing on my unrooted Android."
- techsupporter 8y ago
  That's the problem I have with all of the commercial password managers: I simply don't trust them. I find it incredibly telling that every big password manager has a mandatory, binding arbitration clause in their user agreements. This tells me that I am supposed to take their word on everything yet I have zero recourse to a neutral third party if the password manager company leaks (or intentionally hands over) all of my passwords. That's not reasonable.
  - fencepost 8y ago
    Unfortunately, I have a similar issue with things like Keepass - perhaps the core project has enough eyes on it, but how about all those "Contributed/Unofficial KeePass Ports"?
    - techsupporter 8y ago
      Totally reasonable. I figure the people who write the unofficial ports I use have a personal reputation to protect. It bothers me a lot that the "professional" password management people disclaim all of their liability and just expect me to hope that it works the way they want.
      - fencepost 8y ago
        I kind of figure almost the opposite - those commercial entities have both the resources (hopefully) for subject matter experts and auditing (also hopefully) and a strong financial interest in not having a disclosed breach (and almost all significant breaches are likely to be disclosed/discovered at some point). On the other side a small development team of individuals seem (to me) less likely to have the resources and more ability to simply walk away in case of a breach.
        jeena 8y ago
        Because they don't offer to save your passwords the breach can always just be if someone attacks your personal computer, which is so much less likely than that someone tries to attack a company which hosts thousands or even millions password databases. In the open source world you have at least the possibility that someone who you trust looks at the code, with the closed source you don't.

by awill 8y ago

jeena 8y ago

The newest kid on the block is KeePassXC https://keepassxc.org https://keepassxc.org

bubblethink 8y ago
The browser extension leaves a lot to be desired though. I feel that there are a lot of good standalone password managers, but the ones with good browser extensions are far fewer. I'm using bitwarden right now, which so far seems to be the best of the open source ones in terms of usability.

jeena 8y ago

Hm, enpass seems to be closed source which makes it unusable for me to store all my passwords basically because of the same as someone wrote in their forum: "The fact that Enpass isn't submitting all my passwords to enpass.io right now doesn't mean anything. I'm currently using iptables to restrict Enpass from doing so, but I don't know yet how to archive the same thing on my unrooted Android."

techsupporter 8y ago
That's the problem I have with all of the commercial password managers: I simply don't trust them. I find it incredibly telling that every big password manager has a mandatory, binding arbitration clause in their user agreements. This tells me that I am supposed to take their word on everything yet I have zero recourse to a neutral third party if the password manager company leaks (or intentionally hands over) all of my passwords. That's not reasonable.
- fencepost 8y ago
  Unfortunately, I have a similar issue with things like Keepass - perhaps the core project has enough eyes on it, but how about all those "Contributed/Unofficial KeePass Ports"?
  - techsupporter 8y ago
    Totally reasonable. I figure the people who write the unofficial ports I use have a personal reputation to protect. It bothers me a lot that the "professional" password management people disclaim all of their liability and just expect me to hope that it works the way they want.
    - fencepost 8y ago
      I kind of figure almost the opposite - those commercial entities have both the resources (hopefully) for subject matter experts and auditing (also hopefully) and a strong financial interest in not having a disclosed breach (and almost all significant breaches are likely to be disclosed/discovered at some point). On the other side a small development team of individuals seem (to me) less likely to have the resources and more ability to simply walk away in case of a breach.
      - jeena 8y ago
        Because they don't offer to save your passwords the breach can always just be if someone attacks your personal computer, which is so much less likely than that someone tries to attack a company which hosts thousands or even millions password databases. In the open source world you have at least the possibility that someone who you trust looks at the code, with the closed source you don't.