6 ms·

Seriously, use 1Password... it's great.

• Du4No 16y ago
  KeePass as a free alternative
  • wnoise 16y ago
    And the clone keepassx for running on unixes.
• jacquesm 16y ago
  Until they get hacked...
  • there 16y ago
    they don't store any passwords.
    • jacquesm 16y ago
      That doesn't mean they can't be compromised. After all, if 1 password gets hacked the passwords that are generated could be sent to two parties instead of just to you.
      • ubernostrum 16y ago
        After all, if 1 password gets hacked the passwords that are generated could be sent to two parties instead of just to you. And if someone mounts a camera in the smoke detector in my apartment they could see me type in the double super secret password whose plaintext has never been stored by a computer. So what's your point, exactly? Tools which generate good passwords and store them locally on your computer with decent-enough security are light-years ahead of what most people do, and their use should be encouraged.
        • anthonyb 16y ago
          They're not open source, and I don't see any checksums on their site - so it's possible that their site could be hacked and have a trojan version uploaded. Harder to do for the iPhone/iPad version, but it might still be possible for a clever hacker^Wcracker to put something into the source code if they can get access to it.
          • ubernostrum 16y ago
            Yes, and a clever hacker might sabotage my C compiler to always build a back door into software it compiles. Even if the compiler's open source that can be hard or impossible to detect. But in my experience, too many people confuse "this is a possible threat" with "this is a threat it's reasonable for me worry/take action about", and that's what I was getting at.
            • anthonyb 16y ago
              C compilers are distributed with checksums and public key signatures, plus it's possible to decompile generated binaries and examine them - so it's at least an order of magnitude harder to compromise them. 1password is easier and a much juicier target, so compromised binaries are definitely a possible threat. How would you know it was compromised, unless you had a packet sniffer going on your network?
              • jacquesm 16y ago
                On their network!
                • anthonyb 16y ago
                  If you're using the iPhone/iPad version. The Mac/Windows ones seem to be downloads: http://agilewebsolutions.com/downloads http://agilewebsolutions.com/downloads
              • ubernostrum 16y ago
                Again: you're saying "possible threat". I agree it's possible. What you have not demonstrated is that it's likely or reasonable enough to serve as a basis for changing my own actions. It's possible that a password manager could be completely open source, distributed with checksums and public key signatures, that my C compiler could be completely open source and distributed with checksums and public key signatures, and I could still end up with a backdoor in the final compiled result, detectable only by deciding to carefully examine the binary I just built. This is a "possible threat". Should I use that possibility as a justification for never using a password manager? Or for never using a C compiler?
• poundy 16y ago
  What would happen when they get hacked?
  • MiguelHudnandez 16y ago
    The biggest threat would be a new version of the software with some malicious aspects. They'd have to upload it and remain undetected long enough for people to update. This seems like a long shot, but stranger things have happened. I use 1Password, and it sure beats my old strategy of using a text file for all my unimportant passwords. Coincidentally, the 1Password plugin is helpful in preventing phishing, too. If you're at the wrong site, the 1Password autofill will not work.