6 ms·

> Ever since they went to the cloud, I stopped using and recommending them to friends and family. The whole point of using a password manager is that the passw

> Ever since they went to the cloud, I stopped using and recommending them to friends and family. The whole point of using a password manager is that the passwords I create and use on my {desktop, laptop, work machine, phone} are immediately and seamlessly available to me on all of the other platforms. As far as I know it is Cloud integration which enables this absolutely necessary and table-stakes functionality. Is that not true? Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind?

robszumski 7y ago
I'm not in a rush to put the holy grail of my personal info into someone's cloud service that I can't manage or securely delete. I think that KeePass + [Dropbox,Google Drive,etc] is the best solution. You can easily get these files on to your phone for passwords on the go.
- sagichmal 7y ago
  > You can easily get these files on to your phone for passwords on the go. Something like 80% of the value prop of my password manager use is one-tap login (with FaceID) on mobile. Handwaving this away is failing to understand the product and market at a fundamental level. edit: literally a paper notebook with my passwords written in it is a better solution in essentially every dimension than a non-syncing password manager.
  - xmprt 7y ago
    I definitely see the benefit of storing my passwords locally and not some single point of failure, but I also wouldn't ever claim it's simple or even a good solution. It does help me ease up on creating new account to places I don't need because I think about having to create and sync up a new password between my devices.
    - ymolodtsov 7y ago
      How is that a single point of failure? You have downloaded copies on all your devices and the database is encrypted with your own master key, so even if 1Password is hacked there isn’t really a problem, just like LastPass hasn’t died when it had one.
- xenophonf 7y ago
  This makes zero sense. You don't want to store passwords in the cloud, but you store your passwords in the cloud anyway!
  - oe 7y ago
    A cloud you can control yourself.
  - mikenyc 7y ago
    The concern, which is fair, is that 1password's cloud is a target. And those targeting it have only one intention, which is to steal people's passwords and other information stored in the 1password cloud. In contrast, of course using the dropbox sync approach with 1password does put your information in the cloud as well. But, it's in your personal dropbox account. That dropbox account could absolutely be hacked, but very unlikely by someone with such clear intent to steal your 1password vault. Basically, 1password's cloud is the ultimate target, and your 1password vault in your personal dropbox account is not.
    - ticmasta 7y ago
      As a non-user of 1password, what's the value of the vault on it's own? don't you need a master password to unlock it?
      - sedatk 7y ago
        Exactly.
cj 7y ago
1password had (maybe still has?) integrations with services like Dropbox where your vault would be stored on a 3rd party service like Dropbox to achieve the cross-device syncing your describing. IMO this was the more secure implementation (assuming 1password was only storing fully encrypted files on your 3rd party cloud preference) - even if someone broke in your Dropbox, they can’t decrypt your passwords without your master pass. An end-to-end cloud solution provided natively by 1pass is much more user friendly and easier, but requires putting an order of magnitude more trust in 1password’s security architecture (which of course is closed source).
- chrisweekly 7y ago
  This option [1Pwd vault stored in Dropbox] is still available; I've been using it for years. Highly recommended!
  - robenkleene 7y ago
    Just adding to this accurate statement, you can also sync a vault in iCloud. So there are at least three syncing methods: 1. 1Password Cloud 2. iCloud 3. Dropbox And at least 2 and 3 can be used simultaneously, which is what I do, with my main vault in iCloud, and temporary vaults, e.g., passwords for a particular job, in Dropbox.
    - sixstringtheory 7y ago
      There’s also still the WiFi sync method which you can use to sync between devices without that information ever leaving your local network.
- luhn 7y ago
  The fundamentals are still the same, everything is encrypted with your master password before being sent to 1Password's cloud. So even if someone infiltrates 1Password's storage, all they get is encrypted files, same with Dropbox.
  - 7y ago
Nullabillity 7y ago
> As far as I know it is Cloud integration which enables this absolutely necessary and table-stakes functionality. Is that not true? Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind? Just store it in your regular sync solution. Syncthing works great, and I don't remember any issues with Dropbox back when I used that. I'd imagine that iCloud or SkyDrive would work fine too, for the masochistically inclined.
sixstringtheory 7y ago
> The whole point of using a password manager is that the passwords I create and use on my {desktop, laptop, work machine, phone} are immediately and seamlessly available to me on all of the other platforms. That isn’t the whole point of 1PW though, or at least it wasn’t at the beginning, as I saw it. It was a way to avoid having to remember a unique, secure (read: probably hard to remember) password for every service that requires one. A place to store them all so you don’t have to remember, or worse, reuse the ones you can remember, and/or use easy-to-remember ones (read: less secure). It’s in the name: one password gets you access to all your passwords. Automatic form filling and cloud sync are definitely selling points and certainly convenient, but they are also risk vectors. I’d not call cloud sync essential; I get by fine without it. I just use the WiFi sync option.
- sagichmal 7y ago
  If the goal is to avoid having to remember strong passwords, then a strong password generator + a paper journal is resistant to more threat models and should be preferred. Password managers without transparent sync and autofill UX are a half-product at best.
  - greedo 7y ago
    Typing a long, complex password on a mobile device is tedious. Much easier to use 1Password.
    - sagichmal 7y ago
      The pain of doing that is nonzero, but much less than the pain of keeping the passwords synced manually, or through an intermediary like Dropbox (permissions, having Dropbox installed and running on my phone, etc.)
  - sixstringtheory 7y ago
    It’s probably similar but I’m not convinced it’s preferred. If I lose that journal anyone can read it. If I lose my computer it is most likely locked already, and if not it (as well as 1PW) autolocks itself after a short time. Also like I mentioned elsewhere, I do sync my vaults, but only using the local WiFi option.
kuzimoto 7y ago
> Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind? For what it's worth, I use it with an ssh plugin, so I only store the database on one machine, and connect using ssh on desktop/Android. It's also pretty straightforward to set up something like syncthing, making it easier for average person.

robszumski 7y ago

I'm not in a rush to put the holy grail of my personal info into someone's cloud service that I can't manage or securely delete. I think that KeePass + [Dropbox,Google Drive,etc] is the best solution. You can easily get these files on to your phone for passwords on the go.

sagichmal 7y ago
> You can easily get these files on to your phone for passwords on the go. Something like 80% of the value prop of my password manager use is one-tap login (with FaceID) on mobile. Handwaving this away is failing to understand the product and market at a fundamental level. edit: literally a paper notebook with my passwords written in it is a better solution in essentially every dimension than a non-syncing password manager.
- xmprt 7y ago
  I definitely see the benefit of storing my passwords locally and not some single point of failure, but I also wouldn't ever claim it's simple or even a good solution. It does help me ease up on creating new account to places I don't need because I think about having to create and sync up a new password between my devices.
  - ymolodtsov 7y ago
    How is that a single point of failure? You have downloaded copies on all your devices and the database is encrypted with your own master key, so even if 1Password is hacked there isn’t really a problem, just like LastPass hasn’t died when it had one.
xenophonf 7y ago
This makes zero sense. You don't want to store passwords in the cloud, but you store your passwords in the cloud anyway!
- oe 7y ago
  A cloud you can control yourself.
- mikenyc 7y ago
  The concern, which is fair, is that 1password's cloud is a target. And those targeting it have only one intention, which is to steal people's passwords and other information stored in the 1password cloud. In contrast, of course using the dropbox sync approach with 1password does put your information in the cloud as well. But, it's in your personal dropbox account. That dropbox account could absolutely be hacked, but very unlikely by someone with such clear intent to steal your 1password vault. Basically, 1password's cloud is the ultimate target, and your 1password vault in your personal dropbox account is not.
  - ticmasta 7y ago
    As a non-user of 1password, what's the value of the vault on it's own? don't you need a master password to unlock it?
    - sedatk 7y ago
      Exactly.

cj 7y ago

1password had (maybe still has?) integrations with services like Dropbox where your vault would be stored on a 3rd party service like Dropbox to achieve the cross-device syncing your describing. IMO this was the more secure implementation (assuming 1password was only storing fully encrypted files on your 3rd party cloud preference) - even if someone broke in your Dropbox, they can’t decrypt your passwords without your master pass. An end-to-end cloud solution provided natively by 1pass is much more user friendly and easier, but requires putting an order of magnitude more trust in 1password’s security architecture (which of course is closed source).

chrisweekly 7y ago
This option [1Pwd vault stored in Dropbox] is still available; I've been using it for years. Highly recommended!
- robenkleene 7y ago
  Just adding to this accurate statement, you can also sync a vault in iCloud. So there are at least three syncing methods: 1. 1Password Cloud 2. iCloud 3. Dropbox And at least 2 and 3 can be used simultaneously, which is what I do, with my main vault in iCloud, and temporary vaults, e.g., passwords for a particular job, in Dropbox.
  - sixstringtheory 7y ago
    There’s also still the WiFi sync method which you can use to sync between devices without that information ever leaving your local network.
luhn 7y ago
The fundamentals are still the same, everything is encrypted with your master password before being sent to 1Password's cloud. So even if someone infiltrates 1Password's storage, all they get is encrypted files, same with Dropbox.
- 7y ago

Nullabillity 7y ago

> As far as I know it is Cloud integration which enables this absolutely necessary and table-stakes functionality. Is that not true? Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind? Just store it in your regular sync solution. Syncthing works great, and I don't remember any issues with Dropbox back when I used that. I'd imagine that iCloud or SkyDrive would work fine too, for the masochistically inclined.

sixstringtheory 7y ago

> The whole point of using a password manager is that the passwords I create and use on my {desktop, laptop, work machine, phone} are immediately and seamlessly available to me on all of the other platforms. That isn’t the whole point of 1PW though, or at least it wasn’t at the beginning, as I saw it. It was a way to avoid having to remember a unique, secure (read: probably hard to remember) password for every service that requires one. A place to store them all so you don’t have to remember, or worse, reuse the ones you can remember, and/or use easy-to-remember ones (read: less secure). It’s in the name: one password gets you access to all your passwords. Automatic form filling and cloud sync are definitely selling points and certainly convenient, but they are also risk vectors. I’d not call cloud sync essential; I get by fine without it. I just use the WiFi sync option.

sagichmal 7y ago
If the goal is to avoid having to remember strong passwords, then a strong password generator + a paper journal is resistant to more threat models and should be preferred. Password managers without transparent sync and autofill UX are a half-product at best.
- greedo 7y ago
  Typing a long, complex password on a mobile device is tedious. Much easier to use 1Password.
  - sagichmal 7y ago
    The pain of doing that is nonzero, but much less than the pain of keeping the passwords synced manually, or through an intermediary like Dropbox (permissions, having Dropbox installed and running on my phone, etc.)
- sixstringtheory 7y ago
  It’s probably similar but I’m not convinced it’s preferred. If I lose that journal anyone can read it. If I lose my computer it is most likely locked already, and if not it (as well as 1PW) autolocks itself after a short time. Also like I mentioned elsewhere, I do sync my vaults, but only using the local WiFi option.

kuzimoto 7y ago

> Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind? For what it's worth, I use it with an ssh plugin, so I only store the database on one machine, and connect using ssh on desktop/Android. It's also pretty straightforward to set up something like syncthing, making it easier for average person.