4 ms·

Cool project. Unfortunately, the reality with password managers is that if I'm going to use it, then it needs to support Windows, Mac, Linux; have a good CLI; s

by mholt 7y ago

Cool project. Unfortunately, the reality with password managers is that if I'm going to use it, then it needs to support Windows, Mac, Linux; have a good CLI; support all major browsers; and have apps and autofill on most mobile devices. And they need to sync, through my own server. Most password manager projects have one or two of these, but it's gonna need the whole package for me to switch to it.

alpb 7y ago
Add a security team on top of that. Unless I'm a crypto expert, it's unlikely that I'll use some DIY password manager on my desktop. Also agree that browser support is quite a major reality of password managers today. Unless you can do that, you're basically a "secrets storage".
- jarm0 7y ago
  That's a good principle in theory, but how do you know that using any 3rd party password manager is any better? There has been plenty of security problems with all of the major providers as far as I'm concerned. At least with all these DIY password managers which are open-source you can see all the code, which is not true for any 3rd party custom made solutions. Also, one of the reasons why I went with libsodium as an encryption solution is the exact same reason - I'm not a cryptograper and libsodium offers an easy and fool-proof API to not mess things up accidentally. This is not true for many other (popular) cryptography solutions.
thrownaway954 7y ago
and this is why I use a Google Sheet as mine :) I know most will say I'm nuts... but I'm sure I'm not the only one out there and I get everything you just described for free. *edit... well except the autofill, but that's why there is good old copy and paste :)
- dastx 7y ago
  > I get everything you just described for free. You get one additional feature that others don't get, and that's Google and likely all sorts of government agencies being able to record all your passwords. Great feature.
  - thrownaway954 7y ago
    I don't kid myself... I'm not that important... no one is looking through the crap I have on my Google Drive.
- mdgrech23 7y ago
  Yea you have zero security w/ this solution. I doubt it's even encrypted.
- BareNakedCoder 7y ago
  I do something similar except the passwords in my gdoc are secured with https://securemypw.appspot.com/ https://securemypw.appspot.com/ (disclaimer: I wrote this 5 years ago so I could share passwords with my wife).
- jarm0 7y ago
  This is a really simple and definitely a better solution than not using any password manager at all (if we leave out possible government/Google issues, which I personally would definitely not leave out). But yeah, as already mentioned - it breaks the privacy and security principles. I would recommend you try anything else, which is actually meant for storing passwords/secrets and when switching, then change all your passwords :)
kkshetty 7y ago
Looks like https://bitwarden.com/ https://bitwarden.com/ meets all your requirements Its open source(https://github.com/bitwarden https://github.com/bitwarden), so self hosting is possible as well => https://help.bitwarden.com/article/install-on-premise/ https://help.bitwarden.com/article/install-on-premise/ Disclosure: I've been using it for a year now. $10 per year paid plan. Just renewed again.
- afterwalk 7y ago
  How are bitwarden/1password better than password manager for chrome and other browsers?
  - behringer 7y ago
    They work outside the browser. They work in more than one browser. They have more features.
    - jvagner 7y ago
      This. I use it across my iPhones and iPads, and all the major browsers on my Mac. Plus, my business partner and I have a shared vault in 1Password for commonly needed account passwords. It’s super useful.
cl3misch 7y ago
Have you heard of "pass"? It's a minimal but very practical password manager best used on *nix terminal, but has great extensions and works on Android and iOS. (the iOS app is the main thing keeping me on my iPhone...). Everything is free and open-source. https://www.passwordstore.org/ https://www.passwordstore.org/ Caveat: It's self-hosted.
- dewey 7y ago
  There's also https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass if you want a compatible Go version.
dewey 7y ago
https://1password.com/downloads https://1password.com/downloads Windows, Mac, Linux, CLI, supports all major browser and supports filling on iOS (Don't have experience with Android). It's just not open source but it's a pretty great package and I'm using it for a long time already.
jarm0 7y ago
Thanks! This project has it all except autofill. Okay, to be really honest then on mobile you need to access secrets via browser (UI is responsive though) and there's no separate app for that. Autofill is not supported and I don't plan to add it on purpose. It's even written in the core project (https://github.com/jarmo/secrets https://github.com/jarmo/secrets) README: "does not auto-fill any passwords anywhere (you don't want that anyway) - it's up to you how you will fill your passwords;". There's one link to an article regarding possible problems with autofills https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-u... When it comes to mobile apps then I don't find them that important to add yet another possible attack vector (also mentioned in the README) since it's pretty easy to copy-paste whatever is needed.

by mholt 7y ago

alpb 7y ago

Add a security team on top of that. Unless I'm a crypto expert, it's unlikely that I'll use some DIY password manager on my desktop. Also agree that browser support is quite a major reality of password managers today. Unless you can do that, you're basically a "secrets storage".

jarm0 7y ago
That's a good principle in theory, but how do you know that using any 3rd party password manager is any better? There has been plenty of security problems with all of the major providers as far as I'm concerned. At least with all these DIY password managers which are open-source you can see all the code, which is not true for any 3rd party custom made solutions. Also, one of the reasons why I went with libsodium as an encryption solution is the exact same reason - I'm not a cryptograper and libsodium offers an easy and fool-proof API to not mess things up accidentally. This is not true for many other (popular) cryptography solutions.

thrownaway954 7y ago

and this is why I use a Google Sheet as mine :) I know most will say I'm nuts... but I'm sure I'm not the only one out there and I get everything you just described for free. *edit... well except the autofill, but that's why there is good old copy and paste :)

dastx 7y ago
> I get everything you just described for free. You get one additional feature that others don't get, and that's Google and likely all sorts of government agencies being able to record all your passwords. Great feature.
- thrownaway954 7y ago
  I don't kid myself... I'm not that important... no one is looking through the crap I have on my Google Drive.
mdgrech23 7y ago
Yea you have zero security w/ this solution. I doubt it's even encrypted.
BareNakedCoder 7y ago
I do something similar except the passwords in my gdoc are secured with https://securemypw.appspot.com/ https://securemypw.appspot.com/ (disclaimer: I wrote this 5 years ago so I could share passwords with my wife).
jarm0 7y ago
This is a really simple and definitely a better solution than not using any password manager at all (if we leave out possible government/Google issues, which I personally would definitely not leave out). But yeah, as already mentioned - it breaks the privacy and security principles. I would recommend you try anything else, which is actually meant for storing passwords/secrets and when switching, then change all your passwords :)

kkshetty 7y ago

Looks like https://bitwarden.com/ https://bitwarden.com/ meets all your requirements Its open source(https://github.com/bitwarden https://github.com/bitwarden), so self hosting is possible as well => https://help.bitwarden.com/article/install-on-premise/ https://help.bitwarden.com/article/install-on-premise/ Disclosure: I've been using it for a year now. $10 per year paid plan. Just renewed again.

afterwalk 7y ago
How are bitwarden/1password better than password manager for chrome and other browsers?
- behringer 7y ago
  They work outside the browser. They work in more than one browser. They have more features.
  - jvagner 7y ago
    This. I use it across my iPhones and iPads, and all the major browsers on my Mac. Plus, my business partner and I have a shared vault in 1Password for commonly needed account passwords. It’s super useful.

cl3misch 7y ago

Have you heard of "pass"? It's a minimal but very practical password manager best used on *nix terminal, but has great extensions and works on Android and iOS. (the iOS app is the main thing keeping me on my iPhone...). Everything is free and open-source. https://www.passwordstore.org/ https://www.passwordstore.org/ Caveat: It's self-hosted.

dewey 7y ago
There's also https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass if you want a compatible Go version.

dewey 7y ago

https://1password.com/downloads https://1password.com/downloads Windows, Mac, Linux, CLI, supports all major browser and supports filling on iOS (Don't have experience with Android). It's just not open source but it's a pretty great package and I'm using it for a long time already.

jarm0 7y ago

Thanks! This project has it all except autofill. Okay, to be really honest then on mobile you need to access secrets via browser (UI is responsive though) and there's no separate app for that. Autofill is not supported and I don't plan to add it on purpose. It's even written in the core project (https://github.com/jarmo/secrets https://github.com/jarmo/secrets) README: "does not auto-fill any passwords anywhere (you don't want that anyway) - it's up to you how you will fill your passwords;". There's one link to an article regarding possible problems with autofills https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-user-identities-web-trackers-exploit-browser-login-managers/ https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-u... When it comes to mobile apps then I don't find them that important to add yet another possible attack vector (also mentioned in the README) since it's pretty easy to copy-paste whatever is needed.