4 ms·

They were also pretty dismissive of Linux for a long time, so it's kind of funny to hear it as one of their biggest requests. 1Password X narrowly prevented me

by jchw 6y ago

They were also pretty dismissive of Linux for a long time, so it's kind of funny to hear it as one of their biggest requests. 1Password X narrowly prevented me from switching for a while, but I've come to see alternatives as generally better options. Yeah, they're not as flashy, but I think Bitwarden and Keepass XC do a great job. Keepass XC may even be doing a better job at security. At least in some dimensions. https://keepassxc.org/blog/2019-02-21-memory-security/ https://keepassxc.org/blog/2019-02-21-memory-security/

karlshea 6y ago
That’s where Agilebits has me; the UI on Mac and iOS is so much better than the alternatives. I do keep looking, Keepass XC looks really good since the last time I checked around.
- benhurmarcel 6y ago
  KeepassXC is quite good if you mainly use it on your computer. I've been using Keepass(XC) for about 10 years, it's secure and reliable. But I'm looking to switch to 1password or Bitwarden as I'm increasingly using portable devices (phone, tablet…).
  - curt15 6y ago
    Keepass2Android works pretty well for me. You can sync your password database via google drive or other file sharing services.
    - distances 6y ago
      Seconded, Keepass2Android is great and has very good integration on Android. You can use the autofill feature to, well, autofill the credentials fields in any app. Has merge functionality if you've edited the password file both on mobile and computer. It even has an offline variant that keeps everything local. I'm using that with NextCloud.
  - jchw 6y ago
    If you do end up leaving Keepass, Bitwarden has been a good experience for me. I can’t attest much about security but it seems OK from my perspective.
nanoha 6y ago
FWIW cache side channel attacks are primarily a threat on (shared) cloud platforms, but not as much [1] on personal devices. Considering that 1password runs in its own process and that most personal devices should have Meltdown mitigations in place, it would be prohibitively difficult to successfully launch a cache side channel attack to extract the password from outside of your device, especially at scale. Attackers would attempt to find other software vulnerabilities instead. I think it would indeed be nice if 1password scrubbed sensitive data from memory, but not a complete deal breaker if it didn't. I do wonder if this could be more of a problem on 1passwordX, though. [1]: not zero, but still
- nanoha 6y ago
  Oops, I somehow managed to respond to the wrong comment. I meant to respond to https://news.ycombinator.com/item?id=24057416 https://news.ycombinator.com/item?id=24057416

by jchw 6y ago

karlshea 6y ago

That’s where Agilebits has me; the UI on Mac and iOS is so much better than the alternatives. I do keep looking, Keepass XC looks really good since the last time I checked around.

benhurmarcel 6y ago
KeepassXC is quite good if you mainly use it on your computer. I've been using Keepass(XC) for about 10 years, it's secure and reliable. But I'm looking to switch to 1password or Bitwarden as I'm increasingly using portable devices (phone, tablet…).
- curt15 6y ago
  Keepass2Android works pretty well for me. You can sync your password database via google drive or other file sharing services.
  - distances 6y ago
    Seconded, Keepass2Android is great and has very good integration on Android. You can use the autofill feature to, well, autofill the credentials fields in any app. Has merge functionality if you've edited the password file both on mobile and computer. It even has an offline variant that keeps everything local. I'm using that with NextCloud.
- jchw 6y ago
  If you do end up leaving Keepass, Bitwarden has been a good experience for me. I can’t attest much about security but it seems OK from my perspective.

nanoha 6y ago

FWIW cache side channel attacks are primarily a threat on (shared) cloud platforms, but not as much [1] on personal devices. Considering that 1password runs in its own process and that most personal devices should have Meltdown mitigations in place, it would be prohibitively difficult to successfully launch a cache side channel attack to extract the password from outside of your device, especially at scale. Attackers would attempt to find other software vulnerabilities instead. I think it would indeed be nice if 1password scrubbed sensitive data from memory, but not a complete deal breaker if it didn't. I do wonder if this could be more of a problem on 1passwordX, though. [1]: not zero, but still

nanoha 6y ago
Oops, I somehow managed to respond to the wrong comment. I meant to respond to https://news.ycombinator.com/item?id=24057416 https://news.ycombinator.com/item?id=24057416