5 ms·

In my opinion, it should be a bare minimum for something as important as a password manager to be free software. Others have mentioned Bitwarden and Keepass in

by jdu9 6y ago

In my opinion, it should be a bare minimum for something as important as a password manager to be free software. Others have mentioned Bitwarden and Keepass in this thread, both of which meet that criteria, but personally I'll stick with pass since I don't need a GUI.

waynesonfire 6y ago
I use pass(1) as well. I love that it allows me to use my yubikey. Also a 1password user. Can't deny it's a wonderful product.
lomex123 6y ago
What does that even mean? There is free alternatives. I use 1password because it does a good job.
- _jal 6y ago
  ...as in freedom, not beer. It means the gp considers the problem space sensitive enough that the source should be available for inspection and modification.
  - tialaramex 6y ago
    The latter in particular means that if there's a thing you wish the software did and it doesn't you can fix that. The more central to your everyday life something is, the more important that is. We take this for granted elsewhere in our lives. You buy a refrigerator, the fridge company doesn't get to tell you that too bad you're only allowed to keep soda in their $80 dedicated "Soda rack" and that little shelf is only for vegetables - you can just put your soda there anyway, and if you want you can even make or buy a gizmo that dispenses cans just the way you want, screw their $80 plastic garbage, you made one from stainless steel scrap at community college. You can take Free Software like pass to pieces to understand how it works too. The thing I keep coming back to is how it uses 'tr' to get random passwords, because it's so simple and yet when you step back it's obviously the correct design. The method goes like this: Unix 'tr' has a mode where it just ignores all input except the character classes you selected which pass through. So e.g. you can say you want passwords with just A-Z0-9. Hook it up to /dev/urandom and the device spews random bytes into it. All the ones that aren't acceptable are just thrown away. Then you catch the desired length of output from 'tr' and you're done. I've seen software attempt to try to bodge a budget of random bits into a fixed character set, which is very difficult to do safely and correctly - but 'pass' just doesn't try to do that at all, why bother when you can make as many random bytes as you want anyway?
    - kspacewalk2 6y ago
      > The latter in particular means that if there's a thing you wish the software did and it doesn't you can fix that. Yeah, that's not really relevant to me... Along with ~99.5% of people out there, I will not be fucking around making customizations to my password manager. There are things you tinker with, and then there are things that hold passwords to your financial and professional life. I have not yet and will not anytime soon be rolling out my own crypto or my own password manager and trusting it with real-life credentials.
heavymark 6y ago
Huh, you are saying that something that is so important you want for free, and that the company building this product for you should forgo money and work simply for free? Wouldn't the opposite make far more sense that something that is so important you should pay 'more' for? They are free options that you are welcome to, but for people who want more they pay for it.
- uponcoffee 6y ago
  Not free as in beer, but free as in freely auditable/accessible. Trusting your life to a black box controlled by other people is a lot to ask.
- 3np 6y ago
  https://en.wikipedia.org/wiki/Free_software https://en.wikipedia.org/wiki/Free_software Free software can still be paid software.
- jdu9 6y ago
  Nowhere did I mention money. It's primarily a trust issue when it comes to proprietary solutions like 1Password safekeeping your passwords. Look at Bitwarden for example: "All of our source code is hosted on GitHub and is free for anyone to review". Yet they have paid plans for individuals and businesses.
- deleted 6y ago
  [deleted]
- ohazi 6y ago
  The only way to guarantee that your keyring is secure long-term is for the source code (and change history) of your password manager to be inspectable and verifiable. A promise made by a corporation is not sufficient. You can pay a corporation to buy a product with more features or better service. But you can't pay a corporation to hold or maintain a principle. There will always be someone who can offer them more money to hold the opposing principle. Principled people who work for a corporation eventually leave and are replaced with apethetic or differently principled people. In this case, the principle is the privacy and security of the credentials in your keyring. How much money do you think a bad actor would be willing to pay for these? How much money do you think a bad actor would be able to pay to a corporation that secures credentials for a huge number of users, and who can push arbitrary updates without pesky source code validation getting in the way? You and I don't have enough money to win this game. Look at another high value target for comparison -- browser extensions that have a large installed userbase. Browser extensions are frequently bought for tens to hundreds of thousands of dollars by ad/tracking/malware vendors in order to quietly replace the extension with one that does their bidding, without the users' knowledge. What's the solution to this problem? Open-source, inspectable, verifyable software that is maintained by a person or a community that shares your principles. I trust the work of Jason Donenfeld (pass, wireguard) and Raymond Hill (uBlock Origin) more than the work of any corporation selling a similar product at any price. The incentive structure of corporations in general precludes them from being given the level of trust required for certain products.
GrantZvolsky 6y ago
For anyone wondering, pass refers to this[1] project. [1]: https://git.zx2c4.com/password-store/tree/README https://git.zx2c4.com/password-store/tree/README

by jdu9 6y ago

waynesonfire 6y ago

I use pass(1) as well. I love that it allows me to use my yubikey. Also a 1password user. Can't deny it's a wonderful product.

lomex123 6y ago

What does that even mean? There is free alternatives. I use 1password because it does a good job.

_jal 6y ago
...as in freedom, not beer. It means the gp considers the problem space sensitive enough that the source should be available for inspection and modification.
- tialaramex 6y ago
  The latter in particular means that if there's a thing you wish the software did and it doesn't you can fix that. The more central to your everyday life something is, the more important that is. We take this for granted elsewhere in our lives. You buy a refrigerator, the fridge company doesn't get to tell you that too bad you're only allowed to keep soda in their $80 dedicated "Soda rack" and that little shelf is only for vegetables - you can just put your soda there anyway, and if you want you can even make or buy a gizmo that dispenses cans just the way you want, screw their $80 plastic garbage, you made one from stainless steel scrap at community college. You can take Free Software like pass to pieces to understand how it works too. The thing I keep coming back to is how it uses 'tr' to get random passwords, because it's so simple and yet when you step back it's obviously the correct design. The method goes like this: Unix 'tr' has a mode where it just ignores all input except the character classes you selected which pass through. So e.g. you can say you want passwords with just A-Z0-9. Hook it up to /dev/urandom and the device spews random bytes into it. All the ones that aren't acceptable are just thrown away. Then you catch the desired length of output from 'tr' and you're done. I've seen software attempt to try to bodge a budget of random bits into a fixed character set, which is very difficult to do safely and correctly - but 'pass' just doesn't try to do that at all, why bother when you can make as many random bytes as you want anyway?
  - kspacewalk2 6y ago
    > The latter in particular means that if there's a thing you wish the software did and it doesn't you can fix that. Yeah, that's not really relevant to me... Along with ~99.5% of people out there, I will not be fucking around making customizations to my password manager. There are things you tinker with, and then there are things that hold passwords to your financial and professional life. I have not yet and will not anytime soon be rolling out my own crypto or my own password manager and trusting it with real-life credentials.

heavymark 6y ago

Huh, you are saying that something that is so important you want for free, and that the company building this product for you should forgo money and work simply for free? Wouldn't the opposite make far more sense that something that is so important you should pay 'more' for? They are free options that you are welcome to, but for people who want more they pay for it.

uponcoffee 6y ago
Not free as in beer, but free as in freely auditable/accessible. Trusting your life to a black box controlled by other people is a lot to ask.
3np 6y ago
https://en.wikipedia.org/wiki/Free_software https://en.wikipedia.org/wiki/Free_software Free software can still be paid software.
jdu9 6y ago
Nowhere did I mention money. It's primarily a trust issue when it comes to proprietary solutions like 1Password safekeeping your passwords. Look at Bitwarden for example: "All of our source code is hosted on GitHub and is free for anyone to review". Yet they have paid plans for individuals and businesses.
deleted 6y ago
[deleted]
ohazi 6y ago
The only way to guarantee that your keyring is secure long-term is for the source code (and change history) of your password manager to be inspectable and verifiable. A promise made by a corporation is not sufficient. You can pay a corporation to buy a product with more features or better service. But you can't pay a corporation to hold or maintain a principle. There will always be someone who can offer them more money to hold the opposing principle. Principled people who work for a corporation eventually leave and are replaced with apethetic or differently principled people. In this case, the principle is the privacy and security of the credentials in your keyring. How much money do you think a bad actor would be willing to pay for these? How much money do you think a bad actor would be able to pay to a corporation that secures credentials for a huge number of users, and who can push arbitrary updates without pesky source code validation getting in the way? You and I don't have enough money to win this game. Look at another high value target for comparison -- browser extensions that have a large installed userbase. Browser extensions are frequently bought for tens to hundreds of thousands of dollars by ad/tracking/malware vendors in order to quietly replace the extension with one that does their bidding, without the users' knowledge. What's the solution to this problem? Open-source, inspectable, verifyable software that is maintained by a person or a community that shares your principles. I trust the work of Jason Donenfeld (pass, wireguard) and Raymond Hill (uBlock Origin) more than the work of any corporation selling a similar product at any price. The incentive structure of corporations in general precludes them from being given the level of trust required for certain products.

GrantZvolsky 6y ago

For anyone wondering, pass refers to this[1] project. [1]: https://git.zx2c4.com/password-store/tree/README https://git.zx2c4.com/password-store/tree/README