11 ms·
Ask HN: What password managers can you recommend?
I used to be a happy 1Password user, but they seem insistent on making the experience as terrible as possible lately. I've tried BitWarden and Enpass, but their integration is worse and they suffer from some of the same problems as 1Password (subscription/server-based, not really in control of own data, etc.)
Are there any password managers that
- Integrate into browsers on all major platforms
- Have decent password generators
- No major security breaches in past ten years
- Local-first / sync via standard sync mechanisms (Dropbox, iCloud, sync thing, etc.)
EDIT: Based on responses below, I'm going to try KeePass[.*] and see how it goes. First hiccup is that 1Password import doesn't seem to work, but I'll keep at it.
- casley 5y ago
- bloopernova 5y agoBitwarden can be self-hosted. $10/year subscription cost is well, well worth it. If you don't self-host, note that everything is encrypted before being stored at bitwarden. They don't have access to your passwords.
- silisili 5y agoSame. 10/yr is not worth self hosting IMO, unless for security/paranoia reasons. Having a reliable, stable PW manager with a good app and TOTP capabilities feels like a steal at that price.
- sliken 5y agoNormally I'd agree, but a single docker command makes is so easy to run. I still recommend the $10/year jsut to help support them.
- torstenvl 5y agoBitwarden is just as user-hostile. They go out of their way to make it harder to own your data, when it should just be local-first vaults. Import/export is irrelevant. I want to own my data, not just be able to check out a copy whenever I want.
- noman-land 5y agoCurious what makes you say this. I recently started using it and it has prominent import and export functionality.
- deleted 5y ago[deleted]
- sliken 5y agoHow so? It's easy to run vault warden if you want local, and their android app supports connecting to your local vault warden. You can also export your data. How could they be less user-hostile?
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- deleted 5y ago[deleted]
- torstenvl 5y agoBitWarden is server-based and not local-first. Stop trolling for software that does not meet the parameters of the OP just because you disagree with those parameters.
- sliken 5y agoEr, not sure how I'm disagreeing or trolling. You claim I'm trolling without mentioning specifically why. Which parameter of the OP isn't being met? You can install the android bitwarden, which maintains a local DB. You can use it offline, and you can sync as you need with a server as needed or never at all. Which fits my definition of "local first". To double check I just put my phone in airplane mode, opened my local vault, and saw my password DB, which I could edit. You can sync by telling it to, and there's plugins for all major browsers. You can use a bitwarden provided server, run your own, or not have one. You can export and sync via dropbox, icloud, syncthing, etc. Not sure why you would do that instead of clicking sync and letting the client upload to your own server or a bitwarden server. Not sure how this could be consider user hostile. The rust server in particular is open source, single command to install, runs happily in provided docker container, etc. Exports are available in .json, or .csv. You can export from a web vault, browser extension, desktop client, mobile, or even command line. I'm not trolling, I use bitwarden on android, and vaultwarden (rust server compatible with warden) on the server and it works great. I'm quite fond of it's security, track record, security assessments, open source, SOC certifications etc. I also like having the local DB on a device I control and doesn't depend on any cloud, remote server, etc so I can have my password db accessible without any internet access.
- stunt 5y agoFirefox's built-in password manager. It works on mobile too.
- jstx1 5y agoBitwarden. The free version does everything I need from a password manager (which is to store, sync and generate passwords); decent browser extension, decent mobile app.
- schleck8 5y agoYou can also self-host it (either the original or a more lightweight fork called Vaultwarden. although i don't know how trustworthy it is)
- itake 5y ago+1 Bitwarden. I wish they dog fooded more so they can see how bad their browser extension is though.
- benbristow 5y agoHow come? Seems to work pretty well for me. Better than LastPass/Dashlane worked for me in the past.
- itake 5y agoresponded here: https://news.ycombinator.com/item?id=29800139 https://news.ycombinator.com/item?id=29800139
- aidenn0 5y agoOn firefox, their browser extension is excellent for me; what issues do you have?
- pydry 5y agoNot him, but: * Android app logs itself out every time I use it. * Lacked versioning of passwords (last time I checked). * The workflow to add new passwords / reset passwords on websites is clunky. This hasnt improved for years.
- 5y ago
- taxcoder 5y agoI use Kee-pass. The password generator is good and I'm not aware of any breaches. I don't know how good the browser integration is. Mine is backed up to several locations that I also use it from, I suppose Dropbox would work.
- blacksmith_tb 5y agoI use KeypassXC[1] on desktop, and Syncthing[2] to keep my db synced across devices. There are a few mobile clients that will work with Keepass dbs. 1: https://keepassxc.org/ https://keepassxc.org/ 2: https://syncthing.net/ https://syncthing.net/
- jdmichal 5y agoBrowser integration for KeePass is non-existent. What I found a few years ago when I tried, is that you install a plugin to KeePass that basically exposes your database to queries from other approved applications. The browser plugin will be one of those applications.
- durakot 5y agoWas in the same boat. KeePassXC is what you want.
- fsflover 5y agoI store my passwords in plain text in an offline virtual machine on Qubes OS. Copy them into browsers with a secure inter-VM copy mechanism (https://www.qubes-os.org/doc/how-to-copy-and-paste-text/ https://www.qubes-os.org/doc/how-to-copy-and-paste-text/).
- systemvoltage 5y ago1Password is fantastic IMO but all these password managers make me nervous.
- dhritzkiv 5y agoWhat's the terrible experience you're finding lately with 1Password? I've found it to be more consistent and stable in the last little while (especially when paired with the more recent Safari releases)
- putlake 5y agoI've not understood why one wouldn't use Chrome or Edge's built-in password manager. Is there a compelling reason to use a separate password manager app?
- SamuelAdams 5y agoI thought they were stored on-disk in a non-encrypted SQLite database. So anyone with physical access to your computer has all your passwords.
- koheripbal 5y agoI believe they are encrypted with you Windows credentials.
- sebazzz 5y agoYes, with DPAPI. In addition, you can choose a master password on Firefox.
- sushisource 5y agoYes: * Sometimes you need to fill passwords on app login screens on your phone, for example. At least 1Password for your phone can do this. * I sometimes need to fill passwords in non-browser apps. I can use a global shortcut to easily open my password list and copy what I need without touching the mouse. * I want to store things that aren't passwords securely. Etc
- thebean11 5y agoDo Chrome and Edge support autofill on other browsers? iOS apps? The answer might be yes just not sure. They are also missing features like secure notes, documents etc.
- deleted 5y ago[deleted]
- abfan1127 5y agoI don't use it because I need passwords on multiple mobile and desktop machines.
- thebean11 5y agoWhy are Dropbox and iCloud preferable to 1Password sync?
- wepple 5y agoI’m curious about this too. 1Password used to sync to a file that could be backed up to iCloud/Dropbox/drive and I wished they’d kept it that way, but it at least partially suggests they may have stuck with full client-side encryption (I have not verified)
- thebean11 5y agoYeah they still claim to have full client side encryption for the cloud service. Maybe it's the subscription pricing model that's the issue for people?
- torstenvl 5y agoBecause they work at a standard level of abstraction (the file system) and can be replaced if necessary. I can replace Dropbox with Box or Syncthing or OwnCloud or rsync or sftp coupled with crontab or an FSEventsD monitor or whatever I want, at any time I want. 1Password's proprietary sync isn't open source and isn't open standards. It is designed to lock me into reliance on a company that has inarguably demonstrated that it hates its users.
- firepacket 5y agoMy password manager works just like this! It just monitors shared folders and keeps everything in a compressed/32k encoded XML file that you can open with a text editor. It's 1 file per vault, but multiple people can use the same vault and all are update simultaneously.
- abfan1127 5y agoI use LastPass. I love that it has a mobile app for me to copy/paste on my phone and my wife's phone. It has a really good browser extension. I do pay the small fee for multiple devices.
- computershit 5y agoA few HN posts from the last week regarding LastPass: Ask HN: How did my LastPass master password get leaked?: https://news.ycombinator.com/item?id=29716715 https://news.ycombinator.com/item?id=29716715 LastPass users warned their master passwords are compromised: https://news.ycombinator.com/item?id=29716715 https://news.ycombinator.com/item?id=29716715
- basseq 5y agoNote that master passwords were not compromised, the the warnings were triggered in error[1]. That's not to say that other concerns around security aren't valid. [1] https://www.theverge.com/2021/12/28/22857485/lastpass-compromised-breach-scare https://www.theverge.com/2021/12/28/22857485/lastpass-compro...
- computershit 5y agoThe warnings might have been triggered in error, but the evidence is certainly there for masters to have been compromised. Until recently their publicly available support forum running phpBB was using the master password for customer logins.[1] [1] https://news.ycombinator.com/item?id=29706579 https://news.ycombinator.com/item?id=29706579
- basseq 5y agoI'm trying to differentiate between "there has been evidence of a breach" and "there are less-desirable security practices". As I understand it, the phpBB / master password practices—which are indeed, not good, but also not fully understood exactly how they did it—are also not evidence that the masters have been compromised. Again, that it could be an attack vector is interesting and relevant, but different from "has been breached" per OP.
- gmoore 5y agoBitwarden - without question - pay the $10 a year. It's only 10 bucks and totalliy worth it...
- firepacket 5y agoI wrote my own with ridiculous Argon2 requirements (Takes 18 secs to open) combined with PKDF hybrid hashing system. (not chained) and strong AES256 CBC implementation with proper random IVs for each field and correct padding. You can encrypt any kind of data and files, it's encoded as 32k UTF-16 + sig XML losing only 1.3% over binary, but I like text files. Of course, some files come out smaller due to the Gzip compression. It is Dropbox friendly meaning any change or addition in another person using the same vault in the same directory is automatically updated in all open vaults. This was originally for collaboration. You can have your own private vault too with a unique password, as many as you like. They just end up as XML files. It runs fast as uses databinding, can generate strong passwords, and makes copying/pasting easy. I am having trouble encrypting files over 1GB though. I take great lengths to protect the key. If the file is open too long, it minimizes and locks, when you open it, it decrypts everything again. As soon as decryption is done, the key is stashed away using ProtectMemory function in the framework. I have done memory dumps to ensure the key is not visible when the app is idle. Files works differently, Their meta data is encrypted but you are able to checksum then and preview them in memory without the key ever being exposed and the content never touches the disk and is zeroed afterward. You can currently play sound, view pictures, execute files (in memory!) and soon video. I plan on browser integration by a cross-browser userscript and loopback routing (127.0.0.1) that recognizes when the cursor is in a field specified in the login's metadata. But I am am running into trouble because sites like to randomize the name of the login fields, so I a have to use some reliable heuristic approach. Does anyone have any ideas on how to deal with that? If I can figure that out, and get video previews working I will open source it. EDIT: Here's a preview of the app: https://imgur.com/a/rZGPCPZ https://imgur.com/a/rZGPCPZ
- hprotagonist 5y agokeepass tics all those boxes for you.
- drcongo 5y agoI hate what 1Password has become, and how user-hostile Agile Bits are. BUT after the last bait and switch they pulled I tested _every single password manager on the market_, and the bad news is that the others are all worse. The only two I found that I liked, but sadly lacked at least one feature that we need, were Secrets [0] and Elpass [1]. I think both might fail your requirements list too. I've begrudgingly had to stick with 1Password, but after the way they've treated the customers who have been giving them money for over a decade I'll be off the second someone makes a password manager that meets our requirements. [0]https://outercorner.com/secrets-mac/ https://outercorner.com/secrets-mac/ [1] https://elpass.app https://elpass.app
- santoshalper 5y agoI've been a happy 1PW user on Windows 10 for a few years, but admit I haven't paid a lot of attention. I haven't noticed any big changes. What are you guys referring to?
- drcongo 5y agoThey've made a laundry list of user-hostile changes in the last few years, enough to turn me from a very vocal advocate recommending 1P to everyone I know, into someone with a visceral dislike of the company and everything they do. They've repeatedly removed features that people relied on (self-managed sync), done all sorts of dark patterns to trick people into subscribing and the app just keeps getting worse. My biggest bugbear on that last point is that it's no longer possible to tab to the generate password button - something that was possible in every version up until the latest one. And to top it all off, the next version is going to be yet another stinking Electron turd eating up your system resources.
- torstenvl 5y agoThey made generating passwords more difficult. You can no longer tell it how many, e.g., special symbols to use, only to use them or not. This means regenerating new passwords over and over until one fits site requirements, and/or manual tweaking that might unintentionally reduce entropy. They stopped supporting the mobile extension. I can no longer invoke 1Password from Safari on iOS. If I'm lucky, then Safari's own AutoFill will recognize what I'm trying to do, and connect to 1Password that way. Otherwise I have to manually copy login credentials from the 1Password app to Safari. Either way, that is not an acceptable solution. They make it increasingly difficult to find and use the non-subscription version of their software. The new desktop software is a giant Electron mess. And the developers respond to any and all criticism with the polite corporate-speak version of a giant middle finger.
- wepple 5y agoCan you elaborate on > they seem insistent on making the experience as terrible as possible lately
- dxf 5y agoI was a happy 1Password user and warily switched to their subscription model. But It still does everything I want and now it even does more -- e.g. I can have shared vaults with my partner and other family members, which is more convenient than duplicating entries between machines or going to each others' computers to look something up.
- angst_ridden 5y agoBitWarden is good. Codebook is the commercial version of the earlier Open Source "STRIP" and underrated.
- gspr 5y agoPass! https://www.passwordstore.org/ https://www.passwordstore.org/ With git or whatever you want for sync, and whatever GPG-compatible security device you want for encryption. I swear, pass is the piece of software that has improved my digital life the most per line of code in the software.
- mmettler 5y ago1Password is consistently fantastic. I hear you about problems with a server/subscription-based model, but a) it's the least of all evils, and b) I've come to enjoy financially supporting them (i.e. my subscription means they can keep making great software, which is definitely valuable to me).
- Sanzig 5y agoI use pass. It's a Unix-style password manager created by zx2c4 of Wireguard fame. https://www.passwordstore.org/ https://www.passwordstore.org/ Pass uses GPG under the hood for encrypting the password store. I use an OpenPGP smartcard (a Yubikey in my case) to decrypt the password files. I synchronize the store across devices using Git. There are good autofill implementations for Firefox and for Android. When I need a password, the autofill prompts me to insert my Yubikey and enter in the unlock PIN, which I find more convenient than a master password. Crypto functions are offloaded to the Yubikey with a (theoretically) very difficult to extract private key, so unless somebody swipes that they can't get into my passwords. I mostly followed this guide for setting it up: https://dehnes.com/software/2020/04/03/password_management_yubikey_pgp_git.html https://dehnes.com/software/2020/04/03/password_management_y...
- sam_lowry_ 5y agoThere is Browserpass extension for Chromium as well.
- mariusor 5y agoPass is not very user friendly. Adding a new device to your tree is a painful experience. Losing your Yubikey or your main gpg key is a painful experience. That being said, there are variants to pass that make multi key trees easier to manage and that's what I'm using.
- sam_lowry_ 5y ago>Adding a new device to your tree Are you talking about `git clone`?
- mariusor 5y agoNo, I'm talking about having different GPG keys for different devices. I want my passwords on my phone, and on each of my computers. I would prefer to have separate keys for each of them.
- brycewray 5y agoIf you can handle what I call[0][1] "the KeePass way": on desktop, KeePassXC (Windows/macOS/Linux) on desktop; on mobile, KeePass2Android or Keepassium (iOS). [0]: https://www.brycewray.com/posts/2021/06/two-paths-password-management/ https://www.brycewray.com/posts/2021/06/two-paths-password-m... [1]: https://www.brycewray.com/posts/2021/08/1password-hits-fan/ https://www.brycewray.com/posts/2021/08/1password-hits-fan/
- c7DJTLrn 5y agoI use KeePassXC. I don't feel that web password managers are safe given the monstrous attack surface of browsers.
- peruvian 5y agoI don't get he drama about 1Password. What's wrong with it? I'm a little wary of 8 (Electron) but eh, I doubt it'll be bad. It costs me like $4-5/mo which is an mount I don't even bother keeping track of or budgeting.
- ryandvm 5y agoAm I the only one that thinks that password managers are a terrible idea? Lets take all of a user's credentials (mixing the critical and the trivial) and put them into a single database and then use Javascript-based browser extensions to control access to the DB. What could go wrong? The LastPass communications brouhaha from last week was just a whiff of the total shit show we're going to see when the client code from one of these password managers is modified with trojan code and we realize that some group has been slurping up credentials by the billions over the course of a few months. Seems like the charitable take is that password managers are maybe the best approach to a horrible idea, and the real solution is that we ought to be racing to abolish passwords altogether as soon as possible.
- jrockway 5y agoYes, you're pretty much the only one that thinks password managers are a terrible idea. The alternative is using the same password on every site, which is proven not to work. Even ignoring breaches, you're sending the administrators of your favorite forum or whatever your email password. That rarely ends well. If you generate random 16 character passwords and commit them to memory for every site (likely thousands you'll encounter over your lifetime), then fine, you don't need a password manager. For most other humans, it's a net win. Having said that, passwords are a fundamentally flawed idea. Everyone should be using WebAuthn. Password managers turn "something you know" into "something you have". Webauthn skips the guessable backdoor and just goes right to "something you have". Much safer, and much easier to use!
- politelemon 5y agoI think you're mixing a few aspects of a password management solution. Not all password managers are online (LastPass). Not all password managers require an extension. If you use an offline password manager you don't need to use a browser extension. If your password manager requires a browser extension, it's increasing the risk profile. Password managers are not a terrible idea. Certain implementations of password managers are a terrible idea.
- firepacket 5y agoThis is a huge problem. How do we reliably be sure we are entering credentials in the right place? I am thinking we need to look at a bunch of different factors, but what?
- politelemon 5y agoI can recommend not using an online password manager. When it comes to a sensitive set of information, the first step in a terrible experience is giving another entity control of that set of information. Offline password managers have a reduced risk due to the not-always-on nature and your own control over its syncing. So your choice of KeePass is pretty good. There is KeePass2 which is by the original author of the KDBX format. There is KeePassXC which is an alternative. KeePass2 has a lot of community plugins if that's what you're after.
- vocatan 5y agoCan anybody reveal WHERE to buy the standalone / non-subscription version of 1Password? It seems like it's vanished off their site (it used to be that if you hunted for long enough, you could find it)
- firepacket 5y agoI believe the most popular password managers have been cracked already, that is why I did a LOT of research and built my own. It was not easy, but it was fun, and if anyone wants to decrypt my files they have a lot of difficult hurdles to jump through. Of course, keylogging is easier, but then they still have to run my software or at least seriously read the source code.
- f1refly 5y agoI don't believe GPG has been cracked. Also, running your own crypto is in 99.9% of cases a terrible idea.
- firepacket 5y agoWhy do you think they say that? Because they really want to help you? You believe that crap if you want, I'll do my own research. SOMEONE has to write it, otherwise where does it come from?
- Bowes-Lyon 5y agoEnpass. https://www.enpass.io/ https://www.enpass.io/
- Leftium 5y agoI second Enpass. OP says "I've tried BitWarden and Enpass, but their integration is worse and they suffer from some of the same problems as 1Password (subscription/server-based, not really in control of own data, etc.)" but I don't think this is accurate. Enpass offers a lifetime license and is local-first with syncing via your choice of cloud service. (Enpass also supports wifi-only sync, too. No cloud required.)
- torstenvl 5y agoYou're right, I'm not sure why I thought that. I think I'll give enpass a second look.
- torstenvl 5y agoI don't know who downvoted you, but — terse as it is — I think this is the best recommendation in the thread. From what I can tell, the primary players in the local-first vault space are legacy 1Password, the pass ecosystem, KeePass[.*], and Enpass. 1Password is aggressively abandoning this market to pursue rent-seeking, and using shady practices to nudge their former customers that way. KeePass and pass are similar: more ecosystems than products, their password file implementations are documented and there's a broad ecosystem. I didn't find any of the options compelling though. -- For pass in particular, I'm not an Alfred user, so the macOS integrations don't make a lot of sense to me, though I might play with it at some point later. The Firefox extension seems pretty minimal but maybe worthwhile. All in all the ecosystem seems promising but immature. -- For KeePass, Strongbox had the smoothest consistency on macOS/iOS, but doesn't support KeePassHTTP, so can't be used with any of the desktop browser extensions, and on iOS KeePassium is a lot faster / doesn't fight me. I ended up trying MacPass (→ KeePassHTTP Connector) and KeePassium. This worked okay, but MacPass was finicky about running in the background, and always forgot where my keyfile was every time it started up. I would revisit KeePass if there were a good full-blown desktop client on every major OS (even if it were Electron) and browser integrations that weren't reliant on using http for IPC. Enpass is a proprietary solution but built on open standards. They haven't published a full spec of their password database, but they published a lot of information about their use of SQLCipher and what encryption, how they do key derivation, and initialization vectors, so that the format was pretty quickly worked out from there. I would prefer if they made it an open standard like KeePass, but they are helpful rather than hostile to community reverse engineering, so that'll work. The app works great, better UI than 1Password (more organized if slightly less flashy), and the browser extension handles password changes better than anything I've ever seen (though it still confuses some things). I spent a couple hours yesterday reviewing all my weak/old/compromised passwords and changing them. Enpass made this drastically easier than any other tool I've used. The OTP support also seemed to work better than with 1Password, and I've been able to cut back on the number of annoying text message confirmations I get. I pretty quickly sprang for the paid version of Enpass and I think this is where I'm gonna stay for a while — and what I'm going to recommend to others.
- darksofa 5y agoPassword Safe https://www.pwsafe.org/ https://www.pwsafe.org/ Designed by Bruce Schneier https://www.schneier.com/academic/passsafe/ https://www.schneier.com/academic/passsafe/ Mobile clients available and you can sync via Dropbox or iCloud.
- w4rh4wk5 5y agoAs stupid as it might sound, but my recommendation is a simple paper notebook. Certainly, it is less convenient; but in terms of security, one pretty much needs physical access to obtain it. Otherwise, I think KeePass will do you just fine. I'd advice against any form of browser integration. Stick with the auto-type type feature instead. Connecting a full, decrypted password database directly to a _browser_ sounds scary. Consider installing an add-on in your browser that changes the window title to include the page's URL. This way KeePass' window matching works a lot better.
- hmrtn 5y agoMYKI has been good to me, and I recommend it.
- aborsy 5y agoStay away from online password managers, especially closed source ones.
- tmikaeld 5y agoConsidering how important security is in a password manager, I don't trust any other than Bitwarden. It's been audited [0] by external companies multiple times and both the client and the server are fully open source [1]. I know others may say that the encryption is too weak[2], but that's true for all other password managers too [3], since Argon2id is not mature enough to run as a WASM module in the browser yet (especially not on mobile). [0] https://bitwarden.com/help/article/is-bitwarden-audited/ https://bitwarden.com/help/article/is-bitwarden-audited/ [1] https://github.com/bitwarden https://github.com/bitwarden [2] https://github.com/bitwarden/jslib/issues/52 https://github.com/bitwarden/jslib/issues/52 [3] https://github.com/bitwarden/jslib/issues/52#issuecomment-783594951 https://github.com/bitwarden/jslib/issues/52#issuecomment-78...
- jareklupinski 5y agoI was creating my own standalone hardware password manager: https://github.com/jareklupinski/zamek https://github.com/jareklupinski/zamek Looking for inspiration and excited testers :)
- technick 5y agoI've used lastpass since 2016, it works for everything I need. Before that I struggled with Keepass and keeping it updated across all my various platforms, which I can only recommend if you use it from only a single location.
- chenxiaolong 5y agoI use KeePass databases synced with SyncThing. One database for passwords and private keys, another for TOTP 2FA (which I only ever update/unlock on my phone). As for the software I use to access the database: * On Windows/Linux, I use KeePassXC with the corresponding browser extension. I also use the built-in SSH agent integration so I don't need to store my private keys in ~/.ssh nor manually type in their encryption passphrase. On Windows, auto-type works great for the most part, except in ancient applications that only support scan-code-based input and not Unicode-based input (shakes fist at IPMI consoles of brand new servers that _still_ use ancient noVNC versions without support for Unicode input). I build KeePassXC from source to include a not-yet-merged patch for scan-code support. * On Android, I use KeePassDX (open source). It integrates with Android's autofill API, but also has a keyboard for typing the username/password/TOTP code into apps that don't support autofill. * Back when I still used iOS, I used Strongbox (open source, but does not accept contributions). It integrates with iOS' autofill API. For syncing, I use SyncThingTray on Windows/Linux and SyncThingFork on Android. On iOS, I used to have Strongbox connect via sftp to my server running SyncThing because I could not find a decent SyncThing client. (I'm not even sure it's possible to implement on iOS without resorting to abusing location services for background execution, like iSH or most SSH clients.)
- torstenvl 5y agoI'm leaning toward Strongbox on iOS as well. I'm struggling a little with finding a good Mac experience. Strongbox doesn't support KeePassHTTP or any other browser integration beyond macOS/Safari AutoFill, and KeePassXC seems a little rough around the edges. I might try MacPass.
- fitblipper 5y agoI use one of these password managers that folks have been sharing here but I'm curious why folks don't like using the ones built into firefox/chrome. Chrome at least allows you to provide a separate encryption password so they don't have any visibility into what the passwords are.
- lockyc 5y agoFor me it’s because I need my passwords on my phone as well as my computer. And for apps not just websites. Web browser password managers don’t integrate with iOS and isn’t very usable if you need to retrieve a password that isn’t linked to the website you are visiting
- madmonk 5y agoI've been working on a concept where, instead of storing passwords in a manager I use a generator that creates pseudorandom passwords based on a few, easy to remember things. It's essentially a hashing algo created in javascript. You provide a site name, a password length and a pin code and it will consistently generate the same pseudorandom string. Nothing is stored and the generator can be publicly hosted. https://github.com/madmonk13/keymaster https://github.com/madmonk13/keymaster This is the first time I've publicly shared it and I welcome your feedback.
- torstenvl 5y agoBefore I started using 1Password I used to do the same thing.
- knowingpark 5y agoI've been using https://chriszarate.github.io/supergenpass/mobile/ https://chriszarate.github.io/supergenpass/mobile/ a similar idea. I'm going to switch to yours though, its designed better. Thanks
- madmonk 5y agoThank you for the feedback. If there's any issues you notice going forward, feel free to reach out.
- wepple 5y agoThis is great, I used to do a similar thing but all in my head (so obviously not as complex permutations) In practical use, how do you typically remember whether or not a site allows special characters or has a length requirement? Also do you ever have trouble remembering what you named a particular thing? Might be easy for something with an FQDN, but for an encrypted vault or ssh key may be harder Edit: on second thought, the use of only a numeric pin (with suggested length of 4) seems not good from a security perspective. For an offline attack against, say, a true crypt partition I could offline attack a fairly large pin space with a number of different names fairly trivially. Even in an online attack, if I assume you’re sticking with a 4-digit pin and using the site name “Facebook” then I have a 1/10000 chance, which drops to 1/2500 if Facebook lets me have 4 attempts. The PIN should be a pass phrase IMO Edit2: please take these criticisms as genuine feedback, as I think this is an excellent idea and I’d like to use it myself. I’m curious why no true cryptographic hash algorithms were used? I only skimmed the code, but I’m concerned that under a model where 1 or especially 2+ passwords are leaked (inevitable in this day), there would be non-zero leakage of intermediate stages if not the original pin. The other challenge I see is the integrity of the JS - would folks self-host this? Otherwise you could possibly use Subresource integrity to load the JS from an untrusted source, and the user would manually verify the SRI key or something
- blikdak 5y agoMacOS with iCloud has shared Keychain 1st party. People should stop thinking this integration is an app, it's a function of your entire online environment including how your OS talks to it. FBG
- pseudalopex 5y agoiCloud Keychain just works with macOS Safari, macOS Chrome, Windows Chrome, and iOS.