6 ms·

Bitwarden, Keeper ($ but trusted at megacorps), and good ol' PasswordSafe are the safest solutions. I run BW with Yubikey 2FA and a local hosted sync server.

Bitwarden, Keeper ($ but trusted at megacorps), and good ol' PasswordSafe are the safest solutions. I run BW with Yubikey 2FA and a local hosted sync server. KeePassX/C perhaps. Vault for secrets management. Never touched LastPass, 1Password or any of these other mickey-mouse commercial apps that invariably claim "military-grade encryption" or "unhackable" when their fundamental constructions are crap.

xenospn 4y ago
Do you have any evidence to back your claims about 1password?
onphonenow 4y ago
I do passwordsafe on google drive. I feel google does a good job w security / main risk a computer I’m using getting compromised
- jcpham2 4y ago
  Except or unless your google account gets locked. Any number of reasons and posts HN horror stories exist about other users getting locked out of their lives because of a user account or lack of access thereof
  - onphonenow 4y ago
    That’s a risk. I pay for my account to try and mitigate this risk so I’m the actual customer, not advertisers. Google workspaces has a support assisted recovery option. I host dns separately from google as their admin level recovery may require some dns signaling. Other steps include a yubikey etc . I’ve actually had the experience of losing all my Authenticator codes on an iPhone upgrade which at the time was how I did 2fa - so had to go through recovery for many providers. My top takeaway - if I was paying for service it was possible if sometimes a bit time consuming. If I wasn’t it was hit or miss. Other tip? Google Authenticator may not backup to iCloud!! I had 20 codes in it including some really hard to fix ones.
bee_rider 4y ago
I see a lot of people mentioning bitwarden around here; is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). There’s very little room for failure and learning in the online password safe field, so I generally assume these companies are in one of two states: * has unknown bugs waiting to be revealed * out of business
- eternityforest 4y ago
  BitWarden is open source with some freemium features. It's what I use at the moment. I believe it has third party network audits. As far as I know it's fully E2E encrypted, and has never had a data breach. The only thing I don't like is the lack of SMS based 2FA, although I appreciate their commitment to maximum security by not allowing it .
- hoistbypetard 4y ago
  > is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). You can see their server and client code here: https://github.com/bitwarden https://github.com/bitwarden I choose to use their clients unmodified, along with an instance of the server formerly known as "bitwarden_rs" running in my basement as the sync backend. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden I still pay them annually for their "freemium" features even though I prefer not to let them host my data.
  - fruit2020 4y ago
    Do you expose your server to the internet or is it ok to sync devices only when you’re at home? Is every device a replica, if you lose your server can you redeploy it from the data on your device?
    - diarrhea 4y ago
      Not the parent, but I have been hosting a Vaultwarden instance on the public internet for about two years now. After learning about certificate transparency logs, I moved the app from a raw subdomain behind a secret URL path. Think “hello.domain.com/correcthorsebatterystaple”. Is it security by obscurity? You bet. Does it work? Yes. I regularly evaluate the JSON logs emitted by Caddy in a pandas script and so far, no foreign party has even hit that endpoint. It’s like an extra username of sorts you’d have to know. I’ve always been unsure of where to draw the line when it comes to obscurity. People online are viciously against it, but isn’t a password also just obscurity, if you squint your eyes real good? It’s all secrets users would need to know. All that being said, I’m thinking of hosting it at-home-only as well. Would be a huge win in security and barely any loss in convenience.
int_19h 4y ago
When it comes to password management, trust should not even be a thing. https://www.lesspass.com/ https://www.lesspass.com/
- toleda 4y ago
  I may be wrong, the idea is interesting but looks more like a password generator and a terrible password manager to me. You still need to store somewhere informations like url, username, counter, etc. right ? Can you change the master password without changing all your accounts password ? If one happens to find your master password, he's basically able to get/generate all your passwords just like a normal pw manager with no 2FA, correct ?
  - ziml77 4y ago
    You have it right. This master password derived passwords idea is nothing new. Few people actually use it because it's not actually a great idea for the reasons you listed.
oellegaard 4y ago
Curious to hear what 1Password is doing wrong?
- throwaway29812 4y ago
  User hostile pricing schemes and removing the ability to sync locally, only on their cloud.

xenospn 4y ago

Do you have any evidence to back your claims about 1password?

onphonenow 4y ago

I do passwordsafe on google drive. I feel google does a good job w security / main risk a computer I’m using getting compromised

jcpham2 4y ago
Except or unless your google account gets locked. Any number of reasons and posts HN horror stories exist about other users getting locked out of their lives because of a user account or lack of access thereof
- onphonenow 4y ago
  That’s a risk. I pay for my account to try and mitigate this risk so I’m the actual customer, not advertisers. Google workspaces has a support assisted recovery option. I host dns separately from google as their admin level recovery may require some dns signaling. Other steps include a yubikey etc . I’ve actually had the experience of losing all my Authenticator codes on an iPhone upgrade which at the time was how I did 2fa - so had to go through recovery for many providers. My top takeaway - if I was paying for service it was possible if sometimes a bit time consuming. If I wasn’t it was hit or miss. Other tip? Google Authenticator may not backup to iCloud!! I had 20 codes in it including some really hard to fix ones.

bee_rider 4y ago

I see a lot of people mentioning bitwarden around here; is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). There’s very little room for failure and learning in the online password safe field, so I generally assume these companies are in one of two states: * has unknown bugs waiting to be revealed * out of business

eternityforest 4y ago
BitWarden is open source with some freemium features. It's what I use at the moment. I believe it has third party network audits. As far as I know it's fully E2E encrypted, and has never had a data breach. The only thing I don't like is the lack of SMS based 2FA, although I appreciate their commitment to maximum security by not allowing it .
hoistbypetard 4y ago
> is their actually a technical reason to believe they are better than Lastpass or any of their competition (have they like open sourced all their stuff?). You can see their server and client code here: https://github.com/bitwarden https://github.com/bitwarden I choose to use their clients unmodified, along with an instance of the server formerly known as "bitwarden_rs" running in my basement as the sync backend. https://github.com/dani-garcia/vaultwarden https://github.com/dani-garcia/vaultwarden I still pay them annually for their "freemium" features even though I prefer not to let them host my data.
- fruit2020 4y ago
  Do you expose your server to the internet or is it ok to sync devices only when you’re at home? Is every device a replica, if you lose your server can you redeploy it from the data on your device?
  - diarrhea 4y ago
    Not the parent, but I have been hosting a Vaultwarden instance on the public internet for about two years now. After learning about certificate transparency logs, I moved the app from a raw subdomain behind a secret URL path. Think “hello.domain.com/correcthorsebatterystaple”. Is it security by obscurity? You bet. Does it work? Yes. I regularly evaluate the JSON logs emitted by Caddy in a pandas script and so far, no foreign party has even hit that endpoint. It’s like an extra username of sorts you’d have to know. I’ve always been unsure of where to draw the line when it comes to obscurity. People online are viciously against it, but isn’t a password also just obscurity, if you squint your eyes real good? It’s all secrets users would need to know. All that being said, I’m thinking of hosting it at-home-only as well. Would be a huge win in security and barely any loss in convenience.

int_19h 4y ago

When it comes to password management, trust should not even be a thing. https://www.lesspass.com/ https://www.lesspass.com/

toleda 4y ago
I may be wrong, the idea is interesting but looks more like a password generator and a terrible password manager to me. You still need to store somewhere informations like url, username, counter, etc. right ? Can you change the master password without changing all your accounts password ? If one happens to find your master password, he's basically able to get/generate all your passwords just like a normal pw manager with no 2FA, correct ?
- ziml77 4y ago
  You have it right. This master password derived passwords idea is nothing new. Few people actually use it because it's not actually a great idea for the reasons you listed.

oellegaard 4y ago

Curious to hear what 1Password is doing wrong?

throwaway29812 4y ago
User hostile pricing schemes and removing the ability to sync locally, only on their cloud.