2 ms·

Today it might be, tomorrow they might be acquired by someone with all your data. Then in a year they may focus on monetization more than security. Get somethi

Today it might be, tomorrow they might be acquired by someone with all your data. Then in a year they may focus on monetization more than security. Get something that writes data in open format and does not interfere with how you store it. Eg. Keepass with some privacy focused file storage.

scrollaway 4y ago
Keepass is fantastic but it is unsuitable for many things, such as multi-user/teams. The browser integration is also very much not something I trust, unlike 1Password's. 1Password has a fantastic track record. Yes, tomorrow, their incentives might change. But the data is copied and available locally; if they start fucking with user data, we will see it coming. Security is a lot about trust and trade-offs. This includes trusting someone who has shown themselves to be trustworthy, even if they might not be trustworthy tomorrow.
- dzikimarian 4y ago
  Well - guess I have no trust, when it comes to uploading my passwords to someone's else server. I remember too many SaaS companies with awesome reputation, that over time became sketchy (including Last Pass). As for the teams - you shouldn't have shared accounts. Making introducing them convinient is bad idea. Where I work, we're audited for that and honestly it's very small issue if you give it a few minutes of thought.
  - scrollaway 4y ago
    Lastpass was always sketchy, as long as I have known them. I can back this up with proof, it’s not their first leak and I’ve personally talked about how you shouldn’t use them as early as 2012… Re teams, just because you shouldn’t have shared accounts doesn’t mean you can’t have shared secrets which end up in a password manager. Or more generally, the ability to have managed employee vaults. And regardless, shared accounts do happen, because some providers just suck. Making them as secure as possible is more important.

scrollaway 4y ago

Keepass is fantastic but it is unsuitable for many things, such as multi-user/teams. The browser integration is also very much not something I trust, unlike 1Password's. 1Password has a fantastic track record. Yes, tomorrow, their incentives might change. But the data is copied and available locally; if they start fucking with user data, we will see it coming. Security is a lot about trust and trade-offs. This includes trusting someone who has shown themselves to be trustworthy, even if they might not be trustworthy tomorrow.

dzikimarian 4y ago
Well - guess I have no trust, when it comes to uploading my passwords to someone's else server. I remember too many SaaS companies with awesome reputation, that over time became sketchy (including Last Pass). As for the teams - you shouldn't have shared accounts. Making introducing them convinient is bad idea. Where I work, we're audited for that and honestly it's very small issue if you give it a few minutes of thought.
- scrollaway 4y ago
  Lastpass was always sketchy, as long as I have known them. I can back this up with proof, it’s not their first leak and I’ve personally talked about how you shouldn’t use them as early as 2012… Re teams, just because you shouldn’t have shared accounts doesn’t mean you can’t have shared secrets which end up in a password manager. Or more generally, the ability to have managed employee vaults. And regardless, shared accounts do happen, because some providers just suck. Making them as secure as possible is more important.