4 ms·
I'll add a self-hosted option that no one ever mentions – PasswordWallet: https://www.passwordwallet.com/ https://www.passwordwallet.com/ I use iCloud Keycha
by js2 3y ago
I'll add a self-hosted option that no one ever mentions – PasswordWallet:
https://www.passwordwallet.com/ https://www.passwordwallet.com/
I use iCloud Keychain for most of my passwords these days, but my critical passwords I continue to keep in PW as well.
PW also has an occasionally very useful feature that I have not seen in any other password manager: auto type. Sometimes I just need to point my cursor somewhere and have the password typed for me (e.g. into a login screen on a VNC/RDP connection).
PW uses Blowfish with 448-bit keys.
There is also "pass" (from the author of Wireguard) which is essentially a shell script wrapper around gpg and git:
https://www.passwordstore.org/ https://www.passwordstore.org/
- sgu999 3y agoI've been using "pass" for years and love it. There is also a very nice iOS app that works well and is open source. I synchronise my devices and backup directly without a central repo. Its only flaw is gpg's poor UX...
- alwaysbeconsing 3y agoThere is a fork of pass called "passage" that uses Age for encryption instead: https://github.com/FiloSottile/passage https://github.com/FiloSottile/passage Unfortunately I don't believe any iOS/Android apps exist to work with it so far.
- egberts1 3y agoYeah. Auto-typing of password-related field is a relatively new security feature that got its start in Apple iOS. While password auto-type is also found in Android, its security model is not quite a firm Bell-LaPadula yet like those implemented in Apple iOS/MacOS. Exposing API to monitoring keystrokes remains problematic for any OSes.
- zuprau 3y ago> relatively new security feature Maybe I'm misunderstanding the feature, but I've been auto-filling login forms since I was using IE7 with RoboForm. Other than using Touch ID to trigger the auto-fill instead of 1 click, I don't see any improvements in iOS/macOS Safari.
- egberts1 3y agoYou leave all your password on the iCloud, accessible by AppleID but that AppleID password is so powerful and covers many more sensitive things (AppleWallet, ApplePay, ...) Whereas, using a separate PIN/passcode at application-level provides a separate (master) password which would be used for all your passwords (in case your AppleID password gets compromised). I do not use touchID nor FaceID because it violates the Principle of 3 Factors of Authentication: AppleID merges two of three factors: 1. "what you know (memory rote)" with 2. "what you have (biometric)". https://www.cs.cornell.edu/courses/cs513/2005fa/NNLauthPeople.html https://www.cs.cornell.edu/courses/cs513/2005fa/NNLauthPeopl...
- zuprau 3y ago> using a separate PIN/passcode at application-level provides a separate (master) password which would be used for all your passwords (in case your AppleID password gets compromised). That already happens exactly as you mentioned. You need a secondary encryption password for encrypted iCloud data as well. Having access to your Apple account isn't enough. https://support.apple.com/en-ph/HT202303#:~:text=Apple%20will%20not%20have%20the%20encryption%20keys%20to%20help%20you%20recover%20it%20%E2%80%94%20you%E2%80%99ll%20need%20to%20use%20your%20device%20passcode%20or%20password%2C%20a%C2%A0recovery%20contact%2C%20or%20a%20personal%C2%A0recovery%20key https://support.apple.com/en-ph/HT202303#:~:text=Apple%20wil...
- egberts1 3y agoTHIS! Apple finally provides a modicum variant of Zero Knowledge password. But that is only available in next iOS version 16.2. [1] But, but ... BUT the Apple macOS/iOS issue of Three Form of Authentication being still being reduced into Two-Form with their merge (OR-logic) of what you have (FaceID/TouchID) and what you know (PIN/passcode) ... remains. That reduction of authentication is still the greatest weakest link to individual security (whether ADP is used after v16.2 or not). https://support.apple.com/en-ph/HT202303#:~:text=Apple%20will%20not%20have%20the%20encryption%20keys%20to%20help%20you%20recover%20it%20%E2%80%94%20you%E2%80%99ll%20need%20to%20use%20your%20device%20passcode%20or%20password%2C%20a%C2%A0recovery%20contact%2C%20or%20a%20personal%C2%A0recovery%20key https://support.apple.com/en-ph/HT202303#:~:text=Apple%20wil...
- js2 3y agoThe auto-typing feature is not the same as autofill. Rather, it literally emulates typing from the keyboard and is useful in contexts where autofill is not supported. I only ever use it on desktop, and it's a feature that PasswordWallet has had for more than a decade.
- egberts1 3y agoOoooooo, if the passwordstore has a bash autocomplete in which to navigate selections of its config file subdirectories, then the solution becomes incredibly robust.
- rcme 3y agoWhy would you store critical passwords in two places?
- detaro 3y agoBecause you should have backups for critical things.
- Kwpolska 3y agopass is fine if you like gpg (why?) and the only machines where you need those passwords are Linux/macOS/*nix computers. There are ways to access it on Windows, Android, and iOS, but they are unbearably painful.
- egberts1 3y agoAgreed. Your selection of password manager is going to be invariably dictated by how many different platforms you need to sync up your password manager with. And those maintainers of their own password manager are in an arms race.
- philihp 3y agoPasswordstore (pass) databases are just a git repo which makes great audit trails, but also gives it syncing for free rather than reinventing the wheel. It uses PGP rather than rolling its own encryption, which also makes it compatible with hardware tokens, for free. It's not some complicated project... it's just a thousand or so line shell script.
- Kwpolska 3y agoIt's fine if all platforms where you want your passwords can run bash scripts, git and gpg. Linux and macOS can do it fine. Windows might, although it gets flaky. Android and iOS can’t, at least not in any human-friendly way.
- aborsy 3y agoHonestly, this is the most secure and sufficiently functional password manager!