4 ms·
1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted,
by MrDrMcCoy 3y ago
1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account, leaving you high and dry. Self-hosted, multi-device password managers are the only real solution. Thankfully, Vaultwarden and KeePassXC fill this role perfectly.
Now if we could just get the other providers that require insecure email/SMS 2FA to follow suit, that would be great...
- gcr 3y agoFor others reading this thread, looks like KeePassXC announced passkey support last October! Does it work well?
- ceinewydd 3y agoI’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a year that I spend on hosted technologies.
- sroussey 3y agoAgreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
- littlestymaar 3y agoThat's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.
- pydry 3y agoI've always wanted a decentralized solution that lets me trust my friends instead.
- eru 2y agoYou can use a threshold secret sharing scheme to distribute your keys amongst your friends (and amongst companies). This way you don't need to trust any single one of your friends to be 100% honest nor 100% available.
- littlestymaar 2y agoI know how to do that in theory (I've worked with Shamir secret sharing on elliptic curves before) but you don't have the option to do that in LUKS, so in practice you can't use it.
- pydry 2y agoThats kind of my point. you could rsync files before you could Dropbox too, but there was still a need for a Dropbox.
- prmoustache 3y agoMy rule of thumb is if for some reason you need to use crypto keys that can't be easily replaced, you need to have a safe at the bank with the keys stored in 2 differente media formats, that are recreated every year. I don't trust many people to do that. I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. And having a note somewhere telling me I have a safe in bank X is the only solution I have found.
- gertop 3y ago> I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. Ah! I have the exact same recurring worry, it's very unpleasant. I'd really prefer to keep home media unencrypted, but the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind.
- zarzavat 3y agoDo you still have the hard disk? Did you attempt to recover it ?
- dijit 3y agoSounds like you had control of your data.
- remram 3y agoDo you have machines with no backups? Why?
- psd1 3y agoFeels. I had half a bitcoin on a disk that I left alone. Forgot about it. Reinstalled the OS. Three times. I was a sysadmin for years, but the cobblers' children go barefoot.
- recursive 3y agoI'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.
- jackson1442 3y agoYou can export them- just did so by touching the context menu on the mobile app then “copy item JSON.” This includes the private key for the passkey. Here’s one I just exported: https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee920424de60 https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee9... Whether or not you can import them into something else though…
- scient 3y agoThe whole original point of what underpins FIDO2 was device locked, unphishable credentials. Wanting to export and move passkeys between devices is kind of counter to that. And I would argue vendors completing the attestation process are much more trustworthy than storing your own keys god knows where.
- recursive 3y agoOh, ok. If that's the same thing as passkeys, then I finally figured out that I'm not interested. To me it looks like another vector for platform lock-in, or getting mysteriously locked out of my accounts with no recourse. I'll wait for FIDO3.
- Groxx 3y agoYep. I absolutely refuse to support anything that wants to dictate what I do with my identity. Such things do have purposes, in high-stakes environments. They prevent accidents. The vast majority of uses on the public web are not even remotely in that realm. It'd be better off being a separate spec that only a handful of internal-only systems use, ideally requiring MDM to set up conveniently (to strongly discourage normal and even high-stakes-normal website usage). My banking website has absolutely no business knowing and being able to approve or deny what brand my authenticator is.
- patrakov 3y agoI also think that the "self-hosted" requirement is an over-reach. It would be sufficient to require some standardized commodity that can, in principle, be self-hosted, but is available in an equivalent form from multiple unaffiliated third parties. E.g., a WebDAV folder.
- MrDrMcCoy 3y agoI disagree. While Vaultwarden may be a bit much to ask of the unwashed masses, the storage model of KeePass* is very easy to understand and works with any existing file synchronisation solution, which almost everyone already has at this point. The effort is nearly as low as with a cloud hosted solution, and the value/safety proposition is quite high.
- signal11 3y agoAnd KeePass XC supports passkeys too[1]. Although I’ve not had a chance to try that out yet. [1] https://keepassxc.org/docs/KeePassXC_UserGuide#_passkeys https://keepassxc.org/docs/KeePassXC_UserGuide#_passkeys
- freeAgent 3y agoYour vault is stored locally on each device, so if they decide to shut down you just export locally, import somewhere else and move on. It’s not as big of a deal as you seem to be implying.
- Hnrobert42 3y agoNo they can’t. You have a local cache. Also, you can export and backup if you are really worried.
- arthur_sav 3y ago> 1Password is a closed-source, cloud-hosted service. At any time, for any reason, they can close and delete your account They used to offer their apps offline and you could "host" it anywhere. Venture Capital ruined them.
- generalpf 3y agoHaving the passwords in the cloud is useful though. Before, if you wanted to use your vault across multiple machines, you had to store your vault in someone else’s cloud. This simplifies the process.
- alwaysbeconsing 3y agoIncorrect. 1P orginally offer direct LAN syncing among machines.
- skinkestek 3y agoI wonder if BitWarden doesn't support passkeys too. BitWarden is open source to a large degree and even provides an (open source) server for self-hosting.
- deleted 3y ago[deleted]
- briffle 3y agoBitwarden supports passkeys, is open sourced, and can be self hosted.
- MrDrMcCoy 2y agoVaultwarden is a much simpler self-hosted Bitwarden.