4 ms·

What alternatives do you recommend?

by josu 2y ago

hannofcart 2y ago
KeepassXC. https://keepassxc.org/ https://keepassxc.org/ Recently switched over from a premium Bitwarden account to it. Import from Bitwarden was a breeze. Note that KeepassXC only writes to a local encrypted db file. Syncing that across devices is left to you. I used Syncthing for that.
- cyberax 2y ago
  No support for passkeys, either.
  - zeofig 2y ago
    It does support passkeys.
    - cyberax 2y ago
      iOS application doesn't: https://github.com/keepassium/KeePassium/issues/297 https://github.com/keepassium/KeePassium/issues/297 Neither does the Android app: https://github.com/PhilippC/keepass2android/issues/2099 https://github.com/PhilippC/keepass2android/issues/2099
      - zeofig 2y ago
        Well that SUCKS!
  - trinsic2 2y ago
    I wouldn't trust passkey myself [0] [0]: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/?ref=labnotes.org https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
    - cyberax 2y ago
      I'm using passkeys in BitWarden, and they so far work everywhere, except for the Apple Developer website. That doesn't _have_ a passkey enrollment option, and instead automagically creates it in the keychain somehow. I checked the way they are implemented in BitWarden, and it's straightforward. BTW, the blog is disingenuous. The removal of device attestation from PassKeys was a great boon for compatibility. And the experience with resetting key storages or not having enough slots are simply bugs and/or limitations of hardware. Which was to be expected from a new technology.
      - rstuart4133 2y ago
        > The removal of device attestation from PassKeys was a great boon for compatibility. Did they remove attestation? The blog implies they didn't when it says: "a security key ... fail to register ... since the IDP rejected the device attestation." What they removed was a browser API that allowed the IDP to filter the available passkeys, so they could tell the user which of the available keys they would accept before they tried to enrol it. I gather attestation is rarely used by IDP's. That makes sense - why force a low security web site like a forum to keep a list of acceptable token models. However some sites like banks and my Federal Government absolutely need guarantees on how well the secrets are managed. Without it, they will remain with their current "roll their own" solutions. Providing an API that lets their web page say "no we won't accept your North Korean made phone as an authenticator" seems perfectly reasonable to me. That would be the API that Chrome refused to implement.
        cyberax 2y ago
        > Did they remove attestation? Attestation is still in the standard, and some vendors support it. However, Apple removed it from their Keychain-synced keys: https://x.com/rmondello/status/1545085197250482176 https://x.com/rmondello/status/1545085197250482176 and this effectively means that most sites will be forced to deal with non-device-bound keys. Banks can still require device-bound keys, just like they do now. But this effectively makes it impossible to sync these keys across devices. You'll have to use the same hardware token every time, and if you lose it, then you have to re-enroll the keys on every site.
- lordofgibbons 2y ago
  > Syncing that across devices is left to you. I used Syncthing for that. So it doesn't really solve my problem
- yaomtc 2y ago
  Bad news there. https://forum.syncthing.net/t/discontinuing-syncthing-android/23002 https://forum.syncthing.net/t/discontinuing-syncthing-androi...
  - miloignis 2y ago
    I've used this long-running fork and been pleased, and it's on F-Droid. https://github.com/Catfriend1/syncthing-android https://github.com/Catfriend1/syncthing-android
- godelski 2y ago
  I think the thing we need to learn about security is that usability matters. I think this is easy for pretty much anyone that's an active HN user, but is it for your parents or grandparents? It's they who matter a lot. It's why WhatsApp was so successful, it passed the Grandma check. Signal might, but onboarding is "hard" (and the nerds argue and that's all others hear and then do what... Use telegram? Lol). But it's why Matrix isn't gaining popularity, because frankly until creating servers is a one click install it's not going to get mass appeal (same for any federated app). It's the old PGP joke: how do you decrypt a PGP email? You email the sender "I can't decrypt, can you send it without encryption?"
  - ValentineC 2y ago
    > Signal might, but onboarding is "hard" (and the nerds argue and that's all others hear and then do what... Use telegram? Lol). I refuse to use Signal because their message history functionality is too restrictive for me. Telegram strikes a good balance, and wins at the UI/UX game.
    - godelski 2y ago
      > message history functionality is too restrictive for me. At least a way you can get around this is to do the backing up by desktop. I'm assuming you're on an iPhone because Android supports backup. If you are Android, see Molly: https://github.com/mollyim/mollyim-android https://github.com/mollyim/mollyim-android > Telegram strikes a good balance, and wins at the UI/UX game. Telegram gets the "lol" because it's not default E2EE. They advertise themselves as E2EE but most people are not using this feature because it's opt in. If you're going to seriously position yourself as a security app, the defaults have to be secure. It's the bare minimum. And E2EE isn't even available for group chats... WhatsApp is more secure (telegram also gathers metadata)... I do think signal has stagnated while there are many things that could really be improved, including low hanging fruit like just being able to search for stickers (people do in fact care). But for the most part, I'm not sure there's anything major missing. It seems like we're willing to pay high costs to avoid small thorns. But I guess it's better to have a rock on your shoulders than a needle in your finger.
- neonsunset 2y ago
  You can use Vaultwarden. And official server implementation is open-source still.
- LinAGKar 2y ago
  That works fine for a single user, but it doesn't work for sharing secrets between multiple users

What alternatives do you recommend?

by josu 2y ago

What alternatives do you recommend?

KeepassXC. https://keepassxc.org/ https://keepassxc.org/ Recently switched over from a premium Bitwarden account to it. Import from Bitwarden was a breeze. Note that KeepassXC only writes to a local encrypted db file. Syncing that across devices is left to you. I used Syncthing for that.

cyberax 2y ago
No support for passkeys, either.
- zeofig 2y ago
  It does support passkeys.
  - cyberax 2y ago
    iOS application doesn't: https://github.com/keepassium/KeePassium/issues/297 https://github.com/keepassium/KeePassium/issues/297 Neither does the Android app: https://github.com/PhilippC/keepass2android/issues/2099 https://github.com/PhilippC/keepass2android/issues/2099
    - zeofig 2y ago
      Well that SUCKS!
- trinsic2 2y ago
  I wouldn't trust passkey myself [0] [0]: https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shattered-dream/?ref=labnotes.org https://fy.blackhats.net.au/blog/2024-04-26-passkeys-a-shatt...
  - cyberax 2y ago
    I'm using passkeys in BitWarden, and they so far work everywhere, except for the Apple Developer website. That doesn't _have_ a passkey enrollment option, and instead automagically creates it in the keychain somehow. I checked the way they are implemented in BitWarden, and it's straightforward. BTW, the blog is disingenuous. The removal of device attestation from PassKeys was a great boon for compatibility. And the experience with resetting key storages or not having enough slots are simply bugs and/or limitations of hardware. Which was to be expected from a new technology.
    - rstuart4133 2y ago
      > The removal of device attestation from PassKeys was a great boon for compatibility. Did they remove attestation? The blog implies they didn't when it says: "a security key ... fail to register ... since the IDP rejected the device attestation." What they removed was a browser API that allowed the IDP to filter the available passkeys, so they could tell the user which of the available keys they would accept before they tried to enrol it. I gather attestation is rarely used by IDP's. That makes sense - why force a low security web site like a forum to keep a list of acceptable token models. However some sites like banks and my Federal Government absolutely need guarantees on how well the secrets are managed. Without it, they will remain with their current "roll their own" solutions. Providing an API that lets their web page say "no we won't accept your North Korean made phone as an authenticator" seems perfectly reasonable to me. That would be the API that Chrome refused to implement.
      - cyberax 2y ago
        > Did they remove attestation? Attestation is still in the standard, and some vendors support it. However, Apple removed it from their Keychain-synced keys: https://x.com/rmondello/status/1545085197250482176 https://x.com/rmondello/status/1545085197250482176 and this effectively means that most sites will be forced to deal with non-device-bound keys. Banks can still require device-bound keys, just like they do now. But this effectively makes it impossible to sync these keys across devices. You'll have to use the same hardware token every time, and if you lose it, then you have to re-enroll the keys on every site.
lordofgibbons 2y ago
> Syncing that across devices is left to you. I used Syncthing for that. So it doesn't really solve my problem
yaomtc 2y ago
Bad news there. https://forum.syncthing.net/t/discontinuing-syncthing-android/23002 https://forum.syncthing.net/t/discontinuing-syncthing-androi...
- miloignis 2y ago
  I've used this long-running fork and been pleased, and it's on F-Droid. https://github.com/Catfriend1/syncthing-android https://github.com/Catfriend1/syncthing-android
godelski 2y ago
I think the thing we need to learn about security is that usability matters. I think this is easy for pretty much anyone that's an active HN user, but is it for your parents or grandparents? It's they who matter a lot. It's why WhatsApp was so successful, it passed the Grandma check. Signal might, but onboarding is "hard" (and the nerds argue and that's all others hear and then do what... Use telegram? Lol). But it's why Matrix isn't gaining popularity, because frankly until creating servers is a one click install it's not going to get mass appeal (same for any federated app). It's the old PGP joke: how do you decrypt a PGP email? You email the sender "I can't decrypt, can you send it without encryption?"
- ValentineC 2y ago
  > Signal might, but onboarding is "hard" (and the nerds argue and that's all others hear and then do what... Use telegram? Lol). I refuse to use Signal because their message history functionality is too restrictive for me. Telegram strikes a good balance, and wins at the UI/UX game.
  - godelski 2y ago
    > message history functionality is too restrictive for me. At least a way you can get around this is to do the backing up by desktop. I'm assuming you're on an iPhone because Android supports backup. If you are Android, see Molly: https://github.com/mollyim/mollyim-android https://github.com/mollyim/mollyim-android > Telegram strikes a good balance, and wins at the UI/UX game. Telegram gets the "lol" because it's not default E2EE. They advertise themselves as E2EE but most people are not using this feature because it's opt in. If you're going to seriously position yourself as a security app, the defaults have to be secure. It's the bare minimum. And E2EE isn't even available for group chats... WhatsApp is more secure (telegram also gathers metadata)... I do think signal has stagnated while there are many things that could really be improved, including low hanging fruit like just being able to search for stickers (people do in fact care). But for the most part, I'm not sure there's anything major missing. It seems like we're willing to pay high costs to avoid small thorns. But I guess it's better to have a rock on your shoulders than a needle in your finger.
neonsunset 2y ago
You can use Vaultwarden. And official server implementation is open-source still.
LinAGKar 2y ago
That works fine for a single user, but it doesn't work for sharing secrets between multiple users