4 ms·

I used both KeePass and 1Password is not just about the pretty interface as you make it to be. Entire UX is much better. Also, even if some 3rd party looked at

by eknkc 13y ago

I used both KeePass and 1Password is not just about the pretty interface as you make it to be. Entire UX is much better. Also, even if some 3rd party looked at the code, it doesn't really matter because they are really transparent about the file storage format, there are even some open source cli tools to extract data. Also it is a fact that no data leaves your control. No server side storage or something like that. I believe 1Password has a great model for a closed source password manager here. KeePass had been really unreliable and I could not just trust it to store anything. Maybe I should give it another shot. LastPass and other "server side" storage services are not even an option for me though.

moystard 13y ago
With LastPass, all data are encrypted locally on your machine so except if there is a backdoor in their extensions/desktop applications, you are normally pretty safe.
- dobbsbob 13y ago
  http://www.tobtu.com/lastpass.php http://www.tobtu.com/lastpass.php why nobody should use lastpass
  - moystard 13y ago
    Thanks for the read, will probably switch to KeePass then.
SCdF 13y ago
You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.
- eknkc 13y ago
  One important thing is, my data directory is on my computer. It's not transmitted over any wire. Unless NSA comes knocking... Of course if you want to sync then it goes through dropbox then you have a problem. But they stated that the new version will be able to sync within a wireless LAN. And If you don't really trust 1Password's encryption, it would be trivial to relocate data files within a trucrypt container or something. (I know this is somewhat ridiculous)
  - SCdF 13y ago
    Oh for sure. My original point, way back up tree, still stands though. If you care about security, surely you should care about security. If the data is just on your computer and you're not worried about people getting access to the file why don't you just use a text file, or get the browser to save passwords, or a billion other possibilities that don't cost USD$50-70? There is something to be said, I suppose, for "well if I sell my computer and forget to dd the drive / it gets stolen then it stops randoms from easily gaining access to my stuff". You then need to wonder if that's the only file you wouldn't want people being able to access. If it turns out that there is other stuff as well, perhaps encrypting your home directory is a smarter idea (I hear there isn't a massive performance hit these days)?

by eknkc 13y ago

moystard 13y ago

With LastPass, all data are encrypted locally on your machine so except if there is a backdoor in their extensions/desktop applications, you are normally pretty safe.

dobbsbob 13y ago
http://www.tobtu.com/lastpass.php http://www.tobtu.com/lastpass.php why nobody should use lastpass
- moystard 13y ago
  Thanks for the read, will probably switch to KeePass then.

SCdF 13y ago

You can only validate their file format, you can't validate, say, the quality of their implementation. For all you know they are intentionally generating files that are really easy to crack, or are using a custom rng implementation given to them by the NSA, or whatever. Super smart people might be able to reverse engineer such knowledge, but it would be better if they could look at the code.

eknkc 13y ago
One important thing is, my data directory is on my computer. It's not transmitted over any wire. Unless NSA comes knocking... Of course if you want to sync then it goes through dropbox then you have a problem. But they stated that the new version will be able to sync within a wireless LAN. And If you don't really trust 1Password's encryption, it would be trivial to relocate data files within a trucrypt container or something. (I know this is somewhat ridiculous)
- SCdF 13y ago
  Oh for sure. My original point, way back up tree, still stands though. If you care about security, surely you should care about security. If the data is just on your computer and you're not worried about people getting access to the file why don't you just use a text file, or get the browser to save passwords, or a billion other possibilities that don't cost USD$50-70? There is something to be said, I suppose, for "well if I sell my computer and forget to dd the drive / it gets stolen then it stops randoms from easily gaining access to my stuff". You then need to wonder if that's the only file you wouldn't want people being able to access. If it turns out that there is other stuff as well, perhaps encrypting your home directory is a smarter idea (I hear there isn't a massive performance hit these days)?