12 ms·

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem,

by harryh 12y ago

Dude. 1Password. Switching to using it for everything was one of the single smartest things I did this year. I agree with you about the wider industry problem, but for your own personal use just start using a password manager. Just do it.

eyeareque 12y ago
I'm sure it is useful, except for when 1Password attacks take place.
- LeoPanthera 12y ago
  1Password is not a cloud service.
  - JTon 12y ago
    True, but afaik it has the option to use dropbox for device syncing
  - eyeareque 12y ago
    I didn't say anything about how it is implemented. It is software, there is always a way to attack it.
anigbrowl 12y ago
aka 1PointOfFailure. Having spent several years maintaining and repairing computer systems for corporate and professional clients, I can tell you from experience that it is trivially easy to social engineer someone's credentials out of them.
- Micaiah_Chang 12y ago
  I'm currently having a failure of imagination here, but how would you social engineer a password manager? The tricks I'm thinking of involve fooling the user into thinking a site is something it's not or guessing some sort of personal information. But with a separate application the former seems unlikely and the latter is stopped if you use a scheme such as diceware (https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware). I understand that naive, theoretical musings on security are no match for experience, so how would you break that set up?
  - anigbrowl 12y ago
    By getting the user to give me control of it, same as if the user was moving everything to a new computer. You don't have to do this via a website; you use a website to create a problem and then make yourself available to fix it. Not that I'm into this sort of thing, but I've had a few people attempt to co-opt me into criminal activity in the past so I wouldn't be at all surprised to read about such attacks.
- jsmthrowaway 12y ago
  AKA 1FailureToUnderstandTheThreatVector, the common antisecurity argument of lazy or pedantic people. A password manager is not defending against a social engineering attack (how could it?), it's defending against Joe's Blog getting knocked over and your re-used password on Wells Fargo being disclosed. Your comment is a really lame excuse for not using a password manager and is quite a bit of FUD; there is no technical solution to a social engineering attack, so it's a clever way out as an excuse to avoid doing something difficult. You are not the first person to try it on me. You also sound like you're making the case for social engineering control of their machine, at which point what does the password manager matter? You have physical. Game over. I have this conversation regarding self-signed certificates and MD5 hashing as well. "But they don't authenticate," or "but MD5 is insecure!" Yep, I know. Do you understand the threat vector for my usage of either? You sure? Just use one. Seriously.
  - anigbrowl 12y ago
    I'm at a loss as to what benefit I'm supposed to gain by using one. I don't reuse passwords for anything that actually needs to be secure, though I reuse a few for sites that make me create a password even though I don't care about whether those accounts are secure or not. I dpn't see why I should adopt a password manager just because other people don't practice good password security.
    - simonw 12y ago
      How do you remember all of your passwords?
wyager 12y ago
>Dude. 1Password. Password managers only protect against certain kinds of attack. Many cloud services do not or can not properly encrypt their users' data, so having a strong password won't help in the event that your cloud provider's datacenter gets rooted.
- smokinjoe 12y ago
  I think the main point is that while no platform is 100% safe, you can help alleviate the issue by reducing risk (in the case of the original commentor, they were emailing passwords to themselves). Of course there are limits to any measure of security, but 1password does a great job in helping people manage themselves. Personally, it's helped me a lot in just keeping my various usernames/user accounts organized (I sign up for just about anything).
- sigzero 12y ago
  It "eliminates" one attack vector.
- marcosdumay 12y ago
  You can't, but if you use a password manager, you can actually use different passwords on every service. And you can use stronger passwords (if the service permits), thus if they only lost the passwords datbased (assuming it's hashed) you are still safe.
  - ldng 12y ago
    No because say your cloud provider recycle your hard drive to another client with a bad password, then the attacker not only can access the data of the other client but can run a file recovery tool and get some of your files. Most providers don't erase disks properly. Takes too much time.
    - __P 12y ago
      Don't use Password managers because someone can always root a server and unerase deleted files. Logic. Win.
osuritz 12y ago
Couldn't agree more: I look at the max allowed number of characters on website X and I ask 1Password to generate a password of that length with whatever complexity the website allows (so preferably numbers and symbols if allowed).
rayiner 12y ago
Installed! I guess I knew I should use a password manager, but the analysis paralysis of figuring out which one to use is crippling. I just want someone to tell me what to do!
- marcosdumay 12y ago
  For everyone suffering from analysis paralysis: KeepassX, KeepassDroid, and KeepassWhateverYourPlataform. It's not my favorite manager by any dimension, except for portability... but portability is just killer for it.
- gaelian 12y ago
  Another happy 1Password user here. I've been using it for probably about 18 months now and I can never go back to manual account management. It took a bit of upfront time investment to migrate all my existing accounts into the tool but once that was done, it's been a pretty seamless experience overall. There's browser add-ons you can use to auto-populate your login details that work well for most login forms with mostly no or minimal configuration required. It can get a little annoying when the login form has a CAPTCHA or some other non-standard requirement, but generally all that means is a few extra clicks. When creating new account details, configurable (e.g. length, allowed characters, etc.) password generation is built in. You can keep your encrypted data store file on a cloud service for syncing between devices, should you wish. Which brings me to the 1Password mobile apps, which allow you to take your details mobile. Probably the greatest friction point I've encountered has been when I'm on a foreign computer that doesn't have any of my 1Password support tools installed on it. In this case I usually just pull out my phone, navigate to the login details I need and enter them manually. But I take this as a small price to pay for markedly greater peace of mind. I really can't recommend using a password manager enough. If 1Password is not it for you, then use some other password manager. But just use one.
- hisyam 12y ago
  There was a reddit thread that reviews a bunch of password managers out there: http://www.reddit.com/r/apple/comments/1psfmt/1password_vs_lastpass_vs_keepass_vs_dashlane_vs http://www.reddit.com/r/apple/comments/1psfmt/1password_vs_l...
vhost- 12y ago
1Password and last pass are pretty awesome. Some people don't want to use a 3rd party and for those, I suggest KeePass databases at the very least. I have all my two-factor reset keys in KeePassX at home and all normal passwords in last pass. I actually lost a two factor code for Linode when I lost my phone with the Google authenticator app on it and having those reset codes in KeePassX was a life saver.
- flinkblink 12y ago
  Agreed. Keepass + A fileshare service to sync your database to all devices is heavenly.
- kyrra 12y ago
  I've seen this argument come up before and I don't understand it. Why do you trust KeePass more than 1Password? In both cases you are sharing the datafile however you'd like (Dropbox, thumbdrive, etc...). The primary difference is if you have access to the source code or not. If KeePass purposefully injected a vulnerability, it would just be that dev/project that would fail. If 1Password were to do the same, that company and all the people that work for it would go down. I'd personally see this as more of a reason to trust 1Password over KeePass. The primary argument is that the code is open and you can audit it, but in reality that doesn't really happen unless there is a real drive to do it (like we saw recently with TrueCrypt). I trust/distrust both about the same amount. But 1Password has more resources behind it so they are doing more to try and secure the data within the encrypted store.
  - r00fus 12y ago
    Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board). Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.
    - 12y ago
err4nt 12y ago
Agreed! At first I figured that if I could save one piece of information for each dollar I had spent on the software, it would be worth my money. By day two of using 1Password I had 70 entries, and was blown away at how much peace of mind I had. There were seventy things I never needed to _worry_ about forgetting. It was like my brain was holding onto each of those and now I felt more able to just focus on working, it's insane how since I didn't know any better I waited years to finally try it. Second thing I did, buy a copy for my cousin for his birthday! Hope he has a great year with more brainspace for ideas and less spent trying not to forget things :)
deleted 12y ago
[deleted]
tlrobinson 12y ago
While I think using password managers with random passwords is far better than sharing the same password between every account, I've never really gotten comfortable with storing passwords in a file on my computer. What I'd really like is a password manager hardware dongle of some kind, like the Bitcoin Trezor wallet.
- nwh 12y ago
  It doesn't matter. If you have malware lurking in your computer it will just snarf your passwords from the wire and then you're owned all the same. If you use some sort of auth signing system, the request can just be intercepted and modified on the fly.[0] The Trezor is next to useless even for bitcoin for this very reason. Sure they can't steal your money directly, but just replacing the addresses you see and send to accomplishes exactly the same thing. If your platform isn't trusted, no amount if smart crypto or hardware dongles can make it safe.[1] [0]: The rebuttal for this will be signing every request with details of it with a hardware dongle, but would you want to do this for every action in your email client? If the answer is "no", you're owned. Ultimate security is unusable, and doesn't really solve anything outside of the most astute of professional users. Just writing this post I would need 4 signatures, one to log in, one to post, one to fix a typo, and yet another to add this footnote. Would I be able to handle that? No way, I'm far too lazy for that. [1]: The issue is that perfect compromise is impossible to detect. I can be reasonably confident on a heavily sandboxed device like an iPhone that there's little in the way of malware that would affect me. The downside being that I have no tools or methods of analysis if I thought it was compromised. There's no such confidence on the computers I use on a daily basis. I've always thought we have confirmation bias with malicious software. We only notice the dumb stuff while the smart goes unnoticed.
  - tlrobinson 12y ago
    For passwords you're right, but at least it prevents theft of every password all at once. For Bitcoin hardware wallets like Trezor, IIRC they either do or will support BIP-70 "Payment Protocol" payment requests that are signed with an X.509 cert, allowing you to verify the request on the dongle's screen.
genwin 12y ago
Or a text file or spreadsheet containing passwords, in a TrueCrypt container (I still trust it).
- corford 12y ago
  Yep, I do the same. Master truecrypt container on a USB stick that just contains a text file with all my logons. Then whenever I change that file I backup the truecypt container to Spideroak so I'm not hosed if I my stick gets lost/broken/stolen.
  - ptwiggens 12y ago
    That is completely unusable on mobile. As someone who consistently needs my passwords on the go, a password manager is really the best way to go.
    - genwin 12y ago
      Do you have to trust that the password manager doesn't upload the passwords? I trust TrueCrypt since it isn't specifically for passwords.
- vellum 12y ago
  Don't you run the risk of getting the text file or spreadsheet cached to the temp directory?
  - genwin 12y ago
    Good point. I doubt Notepad caches anything on a different drive, but Excel would if auto-save is enabled.
dreamfactory2 12y ago
I got screwed by a password manager that got deleted during upgrading a hard drive. Never again
- sbarre 12y ago
  1Password lets you store your (encrypted) password keychain on Dropbox to sync across devices. You didn't get screwed by a password manager, you got screwed by a bad backup policy.. Sorry to be pedantic - and I feel your pain for losing your data - but there you go..
  - dreamfactory2 12y ago
    It was definitely my stupid fault but the fact is that it introduced a bunch of fragility and less control into password management for me and wasn't a great solution. But it seems increasingly clear to me these days that internet-connected devices are simply unsuitable for anything which requires privacy in any case.
- cheald 12y ago
  That's more or less why I use LastPass. Same concept, only decrypts client-side, but is automatically preserved across machines and hardware failure.
  - tim333 12y ago
    I use Lastpass. I just logged in online and can see all my passwords so it doesn't seem terribly secure. I there was key-logging malware on my machine it could have got my master password and hence all my passwords off Lastpass. It seems handy for all the crap passwords but I would not want to rely on it for anything that lets people nick money. Unless I'm missing something...
    - cheald 12y ago
      LastPass uses your master password to decrypt your key store clientside. What's stored on their servers is an encrypted blob to which they don't have the key. It is an actual zero-knowledge system. If there was key-logging software on your machine, you're pooched any way you slice it (since such malware can just snarf decrypted keystores out of memory anyhow). However, with LastPass you can use Google Authenticator or a Yubikey or similar to enforce second-factor logins, so that even if you have malware on your machine, there is a drastically-smaller window in which to attack you. On the upside, you get phishing protection (LP won't fill passwords for sites that don't actually match the site that you've saved passwords against), password duplication detection and strength auditing, notifications of when your passwords may have been compromised by major breaches, secure transport of passwords to other people, and transparent synchronization across devices. It's quite good.
oliyoung 12y ago
My problem is that 1Password et al are curing symptoms, not solving causes. Personal infosec hasn't evolved quick enough to match the technology it depends on. Sure we're comfortable with 12 character, 3 month rotation passwords, but the average 'civilian'? Probably doesn't even have a passcode on their phone despite the massive personal security risk they're carrying around with them. We need to educate and/or provide easier authentication.
- dredmorbius 12y ago
  12 character? Please! ;-) (Most of mine are markedly longer.) Though I'll admit to being a tad less aggressive on the rotation than I ought to be.
  - rquirk 12y ago
    A lot of sites don't allow more than 12 chars. Of the top of my head, Nintendo's rewards scheme has a limit on the number of characters, it lets you use more but actually truncates the password to 12 or so. Some sites truncate it on the sly then say "incorrect username or password!" when you enter your stored 16+ character password. Other sites silently break if you use characters outside A-Za-z0-9. e.g. you set a password with } or @ in it, then can't log back in again. Ebay wouldn't let me paste a password into the password field recently, I had to type it out, and the keepassx "autotype" feature was thwarted by their focus-altering javascript code on the form. I also think they silently dropped special characters - I know it took me 4 or 5 password reset emails to get the new stored pw to stick. Paypal requires that you enter a credit card number to change the password, so rotating it is tricky if you don't have the card on hand. I'm undecided if this is good or bad, since this sort of 2 factor makes it harder for someone to hijack your account. There are a lot of ways that sites try and make life hard if you are doing things the right way and using a pw manager. It feels like there's this big conspiracy driving us to use the same "Monkey123" password everywhere.
    - dredmorbius 12y ago
      Oh, I know. God do I ever know. I use a password generator. My defaults are _long_. But the nice thing is that I can pass it most constraint rules reasonably readily to create a valid password if I need to fit another use-case. I don't use Ebay, but that sounds particularly annoying. Conversation on G+ suggests that the copy/paste defeat is to combat copy/paste exploits elsewhere, though by that point you might as well declare game over anyhow. I'm definitely _not_ using "Monkey123" everywhere. But a lot of sites get a perfectly cromulent password ... and a mailinator.com email address (also randomly generated). I never use the same tokens twice (mostly registration-required but no real utility / long-term state storage).
prawn 12y ago
I currently use PasswordSafe which is clunky as hell but generally works OK. I checked the 1Password site and it seems like a bit of a bait and switch. Download links without any mention of a price or trial anywhere on the product pages until you create a vault and see a License link in the menus. Then $50+ and another $10 for the mobile app. I'm sure it's worth it, but I'd much rather they spell out their pricing up front.
- jwcooper 12y ago
  They have a 'store' link [1] right in their header with all the pricing. They could maybe be a little more upfront about it, but it's not really a bait and switch. Also, the prices do seem fairly reasonable for what it does. The only thing holding me back has been not having great mobile access (as far as I can tell) on Safari on iOS. Looks like iOS 8 will change that. [1] https://agilebits.com/store https://agilebits.com/store
  - eridius 12y ago
    I've used 1Password for years, and password access in Safari on iOS has indeed been a pain point, but still been manageable. iOS 8 will make it much nicer, with the 1Password extension.
  - prawn 12y ago
    I think they purposely avoid putting a "Buy" link on their product page because they want to get people started before revealing that the software costs money (and a lot of money for a password safe). IMO it's not far off the equivalent of how tourist trap restaurants in Europe put out bread on the table (something provided for free in many restaurants) and then charge you if you touch any. FWIW, that's considered pretty slimy behaviour.
mr_sturd 12y ago
I started using Mitro, recently for the same thing. I had been slowly working on a system which would store pseudo-randomly generated salts and store one for each individual domain. It would detect which site I was entering my password into, take the relevant salt and digest it against the password I had entered - sending a stupidly long, digested passwords to the sites which would allow for it. The password itself would never leave my computer. Progress was slow, though, and other projects took priority. With Mitro, I've done a similar thing by pseudo-randomly generating 64-character base64 strings to store as the passwords for my accounts.
- decode 12y ago
  > I had been slowly working on a system... If you're still interested in this type of system, PasswordMaker has been around for quite a while and does essentially the same thing: http://www.passwordmaker.org/ http://www.passwordmaker.org/
Kiro 12y ago
Stupid question but what happens if you forget the master password or someone steals it?
- cpach 12y ago
  Then you have to reset every password and start over.
- mikerastiello 12y ago
  >1Password creates your data file using the password you provided when you first launched the application. This password is not kept anywhere and it is never logged. Furthermore, there is no “back door” mechanism to recover your data or password. This approach is very important in order to be able to say that 1Password keeps your data safe and secure. However, because of it, once your password is forgotten, there is nothing we can do to help you recover it. https://help.agilebits.com/1Password3/forgot_password.html https://help.agilebits.com/1Password3/forgot_password.html I have my master password written on a piece of paper that is stored in a safe location, mostly so my wife can access my information if anything ever happened to me, but it also works as a backup if I ever forget my master password for some reason.
lsaferite 12y ago
Looks like they still don't have a native Linux client though.
- jbrechtel 12y ago
  pass - http://www.passwordstore.org/ http://www.passwordstore.org/
  - lsaferite 12y ago
    Well, my point was more that I do want a single password storage solution across the board. I use Linux, Windows, OSX, and Android regularly. I tried 1Password in the past but dropped it as it didn't have a Linux client. I now use KeePass as I can sync my DB across all my devices.
baby 12y ago
What if you're not on your computer and you want to check something on gmail, or facebook, or airbnb, etc...
- alexgaribay 12y ago
  They have a mobile version that syncs your passwords across devices. I use the iOS app frequently.
  - baby 12y ago
    Yeah but still, if you don't have a smartphone, or you don't have your mobile, or you can't use your mobile (different country, no wifi). You're pretty much kicked out of your own accounts.

by harryh 12y ago

eyeareque 12y ago

I'm sure it is useful, except for when 1Password attacks take place.

LeoPanthera 12y ago
1Password is not a cloud service.
- JTon 12y ago
  True, but afaik it has the option to use dropbox for device syncing
- eyeareque 12y ago
  I didn't say anything about how it is implemented. It is software, there is always a way to attack it.

anigbrowl 12y ago

aka 1PointOfFailure. Having spent several years maintaining and repairing computer systems for corporate and professional clients, I can tell you from experience that it is trivially easy to social engineer someone's credentials out of them.

Micaiah_Chang 12y ago
I'm currently having a failure of imagination here, but how would you social engineer a password manager? The tricks I'm thinking of involve fooling the user into thinking a site is something it's not or guessing some sort of personal information. But with a separate application the former seems unlikely and the latter is stopped if you use a scheme such as diceware (https://en.wikipedia.org/wiki/Diceware https://en.wikipedia.org/wiki/Diceware). I understand that naive, theoretical musings on security are no match for experience, so how would you break that set up?
- anigbrowl 12y ago
  By getting the user to give me control of it, same as if the user was moving everything to a new computer. You don't have to do this via a website; you use a website to create a problem and then make yourself available to fix it. Not that I'm into this sort of thing, but I've had a few people attempt to co-opt me into criminal activity in the past so I wouldn't be at all surprised to read about such attacks.
jsmthrowaway 12y ago
AKA 1FailureToUnderstandTheThreatVector, the common antisecurity argument of lazy or pedantic people. A password manager is not defending against a social engineering attack (how could it?), it's defending against Joe's Blog getting knocked over and your re-used password on Wells Fargo being disclosed. Your comment is a really lame excuse for not using a password manager and is quite a bit of FUD; there is no technical solution to a social engineering attack, so it's a clever way out as an excuse to avoid doing something difficult. You are not the first person to try it on me. You also sound like you're making the case for social engineering control of their machine, at which point what does the password manager matter? You have physical. Game over. I have this conversation regarding self-signed certificates and MD5 hashing as well. "But they don't authenticate," or "but MD5 is insecure!" Yep, I know. Do you understand the threat vector for my usage of either? You sure? Just use one. Seriously.
- anigbrowl 12y ago
  I'm at a loss as to what benefit I'm supposed to gain by using one. I don't reuse passwords for anything that actually needs to be secure, though I reuse a few for sites that make me create a password even though I don't care about whether those accounts are secure or not. I dpn't see why I should adopt a password manager just because other people don't practice good password security.
  - simonw 12y ago
    How do you remember all of your passwords?

wyager 12y ago

>Dude. 1Password. Password managers only protect against certain kinds of attack. Many cloud services do not or can not properly encrypt their users' data, so having a strong password won't help in the event that your cloud provider's datacenter gets rooted.

smokinjoe 12y ago
I think the main point is that while no platform is 100% safe, you can help alleviate the issue by reducing risk (in the case of the original commentor, they were emailing passwords to themselves). Of course there are limits to any measure of security, but 1password does a great job in helping people manage themselves. Personally, it's helped me a lot in just keeping my various usernames/user accounts organized (I sign up for just about anything).
sigzero 12y ago
It "eliminates" one attack vector.
marcosdumay 12y ago
You can't, but if you use a password manager, you can actually use different passwords on every service. And you can use stronger passwords (if the service permits), thus if they only lost the passwords datbased (assuming it's hashed) you are still safe.
- ldng 12y ago
  No because say your cloud provider recycle your hard drive to another client with a bad password, then the attacker not only can access the data of the other client but can run a file recovery tool and get some of your files. Most providers don't erase disks properly. Takes too much time.
  - __P 12y ago
    Don't use Password managers because someone can always root a server and unerase deleted files. Logic. Win.

osuritz 12y ago

Couldn't agree more: I look at the max allowed number of characters on website X and I ask 1Password to generate a password of that length with whatever complexity the website allows (so preferably numbers and symbols if allowed).

rayiner 12y ago

Installed! I guess I knew I should use a password manager, but the analysis paralysis of figuring out which one to use is crippling. I just want someone to tell me what to do!

marcosdumay 12y ago
For everyone suffering from analysis paralysis: KeepassX, KeepassDroid, and KeepassWhateverYourPlataform. It's not my favorite manager by any dimension, except for portability... but portability is just killer for it.
gaelian 12y ago
Another happy 1Password user here. I've been using it for probably about 18 months now and I can never go back to manual account management. It took a bit of upfront time investment to migrate all my existing accounts into the tool but once that was done, it's been a pretty seamless experience overall. There's browser add-ons you can use to auto-populate your login details that work well for most login forms with mostly no or minimal configuration required. It can get a little annoying when the login form has a CAPTCHA or some other non-standard requirement, but generally all that means is a few extra clicks. When creating new account details, configurable (e.g. length, allowed characters, etc.) password generation is built in. You can keep your encrypted data store file on a cloud service for syncing between devices, should you wish. Which brings me to the 1Password mobile apps, which allow you to take your details mobile. Probably the greatest friction point I've encountered has been when I'm on a foreign computer that doesn't have any of my 1Password support tools installed on it. In this case I usually just pull out my phone, navigate to the login details I need and enter them manually. But I take this as a small price to pay for markedly greater peace of mind. I really can't recommend using a password manager enough. If 1Password is not it for you, then use some other password manager. But just use one.
hisyam 12y ago
There was a reddit thread that reviews a bunch of password managers out there: http://www.reddit.com/r/apple/comments/1psfmt/1password_vs_lastpass_vs_keepass_vs_dashlane_vs http://www.reddit.com/r/apple/comments/1psfmt/1password_vs_l...

vhost- 12y ago

1Password and last pass are pretty awesome. Some people don't want to use a 3rd party and for those, I suggest KeePass databases at the very least. I have all my two-factor reset keys in KeePassX at home and all normal passwords in last pass. I actually lost a two factor code for Linode when I lost my phone with the Google authenticator app on it and having those reset codes in KeePassX was a life saver.

flinkblink 12y ago
Agreed. Keepass + A fileshare service to sync your database to all devices is heavenly.
kyrra 12y ago
I've seen this argument come up before and I don't understand it. Why do you trust KeePass more than 1Password? In both cases you are sharing the datafile however you'd like (Dropbox, thumbdrive, etc...). The primary difference is if you have access to the source code or not. If KeePass purposefully injected a vulnerability, it would just be that dev/project that would fail. If 1Password were to do the same, that company and all the people that work for it would go down. I'd personally see this as more of a reason to trust 1Password over KeePass. The primary argument is that the code is open and you can audit it, but in reality that doesn't really happen unless there is a real drive to do it (like we saw recently with TrueCrypt). I trust/distrust both about the same amount. But 1Password has more resources behind it so they are doing more to try and secure the data within the encrypted store.
- r00fus 12y ago
  Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board). Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.
  - 12y ago

err4nt 12y ago

Agreed! At first I figured that if I could save one piece of information for each dollar I had spent on the software, it would be worth my money. By day two of using 1Password I had 70 entries, and was blown away at how much peace of mind I had. There were seventy things I never needed to _worry_ about forgetting. It was like my brain was holding onto each of those and now I felt more able to just focus on working, it's insane how since I didn't know any better I waited years to finally try it. Second thing I did, buy a copy for my cousin for his birthday! Hope he has a great year with more brainspace for ideas and less spent trying not to forget things :)

deleted 12y ago

[deleted]

tlrobinson 12y ago

While I think using password managers with random passwords is far better than sharing the same password between every account, I've never really gotten comfortable with storing passwords in a file on my computer. What I'd really like is a password manager hardware dongle of some kind, like the Bitcoin Trezor wallet.

nwh 12y ago
It doesn't matter. If you have malware lurking in your computer it will just snarf your passwords from the wire and then you're owned all the same. If you use some sort of auth signing system, the request can just be intercepted and modified on the fly.[0] The Trezor is next to useless even for bitcoin for this very reason. Sure they can't steal your money directly, but just replacing the addresses you see and send to accomplishes exactly the same thing. If your platform isn't trusted, no amount if smart crypto or hardware dongles can make it safe.[1] [0]: The rebuttal for this will be signing every request with details of it with a hardware dongle, but would you want to do this for every action in your email client? If the answer is "no", you're owned. Ultimate security is unusable, and doesn't really solve anything outside of the most astute of professional users. Just writing this post I would need 4 signatures, one to log in, one to post, one to fix a typo, and yet another to add this footnote. Would I be able to handle that? No way, I'm far too lazy for that. [1]: The issue is that perfect compromise is impossible to detect. I can be reasonably confident on a heavily sandboxed device like an iPhone that there's little in the way of malware that would affect me. The downside being that I have no tools or methods of analysis if I thought it was compromised. There's no such confidence on the computers I use on a daily basis. I've always thought we have confirmation bias with malicious software. We only notice the dumb stuff while the smart goes unnoticed.
- tlrobinson 12y ago
  For passwords you're right, but at least it prevents theft of every password all at once. For Bitcoin hardware wallets like Trezor, IIRC they either do or will support BIP-70 "Payment Protocol" payment requests that are signed with an X.509 cert, allowing you to verify the request on the dongle's screen.

genwin 12y ago

Or a text file or spreadsheet containing passwords, in a TrueCrypt container (I still trust it).

corford 12y ago
Yep, I do the same. Master truecrypt container on a USB stick that just contains a text file with all my logons. Then whenever I change that file I backup the truecypt container to Spideroak so I'm not hosed if I my stick gets lost/broken/stolen.
- ptwiggens 12y ago
  That is completely unusable on mobile. As someone who consistently needs my passwords on the go, a password manager is really the best way to go.
  - genwin 12y ago
    Do you have to trust that the password manager doesn't upload the passwords? I trust TrueCrypt since it isn't specifically for passwords.
vellum 12y ago
Don't you run the risk of getting the text file or spreadsheet cached to the temp directory?
- genwin 12y ago
  Good point. I doubt Notepad caches anything on a different drive, but Excel would if auto-save is enabled.

dreamfactory2 12y ago

I got screwed by a password manager that got deleted during upgrading a hard drive. Never again

sbarre 12y ago
1Password lets you store your (encrypted) password keychain on Dropbox to sync across devices. You didn't get screwed by a password manager, you got screwed by a bad backup policy.. Sorry to be pedantic - and I feel your pain for losing your data - but there you go..
- dreamfactory2 12y ago
  It was definitely my stupid fault but the fact is that it introduced a bunch of fragility and less control into password management for me and wasn't a great solution. But it seems increasingly clear to me these days that internet-connected devices are simply unsuitable for anything which requires privacy in any case.
cheald 12y ago
That's more or less why I use LastPass. Same concept, only decrypts client-side, but is automatically preserved across machines and hardware failure.
- tim333 12y ago
  I use Lastpass. I just logged in online and can see all my passwords so it doesn't seem terribly secure. I there was key-logging malware on my machine it could have got my master password and hence all my passwords off Lastpass. It seems handy for all the crap passwords but I would not want to rely on it for anything that lets people nick money. Unless I'm missing something...
  - cheald 12y ago
    LastPass uses your master password to decrypt your key store clientside. What's stored on their servers is an encrypted blob to which they don't have the key. It is an actual zero-knowledge system. If there was key-logging software on your machine, you're pooched any way you slice it (since such malware can just snarf decrypted keystores out of memory anyhow). However, with LastPass you can use Google Authenticator or a Yubikey or similar to enforce second-factor logins, so that even if you have malware on your machine, there is a drastically-smaller window in which to attack you. On the upside, you get phishing protection (LP won't fill passwords for sites that don't actually match the site that you've saved passwords against), password duplication detection and strength auditing, notifications of when your passwords may have been compromised by major breaches, secure transport of passwords to other people, and transparent synchronization across devices. It's quite good.

oliyoung 12y ago

My problem is that 1Password et al are curing symptoms, not solving causes. Personal infosec hasn't evolved quick enough to match the technology it depends on. Sure we're comfortable with 12 character, 3 month rotation passwords, but the average 'civilian'? Probably doesn't even have a passcode on their phone despite the massive personal security risk they're carrying around with them. We need to educate and/or provide easier authentication.

dredmorbius 12y ago
12 character? Please! ;-) (Most of mine are markedly longer.) Though I'll admit to being a tad less aggressive on the rotation than I ought to be.
- rquirk 12y ago
  A lot of sites don't allow more than 12 chars. Of the top of my head, Nintendo's rewards scheme has a limit on the number of characters, it lets you use more but actually truncates the password to 12 or so. Some sites truncate it on the sly then say "incorrect username or password!" when you enter your stored 16+ character password. Other sites silently break if you use characters outside A-Za-z0-9. e.g. you set a password with } or @ in it, then can't log back in again. Ebay wouldn't let me paste a password into the password field recently, I had to type it out, and the keepassx "autotype" feature was thwarted by their focus-altering javascript code on the form. I also think they silently dropped special characters - I know it took me 4 or 5 password reset emails to get the new stored pw to stick. Paypal requires that you enter a credit card number to change the password, so rotating it is tricky if you don't have the card on hand. I'm undecided if this is good or bad, since this sort of 2 factor makes it harder for someone to hijack your account. There are a lot of ways that sites try and make life hard if you are doing things the right way and using a pw manager. It feels like there's this big conspiracy driving us to use the same "Monkey123" password everywhere.
  - dredmorbius 12y ago
    Oh, I know. God do I ever know. I use a password generator. My defaults are _long_. But the nice thing is that I can pass it most constraint rules reasonably readily to create a valid password if I need to fit another use-case. I don't use Ebay, but that sounds particularly annoying. Conversation on G+ suggests that the copy/paste defeat is to combat copy/paste exploits elsewhere, though by that point you might as well declare game over anyhow. I'm definitely _not_ using "Monkey123" everywhere. But a lot of sites get a perfectly cromulent password ... and a mailinator.com email address (also randomly generated). I never use the same tokens twice (mostly registration-required but no real utility / long-term state storage).

prawn 12y ago

I currently use PasswordSafe which is clunky as hell but generally works OK. I checked the 1Password site and it seems like a bit of a bait and switch. Download links without any mention of a price or trial anywhere on the product pages until you create a vault and see a License link in the menus. Then $50+ and another $10 for the mobile app. I'm sure it's worth it, but I'd much rather they spell out their pricing up front.

jwcooper 12y ago
They have a 'store' link [1] right in their header with all the pricing. They could maybe be a little more upfront about it, but it's not really a bait and switch. Also, the prices do seem fairly reasonable for what it does. The only thing holding me back has been not having great mobile access (as far as I can tell) on Safari on iOS. Looks like iOS 8 will change that. [1] https://agilebits.com/store https://agilebits.com/store
- eridius 12y ago
  I've used 1Password for years, and password access in Safari on iOS has indeed been a pain point, but still been manageable. iOS 8 will make it much nicer, with the 1Password extension.
- prawn 12y ago
  I think they purposely avoid putting a "Buy" link on their product page because they want to get people started before revealing that the software costs money (and a lot of money for a password safe). IMO it's not far off the equivalent of how tourist trap restaurants in Europe put out bread on the table (something provided for free in many restaurants) and then charge you if you touch any. FWIW, that's considered pretty slimy behaviour.

mr_sturd 12y ago

I started using Mitro, recently for the same thing. I had been slowly working on a system which would store pseudo-randomly generated salts and store one for each individual domain. It would detect which site I was entering my password into, take the relevant salt and digest it against the password I had entered - sending a stupidly long, digested passwords to the sites which would allow for it. The password itself would never leave my computer. Progress was slow, though, and other projects took priority. With Mitro, I've done a similar thing by pseudo-randomly generating 64-character base64 strings to store as the passwords for my accounts.

decode 12y ago
> I had been slowly working on a system... If you're still interested in this type of system, PasswordMaker has been around for quite a while and does essentially the same thing: http://www.passwordmaker.org/ http://www.passwordmaker.org/

Kiro 12y ago

Stupid question but what happens if you forget the master password or someone steals it?

cpach 12y ago
Then you have to reset every password and start over.
mikerastiello 12y ago
>1Password creates your data file using the password you provided when you first launched the application. This password is not kept anywhere and it is never logged. Furthermore, there is no “back door” mechanism to recover your data or password. This approach is very important in order to be able to say that 1Password keeps your data safe and secure. However, because of it, once your password is forgotten, there is nothing we can do to help you recover it. https://help.agilebits.com/1Password3/forgot_password.html https://help.agilebits.com/1Password3/forgot_password.html I have my master password written on a piece of paper that is stored in a safe location, mostly so my wife can access my information if anything ever happened to me, but it also works as a backup if I ever forget my master password for some reason.

lsaferite 12y ago

Looks like they still don't have a native Linux client though.

jbrechtel 12y ago
pass - http://www.passwordstore.org/ http://www.passwordstore.org/
- lsaferite 12y ago
  Well, my point was more that I do want a single password storage solution across the board. I use Linux, Windows, OSX, and Android regularly. I tried 1Password in the past but dropped it as it didn't have a Linux client. I now use KeePass as I can sync my DB across all my devices.

baby 12y ago

What if you're not on your computer and you want to check something on gmail, or facebook, or airbnb, etc...

alexgaribay 12y ago
They have a mobile version that syncs your passwords across devices. I use the iOS app frequently.
- baby 12y ago
  Yeah but still, if you don't have a smartphone, or you don't have your mobile, or you can't use your mobile (different country, no wifi). You're pretty much kicked out of your own accounts.