6 ms·

I've seen this argument come up before and I don't understand it. Why do you trust KeePass more than 1Password? In both cases you are sharing the datafile how

by kyrra 12y ago

I've seen this argument come up before and I don't understand it. Why do you trust KeePass more than 1Password? In both cases you are sharing the datafile however you'd like (Dropbox, thumbdrive, etc...). The primary difference is if you have access to the source code or not. If KeePass purposefully injected a vulnerability, it would just be that dev/project that would fail. If 1Password were to do the same, that company and all the people that work for it would go down. I'd personally see this as more of a reason to trust 1Password over KeePass. The primary argument is that the code is open and you can audit it, but in reality that doesn't really happen unless there is a real drive to do it (like we saw recently with TrueCrypt). I trust/distrust both about the same amount. But 1Password has more resources behind it so they are doing more to try and secure the data within the encrypted store.

r00fus 12y ago
Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board). Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.
- eridius 12y ago
  Free as in beer is a reason to be more distrustful of the software. Sure it's more convenient, but this seems to be an area where it's really worth investing money in getting the more reliable solution.
  - jimlei 12y ago
    Why do you assume paid software is more reliable?
    - eridius 12y ago
      See this other comment I just posted: https://news.ycombinator.com/item?id=8264450 https://news.ycombinator.com/item?id=8264450
  - pyre 12y ago
    Are you by chance a purchasing manager for a large corporation? Do you feel that signing a $100K-$1M Oracle contract is worth it because "if MySQL or PostgreSQL were worth something, then they would charge you for it?"
    - eridius 12y ago
      Thanks for the straw man and entirely manufactured quote. We're talking about paying $50 for software that manages your passwords for everything, not paying hundreds of thousands to millions of dollars.
      - pyre 12y ago
        > Free as in beer is a reason to be more distrustful of the software. > this seems to be an area where it's really worth investing money in getting the more reliable solution. You're stating that "Free as in Beer" == "Less Reliable" and the fact that something costs money implies with 100% accuracy that it is reliable. Neither of these are true. Arguing that I'm bringing up a strawman because I said "Free vs. Millions of Dollars" instead of "Free vs. $50" is beside the point.
        eridius 12y ago
        I am not saying either. I'm saying "Free as in beer" is not a reason to trust software in this particular field, i.e. the field of security software where one error can undermine the whole point of the software and expose your secret data to the world. And I never even came close to saying that "something costs money implies with 100% accuracy that it is reliable". You are once again making up words to put in my mouth. The fact is, a lot of people still believe the "open source == more eyeballs" myth, even though that is a myth. Open source does not equate to reliability. And when it comes to software that requires this much trust, a company built around a product is more inherently trustworthy than open source, as the entire company is on the line with their product (and the livelihood of all their employees), whereas with the open source product only the reputation of the author(s) is at stake. Please note that, once again, I am not saying this is a "100% accurate" indicator of reliability. There are many factors at play. One important factor would be whether the software in question has ever undergone a security audit. Another would be whether there's proper documentation on the encryption (i.e. 1Password's file format is completely documented, both so third party software can use it if need be, and so the security of the file format can be vetted). A third would be the involvement of anyone who is already previously known to be an expert in the field. Etc. Edit: Come on guys, please stop drive-by downvoting. If you disagree, comment!
  - cpach 12y ago
    IMHO, the license is not really the big question for this type of software. The most important thing is the competence of the team(s) who wrote and audited the software.
    - eridius 12y ago
      Exactly. I love open source software and use (and contribute to) it all the time, but the sad fact is that, despite the "many eyeballs" claim, most open source software is very rarely audited. I am willing to believe that KeePass is in fact implemented well and safe to use, but I don't actually know anything about the developer(s) behind it, don't know anything about the future development of the software (will it still be the same developers? Will new unknown people start contributing? etc), and pretty much the only thing that the developer(s) stand to lose by screwing up is reputation. On the other hand, AgileBits (makers of 1Password) is a company, with actual money on the line (in addition to reputation) serving as an assurance that the product will not only continue to be developed, but will remain secure. If KeePass screws up, some reputation is lost, people may switch to another product, and the developer(s) can just move on to working on other software if KeePass can't be salvaged. If AgileBits screws up, not only is reputation lost, but so are paying customers, depending on the severity the entire company might go belly-up (e.g. if 1Password is compromised heavily enough that it can't be trusted anymore), a lot of people are suddenly out of a job, etc. Basically, there's a lot more at stake for AgileBits, which makes it much easier to trust that not only are they going to do their job right, but they're also going to have processes in place to ensure a build never gets released externally that doesn't pass QA, etc. And don't forget that as a paying customer of AgileBits, I can get support from them for any problem I might be having. Open source projects don't typically employ support personnel, and generally rely on the community to try and provide whatever support they can. --- Ultimately, this comes down to the fact that this is a specialized class of software, where one breach can mean irreparable damage as the attacker now has access to your passwords for everything. For that kind of software, I really want the backing of a company, with a significant amount to lose, rather than just some unknown collection of open source developers. Which is to say, for nearly any other class of software, I'm much more inclined to judge it based on its merits, and open source has a lot of advantages. But this isn't any other class of software.
  - eridius 12y ago
    Wow, Hacker News really hates the idea of paying a reasonable amount of money for important software? Edit: And hates being told they hate it. How meta. If you disagree, please leave a comment. Drive-by downvoting does not help anyone.
vhost- 12y ago
I was just offering it as a suggestion. Some people like to keep things on their own computers (or servers) and keepass offers that. I use Lastpass, which is hosted and I trust them with my passwords. I simply use keepassx to store two factor reset codes. I do this because if I store my reset codes in the same system as my passwords, then it's not very two-factor anymore, is it?
- kyrra 12y ago
  I completely understand. When people ask me which they should use, I outline the pros/cons of Keepass, LastPass, and 1Password. If you want password management for free, KeePass rocks. If you want to pay, it's definitely a tossup between LastPass and 1Password. I think they are all awesome tools.
  - teach 12y ago
    This is an aside, but your comment reminded me to check why I've never even considered using 1Password and happily pay for LastPass. A brief visit to their website later and I remembered: 1Password doesn't have Linux support. It's a shame; it looks really nice and I don't mind paying for good software.
MichaelDickens 12y ago
My concern is that 1Password could shut down at any time and stop being supported, and I may lose access to all my passwords. KeePass is open source, so even if the current maintainer quits, it's likely that others in the community will step up to continue maintaining it. If absolutely necessary, I can edit the source code myself.
- Accelerata 12y ago
  That's not how 1Password works. All passwords for 1Password are stored locally in an AES encrypted file. They never see, touch, or have any control over your passwords on their end. Even if they suddenly shut down tomorrow, all your passwords would still be accessible unless you chose to delete the application and have zero backups to restore from. They even have an export function to dump the passwords (unencrypted) into a plain text or CSV file, so you can easily migrate the data to a new manager if needed.
  - Dobbs 12y ago
    You are 100% correct. To add to this all syncing on 1Password is done using 3rd party vendors. You can use dropbox, iCloud, Google Drive, etc to do the actual syncing of the encrypted files.
    - mikepurvis 12y ago
      I use Dropbox, but my password for Dropbox itself is stored inside 1Password. The escape hatch is that the 1Password sync folder is shared publicly, and the URL is copied to a slip of paper in my wallet.
      - newman314 12y ago
        Why would you ever expose the sync folder publicly? Just keep a copy on a local computer with Dropbox if need be.
        12y ago
oinksoft 12y ago
Why do you assume every KeePass user is storing their passwords on a server somewhere? I would never send my password file over a network, and I don't consider USB storage "sharing."
- deciplex 12y ago
  The password file itself is an encrypted DB. Unless you choose a weak password for that, it's pretty secure.
  - oinksoft 12y ago
    The more tightly you control copies of your password DB file, the less vulnerable you are if somebody "purposefully injected a vulnerability" in the software as parent suggests, that's the only reason I brought it up.

by kyrra 12y ago

r00fus 12y ago

Well, Keepass is free as in beer too, so from a licensing perspective, that's a factor (mainly for adoption) though, 1Password is a totally affordable and solid investment for 99%+ of folks on this board). Free allows much more organic adoption - I can recommend a friend to use KeePass without worrying a bit that he doesn't think 1Password is a good investment. I can mandate it for my team at work without having to get it expensed.

eridius 12y ago
Free as in beer is a reason to be more distrustful of the software. Sure it's more convenient, but this seems to be an area where it's really worth investing money in getting the more reliable solution.
- jimlei 12y ago
  Why do you assume paid software is more reliable?
  - eridius 12y ago
    See this other comment I just posted: https://news.ycombinator.com/item?id=8264450 https://news.ycombinator.com/item?id=8264450
- pyre 12y ago
  Are you by chance a purchasing manager for a large corporation? Do you feel that signing a $100K-$1M Oracle contract is worth it because "if MySQL or PostgreSQL were worth something, then they would charge you for it?"
  - eridius 12y ago
    Thanks for the straw man and entirely manufactured quote. We're talking about paying $50 for software that manages your passwords for everything, not paying hundreds of thousands to millions of dollars.
    - pyre 12y ago
      > Free as in beer is a reason to be more distrustful of the software. > this seems to be an area where it's really worth investing money in getting the more reliable solution. You're stating that "Free as in Beer" == "Less Reliable" and the fact that something costs money implies with 100% accuracy that it is reliable. Neither of these are true. Arguing that I'm bringing up a strawman because I said "Free vs. Millions of Dollars" instead of "Free vs. $50" is beside the point.
      - eridius 12y ago
        I am not saying either. I'm saying "Free as in beer" is not a reason to trust software in this particular field, i.e. the field of security software where one error can undermine the whole point of the software and expose your secret data to the world. And I never even came close to saying that "something costs money implies with 100% accuracy that it is reliable". You are once again making up words to put in my mouth. The fact is, a lot of people still believe the "open source == more eyeballs" myth, even though that is a myth. Open source does not equate to reliability. And when it comes to software that requires this much trust, a company built around a product is more inherently trustworthy than open source, as the entire company is on the line with their product (and the livelihood of all their employees), whereas with the open source product only the reputation of the author(s) is at stake. Please note that, once again, I am not saying this is a "100% accurate" indicator of reliability. There are many factors at play. One important factor would be whether the software in question has ever undergone a security audit. Another would be whether there's proper documentation on the encryption (i.e. 1Password's file format is completely documented, both so third party software can use it if need be, and so the security of the file format can be vetted). A third would be the involvement of anyone who is already previously known to be an expert in the field. Etc. Edit: Come on guys, please stop drive-by downvoting. If you disagree, comment!
- cpach 12y ago
  IMHO, the license is not really the big question for this type of software. The most important thing is the competence of the team(s) who wrote and audited the software.
  - eridius 12y ago
    Exactly. I love open source software and use (and contribute to) it all the time, but the sad fact is that, despite the "many eyeballs" claim, most open source software is very rarely audited. I am willing to believe that KeePass is in fact implemented well and safe to use, but I don't actually know anything about the developer(s) behind it, don't know anything about the future development of the software (will it still be the same developers? Will new unknown people start contributing? etc), and pretty much the only thing that the developer(s) stand to lose by screwing up is reputation. On the other hand, AgileBits (makers of 1Password) is a company, with actual money on the line (in addition to reputation) serving as an assurance that the product will not only continue to be developed, but will remain secure. If KeePass screws up, some reputation is lost, people may switch to another product, and the developer(s) can just move on to working on other software if KeePass can't be salvaged. If AgileBits screws up, not only is reputation lost, but so are paying customers, depending on the severity the entire company might go belly-up (e.g. if 1Password is compromised heavily enough that it can't be trusted anymore), a lot of people are suddenly out of a job, etc. Basically, there's a lot more at stake for AgileBits, which makes it much easier to trust that not only are they going to do their job right, but they're also going to have processes in place to ensure a build never gets released externally that doesn't pass QA, etc. And don't forget that as a paying customer of AgileBits, I can get support from them for any problem I might be having. Open source projects don't typically employ support personnel, and generally rely on the community to try and provide whatever support they can. --- Ultimately, this comes down to the fact that this is a specialized class of software, where one breach can mean irreparable damage as the attacker now has access to your passwords for everything. For that kind of software, I really want the backing of a company, with a significant amount to lose, rather than just some unknown collection of open source developers. Which is to say, for nearly any other class of software, I'm much more inclined to judge it based on its merits, and open source has a lot of advantages. But this isn't any other class of software.
- eridius 12y ago
  Wow, Hacker News really hates the idea of paying a reasonable amount of money for important software? Edit: And hates being told they hate it. How meta. If you disagree, please leave a comment. Drive-by downvoting does not help anyone.

vhost- 12y ago

I was just offering it as a suggestion. Some people like to keep things on their own computers (or servers) and keepass offers that. I use Lastpass, which is hosted and I trust them with my passwords. I simply use keepassx to store two factor reset codes. I do this because if I store my reset codes in the same system as my passwords, then it's not very two-factor anymore, is it?

kyrra 12y ago
I completely understand. When people ask me which they should use, I outline the pros/cons of Keepass, LastPass, and 1Password. If you want password management for free, KeePass rocks. If you want to pay, it's definitely a tossup between LastPass and 1Password. I think they are all awesome tools.
- teach 12y ago
  This is an aside, but your comment reminded me to check why I've never even considered using 1Password and happily pay for LastPass. A brief visit to their website later and I remembered: 1Password doesn't have Linux support. It's a shame; it looks really nice and I don't mind paying for good software.

MichaelDickens 12y ago

My concern is that 1Password could shut down at any time and stop being supported, and I may lose access to all my passwords. KeePass is open source, so even if the current maintainer quits, it's likely that others in the community will step up to continue maintaining it. If absolutely necessary, I can edit the source code myself.

Accelerata 12y ago
That's not how 1Password works. All passwords for 1Password are stored locally in an AES encrypted file. They never see, touch, or have any control over your passwords on their end. Even if they suddenly shut down tomorrow, all your passwords would still be accessible unless you chose to delete the application and have zero backups to restore from. They even have an export function to dump the passwords (unencrypted) into a plain text or CSV file, so you can easily migrate the data to a new manager if needed.
- Dobbs 12y ago
  You are 100% correct. To add to this all syncing on 1Password is done using 3rd party vendors. You can use dropbox, iCloud, Google Drive, etc to do the actual syncing of the encrypted files.
  - mikepurvis 12y ago
    I use Dropbox, but my password for Dropbox itself is stored inside 1Password. The escape hatch is that the 1Password sync folder is shared publicly, and the URL is copied to a slip of paper in my wallet.
    - newman314 12y ago
      Why would you ever expose the sync folder publicly? Just keep a copy on a local computer with Dropbox if need be.
      - 12y ago

oinksoft 12y ago

Why do you assume every KeePass user is storing their passwords on a server somewhere? I would never send my password file over a network, and I don't consider USB storage "sharing."

deciplex 12y ago
The password file itself is an encrypted DB. Unless you choose a weak password for that, it's pretty secure.
- oinksoft 12y ago
  The more tightly you control copies of your password DB file, the less vulnerable you are if somebody "purposefully injected a vulnerability" in the software as parent suggests, that's the only reason I brought it up.