Hacker News Reader

Comment by colinplamondon | Hacker News Reader

This really rubs me the wrong way. Do not like the idea of my password manager bouncing around owners. Or infrastructure changes that new owners often push on the acquired company.

If there's one business I REALLY do not want to be moving about, and I want as little churn as possible for, it's a password manager.

The thing I liked about LastPass was that it seemed like the highly geeky, less startupy approach to password managers, more likely to be run for the long-term, less likely to be at risk of an acquisition.

Going to look into Dashlane.

View on HN

I use opensource keepass. Sync my password db via dropbox. Totally works for me.

Using Dropbox for Security seems like a oxymoron? I fail to see that as anything I am willing to use.

Why? The database itself is encrypted. Dropbox is just a easy way to sync it between devices.

I store the private keyfile outside of Dropbox. To me it's a very acceptable tradeoff.

"Using Dropbox for sync". It's just an option. Password db is already encrypted, so it does not matter which service is used for sync :)

What makes you trust LastPass to spread your database to your devices more? And what makes Dropbox so bad?

Dropbox runs a binary on your machine; that's enough to suspect them. Stick with an open source password manager and an open sync service (S3 plus a script? Or a third party client like Arq).

Yeah... I'm not in the RMS camp

Nothing to do with software freedom, everything to do with security/auditability.

Yeah, with Dropbox software running on your machine, you not only have to trust them not to snoop on you, you have to trust their non-auditable code to be ~perfect~ against exploitation by others.

Unless you actually read through and understand your open source alternative line by line you aren't really running anything safer

Of course there is the argument that since it's open source it's safe since someone has "audited" it, but many times that's not true.

And even then unless you spend a lot of time trying to break it so you understand it completely you are way better off just writing your own solution, but that takes time and effort

Does it work on mobile?

Yes, i have it running in my BlackBerry! Im pretty sure, iOS and Android alternatives would be available.

Yep. I have both an Android and iOS client that I use.

Are there plugins for safari/firefox/chrome and does it work on ios and have a nice little cli?

I'm basically preparing to bail on lastpass with this news but need to have all my bases covered.

> Are there plugins for safari/firefox/chrome

I just save+sync passwords in Firefox and use a strong master password. I (usually) only need to paste the password from Keepass once unless I elect to not save it (such as with financial logins).

> does it work on ios?

Google seems to return lots of results for iOS Keepass apps. You'll want to vet them on your own. I use KeePassDroid on Android and like it well enough.

I tend to use all 3 of the browsers for slightly different things so having plugins would be ideal but I suppose I could slum it with copy/paste as long as I follow the password/login route to reduce the chance a password gets exposed.

I forgot about my nexus tablet but android is the other thing to have a look into.

With KeePass I haven't felt the need for a browser plugin: Ctrl+C, Ctrl+V is easy enough for my tastes. Plus, in Windows the "auto fill" works more often than not (reducing things to just Ctrl+V in KeePass).

There are multiple KeePass clients on iOS and just about all of them support things like Dropbox sync.

A curses-based CLI for KeePass, KeePassC was just recently on HN: http://raymontag.github.io/keepassc/

Browser plugins saving me from having to copy/paste are a huge win in my opinion. Prevents me from accidentally copy/pasting things and makes for really nice login behavior.

I'll look at some of this tonight thanks!

Yes there is a plugin for Firefox. Don't know about the others.

Dashlane looks really promising. Does anyone here have experience with it? Does it work as smoothly everywhere as LastPass did?

I'm not affiliated with Dashlane in any manner but I thought I'd chime in with my experience as a user. I used to use LastPass but lost a bit of confidence in them when they asked users to reset their master password [1] when an anomaly was found present in network traffic from one of their DBs. Prior to this I was looking at open source alternatives but the syncing and add-ons for each browser (which made logging in and generating passwords easier offered by Dashlane) really caught my attention. These features aren't unique to Dashlane, I'm sure. New sign-ups reap the benefits of premium features for a month or so, then you could send an invite to a friend and accrue 6 free months of premium service when they sign up (which is what I did) for free. They also offer a public password generator [2] page. They support the major browsers (Safari, Chrome, Firefox). Dashlane also has a "security dashboard" which keeps track of password expiration, reuse, and weak password usage, with a base analysis score that gets presented to you when action on a site is required. If you want something for offline use and that is hardware based, I'd recommend checking out the Mooltipass [3]. I hope this helps.

[1] - https://www.duosecurity.com/blog/breaking-down-the-probable-... [2] - https://www.dashlane.com/password-generator [3] - http://www.themooltipass.com/

I'm a happy user of Mooltipass! Definitely a great alternative.

I used Dashlane at a previous company. It felt like a much buggier LastPass. I avoided it to the extent possible. Most of the problems seemed to be the usual non-standard HTML / Javascript hijinks breaking things but LastPass was pretty good at dealing with that whereas Dashlane seemed to get confused much more often. They may have improved since then. This was about a year ago.

I switched everyone from Lastpass to Dashlane some time ago. From my perspective it works better everywhere except Linux (where it doesn't exist). We currently use it across Windows/OSX/IOS.

It is more expensive than Lastpass, but this news suggests Lastpass was underpriced for a long time.

Dashlane works under Wine on Linux as long as you also have Firefox or Chrome installed under Wine. I copy and paste back and forth.

Big fan of Dashlane's 2FA with Authy. Really easy to share passwords securely around my organization too.

Not having a Linux client is a real miss though, I also kept Lastpass because the Linux integration is seamless.

Dashlane treats passwords shared with you as second-class - you can't access shared passwords in their web app. So I would avoid Dashlane if you're seeking a solution for your team.

I use Dashlane, it is better but is not quite there yet in terms of multi-user support.

Is is pretty OK. I've tried also other alternatives and so far Sticky Password does a great job with the WiFi sync and cheaper price.

So, use an open source one.

What Open Source one was a convenient or as feature complete? Serious I love LastPass and I use it for everything BUT my banking. I just install the plugin on any device or open the webpage and I am all set with all my passwords.

I don't know what features you like or find important. But you have to consider the licensing model as a feature when choosing your software. What happens if the software is sold or no longer maintained?

For me, I use a plaintext file in a Truecrypt archive because I'm a massive dweeb.

Truecrypt appears to be compromised.

http://www.zdnet.com/article/truecrypt-critical-flaws-reveal...

I don't use Windows and that exploit isn't relevant to my use-case anyway (requires an evil local user). I'll move to another encryption program sometime, but it hasn't been a priority.

You should be using VeraCrypt (https://veracrypt.codeplex.com/) rather than TrueCrypt. The authors of TrueCrypt even said to stop using it when they stopped maintaining it.

Yeah, I should. But Arch doesn't provide packages for it yet and there's no realistic attack vector against my usage of TrueCrypt, so meh. It's good enough until Arch starts shipping packages.

You can use Linux's own cryptsetup to mount TrueCrypt volumes. No TrueCrypt needed. There's documentation on the ArchWiki. https://wiki.archlinux.org/index.php/TrueCrypt

Cool, thanks!

https://aur.archlinux.org/packages/veracrypt/

Sure, but at that point, why is maintaining my own package better than just using Truecrypt?

I used Lastpass for random web passwords (everything except banking/shopping) but moved to 1Password, mainly because they could sync between desktop and mobile without using the cloud.

Pretty key to have high quality mobile apps. Another big use case is having my teams be able to share passwords.

Highly useful to be able to have access groups like "team" (everyone, things like Zendesk) "team-secure" (stuff with CC's, like Amazon), "dev" (general dev accounts), and "dev-secure" (compose.io access and the like).

Makes it way faster to onboard new folks, and when people leave, to cleanly strip access and change passwords.

The open source tools don't solve for those kinds of use cases, as far as I know. Just "I have one computer, and want to store my passwords on that one computer."

Sure, but now you're trusting your entire infrastructure to a black box which can be passed around to anyone with enough money. There are trade-offs, and you have to consider everything when comparing features, including the license.

Also, no way I would do anything important on my phone. These things seem to be about as secure as sieves.

We're looking for the exact same thing, mobile apps and team management.

I've yet to find any open source software that does team management. Even multiple open source tools that work together to create this functionality would be great.

Doesn't solve the mobile apps part but we run https://passopolis.com/, a continuation of Mitro (https://www.mitro.co/) that shutdown a couple of days ago.

The server and the chrome/firefox extensions that are opensource (https://github.com/WeAreWizards/passopolis-server, https://github.com/WeAreWizards/passopolis-extensions).

Right now it's mostly for us and other mitro escapees to continue using it so we didn't bother with the site design or the mobile apps. The exact feature you mention would be the first one to be done if we decide to monetize it though ! It would say opensource as well.

You could easily store KeePass database files on a network share. Create one file per access group, for instance. KeePass works pretty well with multiple database files (it has a simple tabbed interface when you do so and you can do things like color code the icons in the tabs). You can use network share permissions to make the database files read-only to particular users and KeePass will do the right thing with read-only files (mark it as read-only in the UI and disallow editing actions).

Reply on news.ycombinator.com