Hacker News Reader

Comment by coldpie | Hacker News Reader

So, use an open source one.

Pretty key to have high quality mobile apps. Another big use case is having my teams be able to share passwords.

Highly useful to be able to have access groups like "team" (everyone, things like Zendesk) "team-secure" (stuff with CC's, like Amazon), "dev" (general dev accounts), and "dev-secure" (compose.io access and the like).

Makes it way faster to onboard new folks, and when people leave, to cleanly strip access and change passwords.

The open source tools don't solve for those kinds of use cases, as far as I know. Just "I have one computer, and want to store my passwords on that one computer."

Sure, but now you're trusting your entire infrastructure to a black box which can be passed around to anyone with enough money. There are trade-offs, and you have to consider everything when comparing features, including the license.

Also, no way I would do anything important on my phone. These things seem to be about as secure as sieves.

We're looking for the exact same thing, mobile apps and team management.

I've yet to find any open source software that does team management. Even multiple open source tools that work together to create this functionality would be great.

Doesn't solve the mobile apps part but we run https://passopolis.com/, a continuation of Mitro (https://www.mitro.co/) that shutdown a couple of days ago.

The server and the chrome/firefox extensions that are opensource (https://github.com/WeAreWizards/passopolis-server, https://github.com/WeAreWizards/passopolis-extensions).

Right now it's mostly for us and other mitro escapees to continue using it so we didn't bother with the site design or the mobile apps. The exact feature you mention would be the first one to be done if we decide to monetize it though ! It would say opensource as well.

You could easily store KeePass database files on a network share. Create one file per access group, for instance. KeePass works pretty well with multiple database files (it has a simple tabbed interface when you do so and you can do things like color code the icons in the tabs). You can use network share permissions to make the database files read-only to particular users and KeePass will do the right thing with read-only files (mark it as read-only in the UI and disallow editing actions).

What Open Source one was a convenient or as feature complete? Serious I love LastPass and I use it for everything BUT my banking. I just install the plugin on any device or open the webpage and I am all set with all my passwords.

I don't know what features you like or find important. But you have to consider the licensing model as a feature when choosing your software. What happens if the software is sold or no longer maintained?

For me, I use a plaintext file in a Truecrypt archive because I'm a massive dweeb.

Truecrypt appears to be compromised.

http://www.zdnet.com/article/truecrypt-critical-flaws-reveal...

I don't use Windows and that exploit isn't relevant to my use-case anyway (requires an evil local user). I'll move to another encryption program sometime, but it hasn't been a priority.

You should be using VeraCrypt (https://veracrypt.codeplex.com/) rather than TrueCrypt. The authors of TrueCrypt even said to stop using it when they stopped maintaining it.

Yeah, I should. But Arch doesn't provide packages for it yet and there's no realistic attack vector against my usage of TrueCrypt, so meh. It's good enough until Arch starts shipping packages.

You can use Linux's own cryptsetup to mount TrueCrypt volumes. No TrueCrypt needed. There's documentation on the ArchWiki. https://wiki.archlinux.org/index.php/TrueCrypt

Cool, thanks!

https://aur.archlinux.org/packages/veracrypt/

Sure, but at that point, why is maintaining my own package better than just using Truecrypt?

I used Lastpass for random web passwords (everything except banking/shopping) but moved to 1Password, mainly because they could sync between desktop and mobile without using the cloud.

Reply on news.ycombinator.com