Comment by brandur | Hacker News Reader

Comment by brandur | Hacker News Reader

Parent Full thread

Completely agree.

I personally have no problem using commercial software, but my password manager is one place where I suspect that I should be moving to open source in case I don't want to renew my license over some future pricing disagreement, and I lose access to some of my critically important property (passwords).

It's tempting to think that we'll be able to keep our currently purchased standalone licenses in perpetuity, but I've already been dragged through at least one major version upgrade of 1Password to keep pace with new OS developments (for OS X and iOS). There were no new features that I needed or even wanted, but I paid the $50 (or whatever it was, I notice a new license is now $64.99!) anyway to maintain compatibility.

Unfortunately, the landscape for open source alternatives doesn't seem particularly good. Some of those mentioned here like Keepass [1] look like they're usable, but are quite a far shot from 1Password's quality.

[1] http://keepass.info/

In another comment I mentioned these 3 KeePass ports:

[1] https://keeweb.info/

[2] http://keepass2android.codeplex.com/

[3] https://minikeepass.github.io/

I'm a former 1Password user and these work fine. The Android app is actually better than 1Password, and KeeWeb is better for me because it works on Linux as well and it gives me a full history of all edits (not just the password field). Plus being just one file, it is also easier to go back in time using Dropbox's version history.

What you'll miss is the fancy browser extension, but for me that's fine, because a browser extension represents a huge security risk, and selecting a field in KeeWeb is painless as it has keyboard shortcuts. 1Password also has the capability for local network Wifi sync, which is really cool, but at least in my opinion they are moving away from this model and that feature will be gone.

So you'd rather copy and paste passwords because KeePass doesn't have browser extensions? No, thanks. How are extensions security risks? You still need to enter your master password to decrypt passwords. And extensions are siloed by the browser.

For example, Lastpass recently had an exploit in their extension: https://news.ycombinator.com/item?id=12171547

I see nothing wrong with copy/paste. On Android it is a security risk, because apps can get notified and wake up when it happens, but Keepass2Android that I mentioned provides a keyboard for input which works better than 1Password.

And on desktops, I just don't think it's a real threat. Bruce Schneider doesn't thinks so either, while at the same time he recommends against auto-fill: https://www.schneier.com/blog/archives/2014/09/security_of_p...

But even so, KeeWeb and KeePass give you this "auto-type" facility that types the password for you in any password field, without going through copy/paste. It's not much, but it works if you're worried.

There are browser extensions that interface with KeePass to do what you are asking.

I don't use them, I simply use KeePass' autotype feature.

I'd like to see websites make copy/paste easier by allowing you to enter user name and password in a combined field. Have separate fields that can be used the normal way, but also allow submission with the username field left blank and the password field containing username:password.

The fancy browser extensions are important in protecting you from phishing. They will refuse to fill in your password unless the domain matches exactly.

Reply on news.ycombinator.com