Hacker News Reader

Comment by Blackthorn | Hacker News Reader

Sigh. I can't ignore the red flags anymore. Time to switch off.

Is there anything automatic out there? I'm not going to use program+dropbox/cloud-provider. I need something like lastpass.

Don't suppose there's anything out there that can import the lastpass db?

View on HN

If you're open to a paid option, 1Password for Teams/Families a good one. You can transfer from LastPass via CSV (https://support.1password.com/import-lastpass/).

I felt like they weren't above board previously with pricing. It wasn't fraud but IIRC prices got a big jump that was timed to be in combination with some kind of defacto mandatory upgrade. It had a bait and switch feel to it and at the time the family price across multiple devices seemed too high.

I'm still on 4.* which was a 1 time fee. I never felt like I was forced to upgrade.

That's cool, but the problem is most software is not safe to use unless it's actively maintained and offering updates from at least a security perspective.

So I don't consider that a realistic approach for most people, especially for something as mission critical as password management.

You just can't really expect proprietary software to be actively maintained indefinitely for a one-time fee. Add to the financial (and ego-) incentives to downplay security issues, I really don't think people should consider anything but open source password managers.

I bought 1Password for Mac and 1Password for iOS in 2013, have paid nothing since and use the current versions. I don't save passwords to their cloud (I use Dropbox, including sharing a vault with my spouse), maybe I would have to start paying a subscription for that.

So I just did this. Have to say that I really didn't feel comfortable with the unencrypted CSV data transfer. I made sure that time machine doesn't index it, but accessing this file in the time window needed to export/import seems like a prime attack vector to me.

Are you using 1Password's cloud sync or the older Dropbox/iCloud/other method? (Really curious about all 1Password users in this thread)

I've read a lot of reviews but many predate 1Password's cloud option.

I use their cloud sync and love it. One of the few subscription services I pay for. I also use the browser extension, which others have pointed out might not be the best, but I think it's better than one to five universal easy to guess passwords I was using before. I have it on Windows, Mac and Android and it syncs seamlessly.

Been using 1P since version 4 or so and syncing with Dropbox. It works really well and I'm quite satisfied with how quickly they resolve issues (especially security related ones)

I recently switched to 1pass, it's much better

I have 1password 4.6 and love it.

I switched from Keepass to Enpass a while ago (enpass.io). It does use 3rd party cloud accounts for synchronization, but it's fully integrated into the apps.

Has android/ios/blackberry/windows mobile clients, desktop clients for mac/win/linux/chromebook (including portable versions), and browser addons. It's not a subscription service---the desktop versions are free, and the mobile versions cost a 1-time purchase to unlock all the features. I'm very happy with it.

passwordstore.org is good if you're a nerd. It's built on standard linux tools: pwgen, gnupg, git. QTPass is a QT based multi-platform desktop gui version. That helps if you're not in the mood to be a nerd today. Android Password Store is the mobile version and integrates with Android chrome/chromium. Thanks to gnupg, pass also works in conjunction with smartcards like Yubikeys. Open Keychain on android allows you to use a Yubikey Neo with Android Password Store. PassFF is the Firefox plugin.

Usage: It's a git repo with passwords stored in encrypted text files. Syncing is done by push/pull the git repo. Since it is git, you have a record of every password you ever generated. Unlocking a password with a Yubikey requires a pin entry and a physical touch. Once entered, the key is available for further passwords without pin, but a Yubikey 4 can be configured to require a touch every time if you're worried about compromised hardware stealing your entire password database.

There's no import from other managers that I'm aware of, but it might exist. Googling stuff about 'pass' is tedious. Google for 'zx2c4 pass' and you'll have better results.

Does using PGP make it any safer than, say, simple password-based SHA-512 encryption?

It does. Using PGP in conjunction with a Yubikey means even if someone obtains your password repo, they still can't get in without your physical private key. Without using a Yubikey, an attacker would still need to obtain the private key. They couldn't just grab the vault from the cloud store and start running offline password cracking on it.

How do you encrypt using a hash function?...

While it can be done (use the secure hash to generate a key stream--but first google it because I bet there are some pitfalls to keep an eye on), I assume that the parent poster meant to indicate a symmetric encryption algorithm like AES (as opposed to asymmetric PGP), instead of a hash algorithm like SHA.

I use bitwarden. It's open source and works in browser and on phone. I haven't done any auditing myself, so I guess it's a leap of faith in that regard, but it's working great thus far.

It can import from a lastpass file.

Even though it's open source, there is a hosted instance (so the experience is much like lastpass). There was a kickstarter a while back that failed though, so I'm unsure how it's funded.

> There was a kickstarter a while back that failed though, so I'm unsure how it's funded.

The lead developer answered that here:

https://news.ycombinator.com/item?id=13926031

Keepass imports from Lastpass [0]. Not that meets the rest of your requirements, but Keepass + KeepassHttp + PassIFox work beautifully for me.

Autofills my logins and fully integrates with Firefoxes password manager so that you don't get conflicts between the browser and your password manager trying to save the same password. Also doesn't add the stupid CSS hacking that LastPass does to add their logo into the password fields breaking various site's styles.

  [0]: http://keepass.info/help/base/importexport.html

Keepass has lots of red flags for me:

- No https on site

- Update file hosted via http (not https)

- Downloads via sourceforge which has injected adware in downloads before

- FAQ downplays lack of constant time comparison instead of using constant time comparisons and being extra safe

- You have to cobble together multiple apps from multiple developers to get a full working solution; means you have to trust lots of individual entities

That being said I can hardly defend staying on Lastpass anymore.

I just wish 1Pass was crossplatform so there was a clear universal winner!

Got a link to that FAQ thing? I find downplaying of potential security issues a rather important red flag.

The https thing is unfortunate and should be fixed, but I've always got my KeepassX from a signed repo.

The cobbling together is also an important part of its strengths. In particular I want the sync of the encrypted DB to be decoupled from the app that decrypts and manages the password entry into forms (the latter being yet another entity, btw).

I'm really curious to see that FAQ entry! Because I can't imagine a scenario where timing sidechannel attacks would be relevant to a password manager app (provided the sync is decoupled, which is one reason why that's so important). If you're gonna bruteforce the master key, you'll use an external program any way, so constant time comparisons in Keepass's routines shouldn't matter? Also it's not like you could remotely trigger Keepass to decrypt 1000s of times in order to glean info from timing data, because it's not a browser plugin. Which is one of the reasons why we don't want our password manager to be a browser plugin. Again, decoupling is a strength.

- No https, agree, its a very old site, but it's not sensitive material that you're submitting. You can check the integrity of the download [0]

- Sourceforge, again not ideal but again it has very old beginnings from when Sourceforge was as respected as Github is. You can't blame the developer for the environment changing. Perhaps they're just a stickler for loyalty. I've never had any crapware with Keepass

- FAQ - I could't find your reference in the FAQ page [1]

- You have one app + plugin with a browser extension from two developers, hardly a mishmash. You know directly who those two developers are. You've no idea who was working on LastPass. I'd say it was more in the bazaar philosophy vs the LastPass cathedral.

  [0]: http://keepass.info/integrity.html
  [1]: http://keepass.info/help/base/faq_tech.html

You can download the file via https [0], this is what the Chocolatey package does [1]

  [0]: https://sourceforge.net/projects/keepass/files/KeePass%202.x/2.35/KeePass-2.35-Setup.exe
  [1]: https://chocolatey.org/packages/keepass

Sounds interesting, but requires a password program, a 3rd party plugin for the program, and a browser plugin... and yet another app to do cloud sync like Dropbox.

Sounds like a huge pain compared to LastPass, as well as increasing attack surface.

LastPass is a Cloud password program + browser plugin

So the extra layer is the plugin that is written by the same developer as the browser plugin. Which is a drop in plugin.

It's all open source so it's much easier for people to check the vulnerabilities. It's also easier to raise issues and other people to help fix them.

Separately Keepass is an offline database, so you have total control over access to it. The overhead of course is using something like Dropbox, plus probably Boxcryptor to ensure it's encrypted before it gets to Dropbox.

I've commented elsewhere here - it's similar to the Keepass bazaar vs the LastPass cathedral. Keepass might look uglier, but I trust it more.

It kinda is. I just dropped the database on my Nextcloud instance though, which has so far not suddenly caught fire.

Clickable: http://keepass.info/help/base/importexport.html

For using with FF, I'd recommend KeeFox.

Dashlane does! Been using it for a year or so. Good experience.

https://csdashlane.zendesk.com/hc/en-us/articles/202699141-H...

I switched away from Dashlane after several years because their software has been getting progressively more unstable. Force-killing the Dashlane executable because the browser plugin has locked up got pretty old.

I love Dashlane, it's pretty magical and a massive timesaver. I use it on OSX primarily but it syncs to my Android very well.

There's an unfixed bug in the OSX client where it crashes rarely (every couple months for me) and I have to kill the process manually and restart, but it has very minor impact.

Is there any security analysis or consensus on Dashlane security vs. other password managers?

I have this problem every couple weeks as well. Killing DashlaneMASService solves it.

I will fully investigate Dashlane. I turned a lot of my non-technical friends onto password managers, and will need to update my recommendation for them with something that can both import the LastPass DB and be as convenient to use.

See the beauty of using program + cloud-provider is that all the cloud provider sees is an encrypted file. If one were to gain access to my Google Drive they would still have to crack an encrypted file which will take a while.

I feel like with lastpass the attack vector is bigger with all the fancy features.

It's encrypted on the lastpass "cloud" too. The point of it being integrated is the user doesn't have to take action to download the encrypted DB; the software does it for you.

But you don't want the software that is capable of decrypting the DB to also be responsible for uploading to a fixed cloud service!

> Don't suppose there's anything out there that can import the lastpass db?

Padlock does: https://padlock.io/howto/lastpass/

Disclaimer: I'm the developer

Check out 1Password.

Reply on news.ycombinator.com