> I recommend 1Password, and there's currently no other commercial password manager that I recommend.
Are there any open source password manager products that you would recommend?
Are there any open source password manager products that you would recommend?
It bothers me when people point to other password managers as alternatives to 1Password because of packaging and pricing issues. It's easy to find other commercial password managers that have attractive packaging and pricing! That's not the hard part!
I happen to like 1Password as a product, but that's not why I recommend it.
What I can see is that 1Password is pushing users towards a model that's fundamentally insecure. Their web-based products require a level of trust in 1Password (the company) that none of us should be willing to place in any company. What we've learned from Snowden is that any cloud provider can be secretly made to bend to their governing body's will. Running closed-source software on our own computers involves a level of trust in the authors of that software. That's just a fact of life when software isn't open source. But when code is pushed out into the world, it can, at least, undergo some scrutiny/testing by people outside the company. This is not true of software running on the company's servers. In so much as the security of 1Password requires executing a single, line of code on servers controlled by 1Password, the product is insecure and fundamentally unauditable because that line of code can be changed at any time without users being made aware.
The other point that should probably not get lost is that we're dealing with levels of security. In advocating for password managers, the interface absolutely does matter. Most computer users haven't adopted any password manager yet. When comparing a secure but difficult to use password manager, a potentially insecure password manager with an easy-to-use UI and a combination of insecure passwords, post-it notes and all the other terrible ways that users have of "managing" their passwords, the middle ground is likely to come out ahead for all but the most technically adept users. Need proof? PGP/GPG passes security reviews but has terrible UIs...what percent of emails are PGP/GPG encrypted? We shouldn't let the perfect be the enemy of the good. There can be different classes of security products for those that need protection from state-level actors and those that don't. Because people who are worried about that level of attack are generally willing to undergo a lot more pain to stay secure than your average user is.
I'd really like to know this as well.
I'm aware that LastPass doesn't have a perfect security record, but because of its prominence it gets lots of attention from hackers and security researchers, security issues tend to be well-reported, and the responses to them seem to be reasonably transparent and proactive.
In contrast, Enpass appears to be a side-project of a small app development house in India. Did a miss a memo where Security Expert X said Enpass is better than LastPass?
1Password is an incredibly complex, solid and polished suite of software products that provides an essential security function. It absolutely boggles the mind that people get up in arms over the idea that they would be forced to pay $36 each year to use it.
It boggles my mind that people are so quick to support a company that's making changes solely for their own benefit to the detriment of their customers. I want AgileBits to succeed too. That's why I bought the software despite having access to a license from work. But try this for math...if they release a major update to their software every year and charge, say, $36 to update, it costs the same exact amount to stay on the latest version. As a bonus to them, they get the money all up-front and get to collect what little interest you can get these days. The main difference is that I don't have to worry about their company imploding and taking all my passwords with it. My software will work in perpetuity without any cloud service they provide. That's piece of mind that I need when it comes to my passwords.
I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.
+ kpcli for TTY use, keepassdroid for android, sync to owncloud, voila.
If you are extra concerned with security after storing your file remotely, you can have it use an addtional external keyfile in addition to the which you manually copy to 'authorize' devices
How has your experience with it so far?
Other than that it has better gui if that is your thing (Keepass is ugly). It is mostly a fork of keepassx which is still usable but KeepassXC merged all pull requests and fixed a load of bugs in keepassx after the maintainer stopped maintaining. Try it. It works. It also has mutilple releases (snap, appimage etc.).
I can't yet wean myself off of LastPass though, just because it's synced everywhere and is more reliable when doing form fills on websites. For example, KeePass and its variants don't have a concept of equivalent domains. For "equivalent domains" I should be prompted with the same lists of auto-fillable credentials, such as:
* youtube.com/google.com/gmail.com
* bing.com/hotmail.com/live.com/microsoft.com/msn.com/passport.net/windows.com
* apple.com/icloud.com
LastPass gets this right, but I sadly haven't seen any other password manager that does. I think there's an open issue with KeePassXC to address this but it's not merged or production ready.
The problem is that they can't deviate from the official KeePass database format, so adding something like aliases requires hacks like the above.
KeePassXC doesn't support KDBX yet, but they'r working on it[2].
It is absolutely rock solid.
I'm not sure that KeepassXC can be considered unmaintained - their last release was in June, this year - https://keepassxc.org/blog/ . Also note the monthly tone of the updates - even the koolist of kool dev kids kant complain that is slow 8)
My favorite thing about it is that it uses standard tools I understand, and I can back it up and version it with git.
I recommend website-based password managers to my non-technical friends because they're easiest to use and therefore most likely to actually BE used, and the security vulnerabilities noted in the article are very small compared to not using a password manager at all.
The DOD defines software commerce as anything available to the public and used for any non-government purposes.
http://dodcio.defense.gov/Open-Source-Software-FAQ/#Q:_Is_op...
So to take your comment one step further, for some organizations, the definition of commercial also has nothing to do with whether you sell it or give it away for free, even though many people reasonably assume commerce==sales.
I've been working on the marketing a bit, and the sense I get in this space is that, like home security, password security is a series of trade-offs. One size doesn't fit all; different situations require different needs, and everyone tries to balance the safety they want to feel with convenience that they desire.
So, in our case, there are a couple of good options. You could operate on a hosted service and get the cloud-based benefits without needing to worry about infrastructure or updates, or you could self-host and trade a bit of hassle in exchange for trusting the host and verifying that the updates will do what they say they're going to do.
[0]: http://passit.io