Hacker News Reader

Comment by dwg | Hacker News Reader

What differentiates RememBear from other password managers? After looking through the blog and website it's not immediately clear to me. What makes (or will make) RememBear better than, say, 1password, which appears to have the same features, is also easy to use, and has a long history with which to work out issues?

View on HN

I disagree that 1Password is easy to use. It’s easy enough for me to use, but trying to get my parents through the setup and UI has not been an easy task. It could be far more simple and straightforward.

I would like to see a version of 1Password that 1) did only passwords - no fishing licenses and secure notes, which adds UX complexity 2) did not distinguish between passwords and logins, which causes endless confusion for my users 3) knew and managed the text requirements for the top 1000 websites so the app could generate legitimate passwords and not ask users to manage password complexity

Ohh I like the idea of knowing the password requirements for the top 1000 websites!

Would it be wrong to wish this could (or should?) be standardized? That is, for example, one upper case letter, same special characters, etc. The lack of a standard seems to hurts users more than hackers. The hackers know it and adjust. User just get confused and default to overly simplistic and common PWs.

There should be a "robot.txt" for passwords. ie: /password.txt

This file could define the accepted password format. Password managers could retrieve that file and know exactly how to generate a password.

no. if you're going to go through the trouble to do that, just fix your bullshit broken fucking password requirements.

The password - as currently implemented - is a fax machine (read: dated technology). Anyone reasonable sees it's far from ideal. Yet there seems to be little _significant_ innovation on solving this problem with something better.

I can order a pizza via Twitter, but I'm still using passwords?

NIST recently updated their standard guidance to no specific characteristics requirements, just long and unique. But no doubt it will take a while to trickle down to many websites that they don’t need this craziness any more.

Many such efforts exist, but getting universal consensus let alone adoption isn't easy.

What if there were a protocol for password management, such that you never had to use a signup form again? Kind of like OAuth, but for a password generator/manager. It would support password changing (with an e-mail confirmation), so that it would be extremely easy for people to convert from manually managed passwords to automatically managed.

Stupid awful password requirements are terrible (an upper case character, lowercase, number, symbol, also no spaces or colons or commas or semicolons or quotes) but the variance does serve to force people to not use the same password for every site.

Such a protocol would be a great place to encode the user-facing aspects of NIST's recommendations.

This would be quite hard to maintain.

Instead they could create a "password complexity requirement specification" to allow sites to embed a universally machine readable description of their requirements, which all password managers and users could benefit from. I don't know if any such effort exists already.

Quite. I have stopped recommending 1Password to non technical family and friends. Not one of them ever managed to figure it out for themselves, so I had to run through it with them on their PCs, Macs, iPads and phones. Then they forgot how to use it, and none of them continued with it. Then I had to remind them to cancel their subscriptions —- most would have continued for life paying but not using.

Many ordinary people have no idea whatsoever of the relationships between clients and servers, and less still of that between different clients (what is a web app? Is gmail my search engine?). Throw in an interposing piece of software that not only manages but duplicates login credentials for these various mysterious entities, and they are completely and utterly despondent, hopeless and lost.

1password could be improved to be sure, but looking at RememBear didn't give me the impression they are competing on ease-of-use as compared to 1password. The UI is pretty similar.

I feel the company's modus operandi is to have easy and cute UX to simplify using security tools.

Their VPN software is apparently very easy to use (from reddit comments). The same will probably apply to the password manager. They also seem to have a good marketing and PR team since I see them around quite a bit in youtube videos (Linus' being the most prominent one) and ads thinly veiled as articles. These two points alone have the ability to make the difficult mainstream user market to use it.

If all your security tools had similar UX and only a single login (what we see as single point of failure is usually seen as convenience), then you'll get many people to use it.

I use TunnelBear, and I can say it works beautifully. It really is just turn on, turn off.

But it does not work very well. Often it does not connect at all, is very slow, and it blocks many things like TeamSpeak and torrents, for example.

That's probably true...

I use it for very basic things, so I guess I wouldn't know.

Their Bearanding

This isn’t Reddit.

Reply on news.ycombinator.com