Hacker News Reader

Comment by roymurdock | Hacker News Reader

Bit off topic, but I was searching for a better way to manage passwords a few weeks ago (rather than have 1 or 2 master passwords across all websites).

I found KeePass through an old ask HN thread. It's a great little free, open source key/password storage app that works across all my devices (iOS, macOS, windows). https://keepass.info/

I'd be interested to hear any suggestions for similar apps I could recommend to my parents, who expressed concerns about their online passwords. KeePass would be the ideal solution, but I don't think it would hold their hand through download, setup, and password generation enough to be 100% ideal. Any suggestions?

View on HN

Again, 1Password.

It allows you to login to multiple workspaces so you can have your family plan and your work team plan at the same time.

There is a cost but I can guarantee that it’s saved me more in time than the cost could ever amount to.

I’ve never used an insecure password since using it. All completely random and it’s so easy to use.

The different vaults means I can grant my little boy access to the stuff he uses whilst having my credit card and server details in other vaults without fear that he can access them (more the credit card details). I just need to get the wife into using it now...

I love 1Password and have used it for years.

But be aware that they are moving to cloud storage for password data. At this point, you're not forced in to it (and they've made no concrete announcement yet), but that's pretty clearly where they want to go.

Perhaps that's acceptable to you; I'll be moving off at that point. But in any case, it is something to be aware of when choosing something like this - moving between password managers is a hassle.

Have you read their security white paper[1]? As much as I tend to freak out about cloud storage of password data (one reason I moved off of lastpass), they do seem to take fairly strong steps to host-proof the data (such as having an on-device generated secret key that they never receive).

[1]: https://1password.com/files/1Password%20for%20Teams%20White%...

I did read it. For me, it doesn't matter for two reasons. Professionally, I have a policy to comply with. And personally, I don't use other peoples' machines for personal storage, period. So why would I want my (even well protected, assuming 1PW didn't make a mistake) passwords to be an exception?

From a legal perspective, once things enter the custody of a third party, your exclusive rights to that data are dramatically diminished.

Have a look at 1password.com and their family plan, so you can admin your parents too, in case they forget their master password. Can’t recommend this enough.

Edit: If that helps, Troy Hunt and other security guys are also using 1password (even the cloud solution).

Keepass works great, but one disadvantage is that you cannot you additional credentials providers if you want to open your database on other devices. For instance, if I would use a Yubikey provider, I cannot open the database on my iPhone.

It would be great if the authentication providers can be configured in an 'or' instead of an 'AND' (this means convenience vs security). So on Windows, with my Windows account or perhaps Hello it unlocks my Keepass database and perhaps use a Yubikey, but on my iPhone I'm still required to enter a password. But unfortunately, the current implementation combines the authentication providers to create a combined encryption key.

But still, Keepass is easy to setup and maintain. Just put your database on your favorite cloud provider (if you want to take the risk) or manually sync it to your phone and you got the righty credentials everywhere at hand.

One way to address this is to have a long term vault that doesn’t get edited often and a working vault.

I've used Lastpass for awhile, and so does my work. Recently I switched to Bitwarden partly because of security concerns, partly because it's open source, but mostly due to Firefox moving to WebExtensions.

They both have free options!

How recently? Because https://addons.mozilla.org/en-US/firefox/addon/lastpass-pass... shows "Compatible with Firefox 57+" since early November.

There was no compatibility when I switched, and I waited for some time (I use Nightly). Maybe "recent" is misleading.

Long time lastpass user recently switched to BitWarden. I find it's UI to be cleaner/easier to use

My biggest frustration with lastpass is that it doesn't seem to know the difference between subdomains, so it suggests several passwords for the same domain even though I am on different subdomains.

There was an option somewhere with which you could disable that one url at a time. I never bothered with it though and recently switched to keepass, so can't verify anymore.

How is BitWardens UX on mobile? Does it support autofill and automatically adding/updating passwords you enter on apps or the browser?

Just keep in mind anything simpler likely has additional attack surfaces. e.g. Anything that's cloud based, browser plug-in, centralized, etc. all bring the standard attack surfaces in that domain. Still, it's probably better than what most people do, same user name/password combo everywhere.

I'm a heavy KeePass user in private and I like it. Recently, I was pleasently surprised that my new corporate IT overlords allow me to use it at work too.

Password generation is fine. Whenever you create a new entry it prepopulates it with a generated password. Just type in domain and username and hit ok.

On the negative side, KeePass UI is old school. Lots of buttons and options. Not streamlined for the common use cases.

(No comment on download and setup, since I'm not a Windows user)

Actually, I’m pretty happy with the integrated iOS password manager. They also feature app support now. Works like a charm for me

Happily, too, Safari’s suggested passwords have pretty good entropy and are sensible enough to be accepted by many password rulesets.

I was looking at Dashlane which seemed to have some good features, including some ability to do password rotation automatically, and some level of yubikey support. That said I'm still using keepass. I discovered it when I needed a solution that worked on an original Surface RT, as well as an iphone, and I've remained happy.

Now Dashlane seems to have in browser apps and finally supports Linux, I'm looking at moving away from Lastpass.

Between them and BitWarden there seems to be quite good options form Linux users now.

If anyone is a DashLane/BitWarden user and wants to chime in with their experience them that would be much appreciated.

I love Dashlane, and the Linux support is solid through the browser extension. Dashlane has the best interface across devices, of all the password managers I've used. The password sharing feature is great for business.

Sure, it's a cloud service, but it's polished enough that I can get non-tech people like my family and coworkers to actually use it. Lastpass did not pass that test.

I use Dashlane every day on Mac, Linux, Windows, and Android.

Thanks. One question I have - can you turn off auto-login globally or just on a per website basis? Docs seem to imply on a per site basis only but that seems a bit odd.

I'm wondering how DashLane handles multiple logins for the same service (Google/GitHub etc etc).

I'm not sure about the global option, I've never tried.

For multiple logins on the same service/domain, it presents a clickable/tappable list.

Hello and thank you for your comment. I am Thibault, from Dashlane's User Support team

If you mean having several accounts for the same service (aka. Google/Github), then yes. All you will need to do is create a Dashlane "credential" (id+password) per account.

If you mean Federated sign-ins (such as this one https://i.imgur.com/se5toyn.png), then it should be possible as long as the button opens a browser window on the right domain (Facebook, Google, etc).

Please don't hesitate to contact us directly through our Help Center if you have other questions about Dashlane !

https://support.dashlane.com/hc/en-us/requests/new

Kind regards,

Thibault Dashlane Customer Support

Been using (and paying for) Dashlane for a couple years now. I love it. The things I like the most:

1. Supports TouchID on my newer MacBook. 2. Supports generating OTP's, stored alongside the credentials.

Not sure if the competitors have these also. In general though, I've been a super happy Dashlane user.

Hello,

Thanks for your message. I am Thibault, from Dahslane's User Support team, and am here to provide you with a bit of information.

Here are a few things to know about Dashlane!

* Dashlane does integrate with Yubikeys for Two-factor Authentication. All keys are compatible except for "FIDO U2F Special SECURITY KEY". Please see this link http://bit.ly/2FnNxka for more information on the subject

* Dashlane has been consistently rated the easiest password manager to use, which is extremely important since the last thing you want is a headache every time you’re trying to store or access your passwords. Don’t just take our word for it - Dashlane has over 50,000 5-star reviews.

* Dashlane is the only password manager with a U.S. patent for its security architecture. And your Master Password is never stored on our servers. Never!

* Dashlane’s auto-fill technology, which reads the fields on the page to store or enter data on your behalf, is the most accurate auto-fill in the industry. We’ve benchmarked our auto-fill tech against the competition and have found Dashlane is up to 40% more accurate than other password managers.

* Dashlane invented Password Changer and is the only Password Manager that allows you to change up to 500 passwords in seconds without ever leaving the Dashlane app.

* Dashlane’s VIP customer support is the best in the industry. Super-quick response times, availability via live chat, and premium support keep our customers happy.

You can check out our great review in the New York Times by following this link : http://nyti.ms/2CCUGKr. You will also find Dashlane in first position of PCMag's list of Best Password Managers for 2017 here : http://bit.ly/2BIdv1S.

Please note that although we propose the Password Changer feature, the automatic rotation is yet to be developed. I will pass you request down to the Development team for further consideration.

I confirm you Dashlane is indeed compatible with iOS devices, and you can access your Dashlane account trough the Web App with your Surface RT!

If I can be of any further help, please let me know!

Kind regards,

Thibault Dashlane Customer Support

I've tried to get my mom to use KeePass with limited success. To her having her easily guessable passwords written in a little notebook next to the computer is fine.

I think a prerequisite is getting buy in on the idea that passwords need to be treated like the keys to your house or your bank account numbers.

As far as I'm concerned writing passwords in a notebook in a draw or something is fine. The easily guessable part not so much. If someone has physical access to your computer in the first place there's lots of things they could do.

The Firefox password manager, combined with Firefox Sync, works across Windows, Mac, Linux, iOS, and Android.

Been using this a few years, it's really good from user standpoint.

1Password is fantastic.

Algorithmic password in your head, with a google spreadsheet to keep track of usernames, password rules, etc. on a per site basis (i.e. "bankofamerica, ythn.smith@gmail.com, 4-12 characters - no special).

Edit: downvote away, but so far no one has ever been able to give a compelling reason why algorithmic passwords are bad. It has tradeoffs, sure, but so do password managers.

If a couple of your algorithmic passwords get leaked, attached to same email, then the algo could be guessed and you potentially lost all your accounts.

That's a lot of unlikely ifs. And that also assumes my algo is easy to reverse from 2 digests. My counter to that is that it is unlikely anyone would specifically target me and waste resources trying to crack my algorithm when there is so much low hanging fruit elsewhere. If I am specifically being targeted, I've probably already lost, even if I use a PW manager.

Compare to PW managers: "If your password db and master password get leaked, attached to the same email, then you lost all your accounts." Also with PW manager, losing your phone can mean Denial-of-Service to all of your accounts if you are i.e. travelling.

Other methods being poorer doesn't make your method objectively better. You're probably right on low-hanging fruit, all depends on your threat model I suppose.

Don't password managers have 2FA, and alternate phone numbers?

There is no method that is objectively best. Every single current method has tradeoffs. Being cumbersome to setup/use/recover is a big tradeoff of PW Managers.

I don't trust myself enough to keep track of a local database of passwords, because of that for years I sticked to the tactic of repeating the same 2~3 passwords over and over on all websites.

Now I'm using https://lesspass.com/, a deterministic password generator that requires no setup besides installing a browser extension[1] and doesn't requires me to keep a database or run any other custom programs.

[1]: There's the official extension for all browsers, but I've developed my own, https://lesspass.alhur.es/, which solves 99% of the problems associated with the whole LessPass idea.

How does lesspass handle password rules?

i.e. one site allows special characters, others don't?

Or say one of your passwords gets compromised and you need to change it.

It doesn't seem like lesspass would be able to do so without a db.

I've been trialing it recently on sites of lesser importance, and in the configuration OP described, it doesn't - everything is deterministic from login+site+master password.

It does however you set password profiles, which alter how the password is generated. Here's an abridged example from their FAQ[0] with my notes about what each option does:

    "login": "contact@lesspass.com", # User name
    "site": "example.org",           # Domain name
    "lowercase": false,    # Site accepts lower case characters (Default: true)
    "uppercase": false,    # Site accepts upper case characters (Default: true)
    "symbols": false,      # Site accepts symbols (Default: true)
    "numbers": true,       # Site accepts numbers (Default: true)
    "counter": 1,    # Increment e.g. on compromise and the generated password is changed  (Default: 1)
                     # Password entropy is derived from pbkdf2, counter is used as part of the salt
    "length": 8,     # Password length to be generated (Default: 16)

In the default configuration, these profiles are stored in the browser's local storage, so lost if/when that is cleared. LessPass provide a service to store these profiles on their server (log-in is generated from the master password using a default password profile), and provide the scripts (Docker) that let you self-host this data (the browser extensions include a field to set server domain).

For me, it's a useful balance of convenience and security (each site gets a strong unique password, but I can regenerated them on devices where I haven't synced a password DB) vs. KeyPass which I was previously using.

I'm probably going to switch to 1Password thought - it gives the same "any device" benefits, has basically the same risk model (compromise of the master password is a full-compromise, and because I need the synced profiles I need to put _some_ trust in a third-party anyway[1]), but it gives me the full flexibility of a real password manager (store associated data, credit cards, set specific passwords if needed etc.)

[0] https://github.com/lesspass/lesspass/wiki/FAQ [1] 1Password: need to trust their client isn't malicious/capturing the password at login and is secure; LessPass: need to trust the webclient is never changed to exfil. the master password, (theoretical?) risk of brute-forcing master password from a generated password, and sends sites/username metadata to a largely unknown third party (could run my own server, but it would likely get neglected and fall behind on security updates etc.).

Reply on news.ycombinator.com