Hacker News Reader

Comment by hartator | Hacker News Reader

I still don’t get the value of using 1Password vs. using Chrome included solution. Anyone cares to explain?

As to OnePassword, I don’t know exactly. As to other password managers like LastPass and DashLane specifically against chrome built in...

- follow you around on encrypted cloud blob

- trusted machines you know you’ll log in from

- 2FA / MFA

- shareable passwords with friends/family

- works in all browsers

- works on mobile app / log in on any PC

- one time password access

- non-password things like door codes, software licenses, etc

- a lot more I’m just not thinking of I’m sure

At a more generalized level then some of the other replies: password and secure information management is a specific set of tasks and requirements that are orthogonal to web browsing. Abstracting that out into an independent piece of software makes it much easier to swap either side. It's much easier to jump from one web browser to any other web browser if there is no information transfer between them required. It's much easier to use multiple browsers simultaneously for the same reason. It's much easier to move from one password manager to another if that doesn't affect any other application that plugs into it at all. Decentralizing and fragmenting authentication and secure information is a problem.

Additionally dedicated problem programs tend to be more responsive and featureful then when the functionality is tacked on non-core in something else. Password managers facilitate sharing within groups and organizations for example in a secure and structured way. For many people that may be one of their most valuable features in fact, right down to the level of families.

I mean, this basic philosophy shows up a lot in computing right? For example, it's an important idea at least at the heart of some of the original Unix style of doing things, where you have lots of independent programs that do something well and then link them for more complex operations rather then everything-and-the-kitchen-sink. The latter has its place sometimes too but there are strengths to the former, or to programming styles that splits up larger systems into smaller tasks joined together.

1Password on mobile works well for mobile app passwords.

1Password also holds documents and notes; in my state, documents such as car insurance can be legally carried on your phone for traffic stops. I also have my health insurance cards in there for ease of use.

Plus, if you want to use multiple browsers across various operating systems you need your password manager to be browser independent.

> 1Password also holds documents and notes; in my state, documents such as car insurance can be legally carried on your phone for traffic stops. I also have my health insurance cards in there for ease of use.

I wouldn't rely on this because it turns your phone into a single point of failure (your battery could die or your phone could fail at the wrong time). Similarly, I would never rely on mobile wallets without physical cards as a backup.

Everything that isn’t in a browser? Mobile apps, SSH/OS, vpns, etc

The ability to give an emergency recovery key to my loved ones in a sealed envelope, and to save a note in 1P for them to read should anything terrible ever happen; that note tells them where to find my bank details^ (1P), various PINs to unlock my devices (1P), logins to my not-web-based email and web servers (1P).

I keep everything in 1P. Why carry around a library/health/gym/etc. card when you need the number once a week? 1P. Credit cards. Colour copies of my passport & licence. Backups of SSH keys. Passwords to sparsebundle disk images containing sensitive files. Loyalty program numbers & PINs.

It does so much that Chrome doesn’t. The iOS apps are magnificent. Their sync service is magnificent. I couldn’t live without it.

(^A friend of mine died a few years ago and we had a hell of a time figuring out where his finances were. Shit job. Don’t let that happen to your friends. Label your stuff in a password manager and make sure someone you trust has the key.)

Here’s what I just realised, while doing the washing-up. The people reading this are all capable of rolling their own solution or using some esoteric Unix-only MIT-licensed command line doohickey. That’s fine. Go for it.

Your family and friends, however, are not. They need advice. They need your advice. And your advice should be that they use 1Password.

* I don't always use Chrome

* I don't really trust Google too much

* I use passwords for non-web-based services routinely

* I share passwords for some accounts with my wife

* I like to be able to access my passwords anywhere I am

* I store credential-related secrets as well (such as security question answers, which I make up the answer to)

* Mobile sync.

* Non-browser passwords.

* Portable between browsers.

* Much better UX.

* Better password generation.

* Secure notes.

* Probably better security (both in terms of the crypto used, and in terms of what you need to do to view your passwords). Reasonable experts will disagree here.

Chrome is better than nothing. But 1Password (standalone) is better than Chrome.

I share a 1password vault with several coworkers, am issued a vault by a company I do contract work for, and have a 3rd vault shared with my family.

I'm fairly certain that scenario isn't possible with what any browser has.

For starters: not everyone uses Chrome.

No, but all major browsers have a solution for storing passwords.

Not everything is done through a browser though. And no browser exists natively on all the platforms I use.

I'm also not limited to just passwords.

all reasonable, but I think the post you're responding to is just widening the net of the original post of 1password vs chrome feature. the follow up was what about people who use a different browser which exposes a flaw in being too specific for the b case, and the follow up to that is just widening it to 1password vs web browser password storage. I didn't even take it as a defense of the b case, just an "okay, think of Edge/Safari/Firefox's password keeper instead"

It could also be added as a benefit for the 1password or other password management application side is that the passwords stored would be usable in all of those browsers whereas Chrome's would be locked in Chrome, Firefox's locked in Firefox, etc.

So the moral of the story, ignoring security in all (external vs browser) cases, if the specific browser is all you use, it is a fine password manager. The moment you go outside of that use case, the values flip quickly.

My point was that "not everyone uses Chrome" is not a good response to the question of 1Password vs just using the browser's password storage (which was the original question), because Chrome isn't the only browser that saves passwords. I wasn't making any judgement on using the browser vs 1Password, though I think some people interpreted my comment as such.

one of the big ones is 2FA OTP generation. when I am logging into my 2FA secured accounts, 1Password autofills my user/password, and then puts a OTP in my clipboard.

Reply on news.ycombinator.com