Hacker News Reader

Comment by SeriousM | Hacker News Reader

I'll stay with www.enpass.io . No need to have it running in chrome, support for windows, Linux and Android aaand it works offline without a subscription model. I can sync my enpass instances over multiple ways like Google drive, Dropbox, one drive, webdav or by my very own way to sync a single file. I use it now for 4 years and had never any problem with syncing or loosing a single password.

View on HN

I've been a satisfied 1Password customer for many years, and so far as I know, they have always supported the "bring your own" method for doing password database synchronization via some other cloud service. DropBox was the first obvious solution in this space, but they should work with any of the others.

And they've also always supported the local wifi-only solution, where you have to be on the same network, and physically authorize both devices to talk to each other, before they can sync the password database.

If enpass.io works for you, that's great. I'm glad you're happy with it. But this feature isn't unique to enpass.io.

Well, it's not unique to sync but different to 1password as my passwords were never on central server!

Neither are 1password’s if you don’t use their sync service.

And honestly your passwords aren’t on their servers. An encrypted blob is. Encrypted with a password only you know.

The problem is that same password is required in the web interface for administrative settings. And a web interface can always be compromised, as it can always inject some extra JS code in one of your sessions, without you having any way to verify that the JS blob you got served is the same you got the last time or that it’s the same blob that all the other users are getting.

This is actually an important attack vector and AgileBits themselves admitted the possibility. Imagine that a compromised HTTPS root certificate can open the door to a huge man-in-the-middle attack, which is totally within the reach of governments or of well funded crime syndicates.

Also the cloud sync is no longer optional. The standalone version is no longer available anywhere on their website and Google doesn’t help either.

At this point the standalone version is still available only for those in the know, being on life support probably to not piss old timers off. At least they are thinking about us, I’ll grant them that.

This is a fair point, but it's worth noting that the password you memorize and enter is only a part of the encryption key. There's another component -- I think they call it the "master key" -- which is generated locally when you set up your database and must be transferred out-of-band to other devices. It doesn't go over a network, not even a local one. So losing control of your password via the web interface still does not constitute a complete breach.

I'm very uneasy with how much astroturfing enpass has done in the past so I will stay far away from them. Track record means a lot when dealing with such sensitive information.

Could you give more information about your concerns?

1Password user here. I only use the manual sync option. And I use Resillo Sync to kept all my devices in sync... Which means, most of the time, it's only syncing on my local network. Works great, and was a one off cost, not subscription model.

The best thing about Enpass, in my opinion, is how they approach syncing. I don't want another cloud sync service in my life, I already use one that I like. Enpass is smart to let me use the service I already have instead of forcing me into their own service.

So does 1Password and it has done so for much longer than they have offered their own service.

What do you use for sync?

Google drive. That's what I use for my stuff and it's 2FA secured

Reply on news.ycombinator.com