Hacker News Reader

Comment by 2T1Qka0rEiPr | Hacker News Reader

I have such great respect for Troy and all the work he's done/is continuing to do to promote good security practices. I just went on HIPB though and noticed the advise for better security is "use 1Password" (after checking your email for compromises).

This just seems a little too commercial to me and I'm not sure I like the phrasing. I fully understand the need for Troy to be sponsored and it's great that 1Password works well with his tooling, but it's not the only solution. I'd feel a little less uneasy if it was phrased in such a way as "Use a password manager, like 1Password".

View on HN

Right on the HIBP page, it says "Why 1Passsword?" where you can read his reasoning for why he recommends the service. You, as an informed consumer, are free to research the things you find in that link, like "what is a password manager?", and decide whether to accept his recommendation or not.

What, precisely, makes you uneasy that he advocates the product of a particular company that he has experience with, trusts, and discloses as having a partnership?

Good response. Specifically I was objecting to this response after submitting your email address - https://imgur.com/toJaSYW. It's not clearly an advert, but also feels a little too commercial for the average user who's probably just been sent the HIBP link but isn't necessarily technical.

This. I am using LastPass for example, because it is probably only password manager, where you can completely disable auto-fill (you need to click on an input field and then pick a profile - so it is "on demand" fill) which makes automatic harvesting attacks much harder. I have switched from 1Password exactly for that reason - 1Password is very aggressive in filling input fields for you.

The most 1Password has ever done (in my experience) is submit after I select the login to use, even on sites with only one login. I disabled that aspect, and I always have to toggle the helper via ctrl/cmd-\. It has never pre-filled a login field without me asking it to, and that's across v4, v5, v6, and v7.

LastPass have a horrible security track record.

I’ve even caught them editing their wiki page, trying to erase their past, which was reverted thanks to HN.

Not-so-happy LastPass user here: I evaluated alternatives, but LastPass is the only one which somehow works on Linux/Firefox. I have even tried to make pressure to 1password about that, without much success: https://discussions.agilebits.com/discussion/comment/410603/...

BitWarden works fine. I'm using Linux/Firefox as well, the rest of the time is on Windows/Chrome. It's 100% open source: https://bitwarden.com/

I stopped using browser based password managers and switched to KeePass. It's a bit more work to pull passwords and back them up, but for me it beats trusting cloud services with security critical data.

I stopped as well, but went for a different setup: Tomb [1] and Pass [2]. There's even a combination of the two: pass-tomb [3], but I don't use it.

No cloud, only USB keys. The thing is, I lost two of these USB keys! Had to rotate my passwords ;)

[1]: https://github.com/dyne/Tomb [2]: https://github.com/zx2c4/password-store [3]: https://github.com/roddhjav/pass-tomb

This! I love my setup. I use KeePassXC and sync my password db with NextCloud. I love having an open source password manager that is useful across all of my devices, be it Android, Linux, Mac or Windows.

KeepassXC, syncthing, and keepass2android here.

Sure but good luck using KeePass across a team on multiple devices.

And you can self host it, which was what convinced me to switch from lastpass.

https://github.com/mprasil/bitwarden_rs

This is a 3rd party implementation of the bitwarden api, which gives me more confidence in the 1st party product.

Have you tried Enpass? It works on Linux and has plugins for Firefox and Chrome. https://www.enpass.io

+1 for enpass, using it to manage and sync passwords between android/iphone/ipad/mac/linux (via dropbox). The single wart is it doesnt autofill firefox on android, you have to switch to a custom secure keyboard where you can manually fill on a field-by-field basis once you've authenticated with master pass or fingerprint. Another thing I appreciate is that there is an npm module to decrypt your own wallet; this gives me confidence that I can access my secrets if there is some problem with the app or company.

1Password does in fact work on Linux and Firefox -- although it's not prominently advertised for some reason; I usually have to search for the page.

We have a team of developers using macOS and Linux, and we use the team functionality to manage both personal and company passwords. We made the switch to 1Password specifically because of Linux support [1].

[1] See 1Password X: https://support.1password.com/getting-started-1password-x/

I couldn't make it work 6 months ago, they answered to the issue I referenced above that it wasn't officially supported and they never sent any updates about that on that issue, so I supposed that the situation stayed the same. I wonder why they don't update their issues anyway

1Password X works on Firefox now as well. Source: I am using it with Firefox on Linux.

I couldn't make it work (see the link above)

That link refers to forum posts for January. Firefox has only been supported officially on stable versions since May.

https://addons.mozilla.org/en-US/firefox/addon/1password-x-p...

It's now as easy as adding the extension and logging in.

It used to be horrendously broken, but it works now.

Have you tried Pain-free Passwords?

I haven't used it myself, but it was created by Wladimir Palant (creator of AdBlock Plus extension), I believe after they examined the LastPass extension and were rather unimpressed with its security practices.

https://pfp.works/

I’m using Bitwarden on budgie / Firefox. Works great.

Thank you! I'll evaluate it

Not that it's the greatest solution, but 1Password does work on Linux using Wine.

Yeah, by no means I am an ambassador of them. For me, it was so-so vs bad really.

They don't have a 'horrible track record'. LastPass has always had some of the fastest response times to security issues. They've had certain breaches in the past, but nothing that has exposed any users' passwords.

Might I suggest reading the following articles:

https://palant.de/2016/09/16/more-last-pass-security-vulnera...

https://palant.de/2017/03/23/lastpass-security-done-wrong

I still use a pretty complex password algorithm:

https://penguindreams.org/blog/password-algorithms/

I like not having my passwords tied to a device, private key I could lose, etc. With an algorithm, I can still avoid credential stuffing, since all my account use totally different secure passwords, but I can derive them without having to look them up.

I realize someone could figure out my algorithm, but they'd probably need several of my passwords and at that point you're talking about a targeted attack.

What do you do when you're asked to rotate your password every ninety days?

Most normal websites don't make you rotate password. When a site has a breech and forces me to change it, I do have an addition to my algorithm for that. I use Keepass to store passwords that violate my algorithm (sites that don't allow my special chars, or that say my password is too long, etc.)

I'm on my third iteration of password algorithms. I use my password manager to store which algorithm I'm using for which site and try to update old ones to new ones as I encounter/use them.

There aren't that many exceptions to my rules, so I can usually remember those exceptions if I use them frequently enough.

Machine accounts that require rotation get their own special secure password that I don't use anywhere else.

Not the parent, but I've haven't been asked this in years. I do periodically change important passwords, but I can't recall being forced to.

Is this new behaviour? In the version of 1Password I have (6.8.8, Mac) it detects the website, but I have to click on the specific login using 1Password Mini to fill the fields. It's never done it automatically as far as I can tell.

It tends to be browsers which are gung-ho about automatically filling in login details.

Nope, I have used 1Password most of last year, maybe they changed it after the data harvesting attack from a few months ago, but for me, the tool was very aggressive in submitting data without me interacting with the website. At the time LastPass was the only major player with "click to launch" feature.

The only way I can think this would happen is if you clicked a URL from within 1Password, which would visit the site and then auto fill. Otherwise you have to press a hot key. That is literally how it has been for years with the only option to change being whether or not it tries to submit the login automatically after filling.

> data harvesting attack

Think I missed that, what happened? I don't enable 1Password autofill or any of it's browser extensions, I just see it as additional attack vectors waiting to be compromised.

https://www.howtogeek.com/338209/you-should-turn-off-autofil...

From your link:

> 1Password isn’t affected by this problem because it doesn’t include an automatic autofill feature.

Are you sure we’re talking about the same app? I’ve used 1Password for years, and it’s never autofilled for me. Maybe it was actually your browser’s built-in keyring?

I think they're confusing the 1Password browser extension.

1Password has a native app, which I use on both windows and osx, and I just don't install their browser extension for autofill features.

Though, given that I avoid autofill like the plague, I could easily be misunderstanding the issue too. I'm speaking of a subject I don't use, I don't think anyone should haha.

I use the browser extension. It does not autofill. I have to open the extension and then select the site before it will fill any form fields.

Sorry, I completely screwed here. I think I am way overworked.

It's Dashlane that I was using, not 1Password.

After Dashlane I was using 1Password for a week but it was not for me, moved to Padlock and now with LastPass.

I have migrated to 1Pass and then from it to LastPass, thus the confusion.

I checked the history of my backups and somehow forgot about my migration from Dashlane that was the initial tool that would do autofills. Sorry for the confusion, I've should check that more thoroughly. A good sign for me it is time for a walk.

Bitwarden has auto-fill disabled by default, and only enables it with a warning (“Use at your own risk”).

Good to know, the more alternatives the better.

The KeePassXC browser integration also does it the way you describe where you choose a profile instead of having the firm already filled in when the page loads.

Note, that's if you use autofill at all.

I use an installed 1Password app, and avoid browser autofill extensions like the plague. Browser extensions don't have a good track record I believe, regardless of company. I don't blame the companies, I blame browser extensions.

I see little benefit in autofill integration, I just click the button in my task bar, click copy, and paste. LastPass has been pretty sketchy in the past too, I don't trust them. I've been quite happy with 1Password, fwiw.

That's....simply not true?

I've been using 1password for many years, and that's not how 1password works for me. There might be a setting to enable that behaviour somewhere, but by default, it doesn't autofill without prompting. That's true for every version, OS, browser plugin, desktop app, mobile, etc.

Edit: I just saw your comment that it was actually Dashlane that autofilled! Nevermind then. :)

My 1password only autofills if I do ctrl+\, otherwise it does nothing.

I've never seen last password auto fill, I've always had to use cmd+\. What browser were you using?

FWIW Apple's Web browser Safari recently switched to this approach, both on iOS and macOS.

For reference: https://www.cultofmac.com/538447/ios-11-3-safari-security/

Absolutely. I myself don't trust closed source and for-profit on such a sensitive matter. It's a matter of time before you have to deal with some bullshit. I'm leaning towards bitwarden, seems very nice.

Their file format specs are open, and there are opensource implementations of it. Sure - closed source isn't ideal - but this is as good as it gets. The 'opensource' alternatives have a way worse security trackrecord. I tried quite a few options - but always went back to 1pass...

I'll be checking out bitwarden for sure. It looks great. I'm ready to move away from Dashlane. While I haven't had any issues with it, I'd feel more comfortable having the data stored on my own servers. And the cost difference is pretty huge.

I switched maybe 3 weeks ago. Love it. Highly recommended.

I recently discovered Enpass password manager (a mostly free alternative to 1password, only the mobile app has a pro version) also integrates HIBP into its desktop app.

https://www.enpass.io/docs/desktop-windows/pwned.html?highli...

Especially considering 1Password is not technically supported on linux.

You are "uneasy" about something provided by Troy for free? Which other password management products have integrated HIBP into their product?

He is also sponsored by cloudflare.

It does sounds like he is. On password managers - KeepassXC, open source.

Reply on news.ycombinator.com