Evaluation of five password managers

I love the iOS app, but things like this concern me (not quite a dealbreaker though): https://github.com/mssun/passforios/issues/223

OTP as in Open Telephony Platform?

Edit: it turns out OTP is one time password, that's neat!

I'm only familiar with that through Erlang and consider it an architectural pattern for supervision trees, would you be willing to expound a teeny bit more on what you mean?

Have you tried to use pass-tomb?

I mitigated this by storing username in the gpg file itself using the 'user:' tag, while having the file named jdoe or something similar instead of a login name.

I use keepassxc on MacOS, Windows, Linux, along with MiniKeePass on iOS. It's synced through my free Dropbox account. I just make sure to set the preferences so that every change to the key database results in a file save.

I use keepassx and yeah it could use some tlc, but overall I consider stability a feature in security software. How does one tell if xc isn't just a bunch of wannabes making keepassx with blackjack and hookers until they break it? At least keepassx has taviso's off-handed Twitter comment that it "looks sane".

What I like about keypass is that it's not networked and not running in the browser, making the attack surface a lot smaller.

Keypassxc having such features(and apparently the old network protocol was vulnerable lol) is for me a strike against it.

Couldn't find any mention of a 3rd party security assessment? Open source doesn't necessarily guarantee security though I'm really glad to see this is open source.

Given macOS's security track record - especially with High Sierra - and how particularly verbose Mach-O binaries tend to be, I'd be kinda worried about something relying so heavily on proprietary APIs (and potentially the system keystore?) Though I'm sure using Keepass with Mono (that the Macpass site lightly implies is the only Keepass macOS alternative) isn't exactly an impenetrable fortress either haha

Got that Hopper license around here somewhere...

How many Linux users don't have chrome or firefox installed?

I think the article would be a bit more accurate to say there's not native client support for Linux.

That's somewhat fair, although the 1Password X page (which is what AgileBits calls their in-browser version) describes it as being comparable to the native versions, which to me goes against OP's statement that

> full functionality can’t be dependent on an app which is only available on Mac OS and/or Windows.

The existence of 1Password X means that full functionality is not _dependent_ on a MacOS/Windows app. The argument that there should be a graphical (because there _is_ a multi-platform CLI), native app for Linux, which does not depend on any browser, is a perfectly valid one -- but it is also an argument that I don't believe they've made.

How is this different than just trusting the browser to handle saved passwords in an encrypted manner?

It's interesting to me that you've had trouble using the 1password browser plugin on linux; it isn't quite as handy as having a native app as you do on OSX, but I've never had any trouble at all with it.

Interesting. Browser plugins, by nature, include source code. I wonder if there's an easy fix. Can you describe the issue in a little more detail?

Interesting. Lastpass works perfectly for me on Debian based Linux, and I have friends that use it on arch. I can't speak to use on other distros though.

I run Arch full time with i3, and I have no issues with lastpass. I use both browser plugins, and lastpass-cli which I have had no issues with[0]

[0]: https://github.com/lastpass/lastpass-cli

I use 1Password via the CLI (https://support.1password.com/command-line/) on Linux (well -- FreeBSD) Desktop all the time. I wrote a wrapper for the CLI (https://github.com/dcreemer/1pass) to make it a bit more ergonomic to use with things like FZF.

I used to use "pass" like others here, but did not like the Android experience.

*edited to add: and we use the 1Password team account at my day job -- and are satisfied customers. I'm sure other products work well too -- just my one data point.

Both Lastpass and 1password browser plugins worked totally fine for me on Linux. My only complaint re: 1pass is the lack of native Linux app — you can't do mildly complicated things in the browser extension like edit credentials. On the other hand, LastPass doesn't have a native app.

There is an official lastpass cli, but I don't know how well maintained it is. https://github.com/lastpass/lastpass-cli

You're correct that the Linux support for 1Password is severely lacking, which is why I called that out in my evaluation.

LastPass, on the other hand, is in a different category. It _claims_ to have full Linux support, and for a long time they did, but more recently -- as you point out -- copy/paste in their browser plugins stopped working properly when the binary component of the plugin is enabled on Linux. Since the binary plugin component is required to work with attachments, Linux users have been forced to choose between working copy/paste and the ability to manipulate attachments. They've known about this bug for many months and have not fixed it. In fact, this is one of the unfixed bugs which drove us to finally evaluate alternatives to LastPass.

I thought they were based out of Toronto, Canada.

They have literally one support person in Australia.

I don't know about the rumours, but "a few days" is a long time to test a bug fix.

It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice.

More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about.

EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place.

An issue was opened about 6 weeks ago asking where the tests are and it received zero responses from the maintainers: https://github.com/bitwarden/core/issues/399

For enterprise software, a couple days is indeed strange. For OSS, it's standard in good communities I'd say. When I filed bug fixes against Tomcat, I often had fix within that day (though it was released only during the typical release schedule of Tomcat)

no use of your own (dropbox) sync...

Their windows app definitely needs some love. Actually kinda wish it was a direct port, UI and all.

Is Bitwarden a native app?

This is informative: https://opensource.com/article/18/3/behind-scenes-bitwarden

My impression is that Kyle cares more about spending time writing software than about hyping his company. ;-)

It's an unfortunate flaw in a founder, but not a fatal one if he hires people to do the communication that he doesn't want to be doing. It feels to me like he's moving in that direction.

No u2f support? :(

In the last few days it's had a good improvement. Copy username/password directly from the window is back (had to previously edit and view password, then copy) and speed is just as good as I see on chrome.

I'm using Windows an Linux and these improvements have come in the past week or so for me. Perhaps they recently updated, I haven't checked.

Worth taking another look if you can.

>More bugs and the support was horrible.

^^^Yes, this.

In 2018, we reported nine different substantive security holes to LastPass. At least two of them were security issues. All of them took far too long to fix; some of them still aren't fixed.

There's a tenth bug which impacts many of our users on a regular basis which we haven't bothered to report to them because by the time we started running into it, our users were like, "Meh, whatever, that's just LastPass being LastPass." It's not good when you stop reporting bugs to a vendor because you've become convinced that they just don't care.

They've had 12 outages of varying severities and lengths in the past six months.

Pretty much every time I reported a bug to them -- and believe me, most of my bug reports were extremely detailed and often included videos or screenshots demonstrating them -- their first response was, "Try uninstalling and reinstalling your plugin." I hate that. HATE, HATE, HATE it.

Same. I recently purchased an upgrade and consider it well worth the price, although I'm considering switching to the subscription model / family plan to make it easier to support my parents and in-laws. However my main concern is that you can't disable browser access when using ay of the subscription plans:

https://discussions.agilebits.com/discussion/80105/cant-disa...

Same. Happy macos 1pwd user here.

Sure, but if it has been audited, it's more likely that security issues were found and resolved than if it hasn't gone through one.

Our company went through an audit and did quite well, and we fixed most of the findings. However, I know for a fact that there are things we can do to improve that weren't covered.

Not all audits are created equal, no audit will catch everything, and there's no guarantee that findings were patched sufficiently. However, I feel much better knowing that an audit was done, which means the author cares at least somewhat about security.

Did you click on the "full report" links, those are just simple page attestations.

The latest appears to be a private bug bounty program, where 9 high priority issues were discovered. Who knows what they where, or whether any of the low priority issues should have been classified differently.

Without transparency, we just trust an empty attestation.

It also has pretty much zero automated (unit, integration, etc) tests as of a few weeks ago.

> What if a new browser comes out that's actually better than Chrome? (I don't want to admit to myself how unlikely this actually is.)

Firefox has a nifty feature where it doesn't send ALL your data to Google, you could try that.

I recently starting using Firefox again, and getting my passwords out of Chrome was by far the most difficult part of the process for me. A few things I learned:

Chrome has a feature to export passwords to a CSV file, but I had to enable it via a chrome:flag, so who knows if/when support for this will disappear. This created a bit of a sense of urgency for me, as Google aggressively removes features that they don't want to support.

My employer MITMs all web traffic, so I would never log into my Google account from work. They also have an ridiculously strict password change policy (every 3 months). But having a password manager on my phone lets me store passwords for my various work-related accounts somewhere, which makes each password change fairly easy, and also lets me log into certain work-related apps/sites (e.g. Slack) from home.

If you have multiple accounts on a single website, it's a bit easier to do in a password manager (at least Keepass or Bitwarden).

Chrome is a web browser, so it only remembers passwords to websites. If you have passwords that don't map to a website - e.g. hard drive encryption password, a pgp/ssh key, a wifi password), it's a bit easier to do in a password manager.

Some password managers have OTP generators built-in, which can be convenient.

Well, you can use Google Chrome on iOS, although you'll get worse performance since Apple doesn't allow third party browsers to take advantage of Javascript optimizations.

So, I'd say the point stands! You'd potentially be using a worse web browser in exchange for access to your passwords!

Keeweb is pretty awesome, and is amazingly just a static HTML page. If you're comfortable running your own secure webserver, you can self-host that for added security: https://github.com/keeweb/keeweb#self-hosting

It’s not Apple’s fault as it’s possible to change the cloud storage to store your password with 1Password for iOS.

Plenty of iOS apps offer multiple cloud storage solutions.

In fact, iOS's own Files app can be used to access different cloud providers (I have iCloud, Dropbox and Google drive set up).

Do you have any good references pointing to Apple limiting Keepass in that regard?

As a current LastPass user, what prompted you to switch?

...just checked and there is literally no export option for Dashlane on linux.

I will start switching to a replacement shortly. I wish I'd known sooner.

Agree - switching to Bitwarden was super easy.

You are right about the synced folder, and that's pretty much the approach that I was using. But I was keeping my DB in one provider and my keyfile in another, which means that I had to remember (or have otherwise access to) a total of 3 passwords to unlock my db. It worked, but when I recently had to change phones two times in a period of a few days it was increasingly annoying. Of course I could have kept my keyfile and the DB in the same provider, but still that's one password too many for me.

Thanks for the recommendation for KeePassDX, I will take a look.

There's a counter on Master Password, so if the password expires or you need to change it, you just +1 and it's new.

They also have settings depending on password requirements (no special characters, etc.).

I'm unsure what the URL really has to do with it, you could just generate a new password for the new URL and change it.

In my system, you have a number of additional pieces of information that are used to generate the password, including a counter and a salt. If you need to change your password, you would typically just increment the counter. You can also do this if the password policies don't allow your password for some reason.

This does mean that you need to remember what the version is. Fortunately this information doesn't need to be kept secret. I also have a system that generates emojis based on your settings, so as long as you remember the emoji that goes with the site, you can just increment it until you get the right one, so it's down to you whether you store the version number somewhere or remember the emoji.

I use URLs by default, but you can enter anything you want into the 'purpose' field. It's still pretty raw, but it's at https://github.com/kybernetikos/sinkless

Most of the complaints people have about deterministic systems don't really hold up in practice for me. Protecting them by 2fa would be better of course, which deterministic can't do and lots of the good password managers do, but I really dislike having to worry about syncing state beyond just emailing it to myself.

One thing that would be awesome would be if someone came up with a standard machine readable way of describing the limitations on passwords for sites (allowable characters, number of characters, any restrictions on previous values / sequences etc), and all good sites could embed that information, and poor sites could be looked up in a third-party service.

Is there a technical restriction that makes yubikeys incompatible with stateless password generators or is it just that no one has implemented it yet?

WHOIS Privacy on the website wasn't a consideration on the table the company used. Maybe it's not important in 2018, or is enabled by default, or an oversight, or they're using the spam filtering. But:

It’s at the bottom of the page.

So why the discrepancy?

I have no criticism of the service or WhoisGuard, just the idea of that kind of site using it.