Hacker News Reader

Comment by chrisblackwell | Hacker News Reader

LastPass... :-(

1Password is better and unlikely to be acquired. They are quite profitable on their own.

They did however take $200 million in VC funding in November: https://blog.1password.com/accel-partnership/

According to Accel that was more about the contacts offered by Accel, with a nice side effect of getting lots of news coverage for a $200 million series A.

I am skeptical that one takes $200 million and it's still more about the contacts. After you've gotten the contacts, there's still a $200 million elephant in the room.

(Personal Opinion): I'm gonna vouch against 1Password.

Some months ago I tried migrating from LastPass to 1Password, had a lot of headaches with the >having to run an executable in the background< as well as the horrid UI on the control panel.

During testing, I was also constantly being prompted to pay for the thing, (trial was just started!). At least importing worked (kinda, some non-form fills [CC, SSN] didn't import or just would get dumped on random places all over their UI).

The key-management thing they have for the safe is really annoying, having to keep a big string around whenever you need to log in somewhere real quick just doesn't work. (One thing is having OTP codes on your phone, other is needing to type a big, random, safe unlock string).

With that said, due to this acquisition of LogMeIn, I'll be looking into alternatives (Mainly Bitwarden as it's been in the "market" for a while already and seems to be recommended). Probably not gonna move yet but better be prepared.

They have recently taken quite a bit of VC money though.

https://techcrunch.com/2019/11/14/fourteen-years-after-launc...

And they talked about why in more detail here: https://rework.fm/venture-capital-and-control-with-david-tea...

Edit: Fixed typo. Would also like to add that their use of VC money appears less risky than one could assume.

Thanks for the link. I'll try to find the time to listen to it.

Regardless, I don't feel personally comfortable with having my passwords in custody of a VC funded enterprise. I am looking into start self-hosting something like Bitwarden in the near future.

Nice option, will make the move over now I think..

Out of interest before I go and google/write it, is there any 'automatic-as-possible' transfer tools/scripts ?

The 1Password cli is a nice touch I must admit.

Heads up, I work for 1Password

We have guides here for migration from other password managers:

https://support.1password.com/import/

Let me know if that helps or if you run into any trouble.

Kyle

1Password Security Team

Why is 1password unlikely to be acquired? I’m sure its owners would like to be billionaires just like everyone else. They’ve already accepted VC funding, and VCs definitely want to be billionaires.

And doesn't work on Linux.

It does: https://support.1password.com/explore/linux/

There is even a cli: https://1password.com/downloads/command-line/

Not having a native gui is not the same as "not working".

Sweet! I used 1Password for years and then went LastPass for Linux support. At the time only the recovery mode worked to the best of my knowledge. This was in the 1Password 4 days.

Their browser extension is a non-shitty experience and works cross-platform.

I'm a happy 1password X user on Linux for the past 1.5 years or so!

Use Pass (https://www.passwordstore.org/) to generate and store passwords locally, GNU Privacy Guard (https://gnupg.org/) to encrypt them, and then use git (https://git-scm.com/) to backup and sync your encrypted passwords on all your devices in a distributed way.

Pass is an open source project by the guy who made WireGuard (https://www.wireguard.com/), and there are open source apps for iOS and Android too, which you can build yourself for maximum security.

Setting this all up is not exactly easy, but once you get it going it's very easy to use, secure, and convenient.

Highschool me fucked up pass and exposed a lot of data. It was entirety my own fault, but there are footguns if you don't fully understand the model.

Essentially, I accidentally publicly exposed my private key. I thought I was clever for writing a Python script to dump all my passwords and then re-add them after setting up pass with a new key.

A year later, when I accidentally deleted my private key (reformatted laptop, phone bricked before set laptop back up), I spent a few hours trying to figure out if I made a mistake that would let me recover my passwords. I was very motivated :)

Eventually, I realized that since I'd been using git to sync pass between my phone and computer (the recommended setup) I could access versions of my encrypted data for every account more than a year old and decrypt them with the private key I leaked. I got back almost all my data.

Luckily I was using a private git repository for defense in depth, but many guides recommend a public reposity because they say gpg is very strong.

It all works, but only if you don't do something dumb like I did. Now I'm on 1password and happy knowing that experienced people are paid to make it and smart security researchers like Troy Hunt (of haveibeenpwned fame) have said it's the most secure password manager they've looked into.

Ensuring a gpg key isn't lost seems pretty obnoxious.

Why would you lose it? You'll have to install it on all your devices that you want to access your passwords from. I have mine on my desktop, laptop, and phone. The chances of me losing all 3 devices at the same time is very low.

It seems like a fire at your home would be a reasonable scenario that might well result in that outcome.

LastPass has been :-( for years. Try Bitwarden. It's open source and much like how LastPass used to be (good).

Yep. The price has risen every year since the acquisition with no new major features to speak of. I imagine it will rise even more under new management.

I'm perfectly willing to switch to Bitwarden, although I will miss the ability to securely share logins with my girlfriend's LP account.

Reply on news.ycombinator.com