Comment by Jasber | Hacker News Reader

Comment by Jasber | Hacker News Reader

Parent Full thread

Both LastPass and 1Password failed to save some generated passwords for me, causing too many trips to forgot password.

LastPass would sometimes post to the wrong login form.

1Password got confused a couple of times between 'Logins' and 'Accounts'.

With 1Password, when I'm away from my computer, I have to use my phone to read my passwords. If my phone dies (fairly common) I have to install the password manager (not always possible).

With LastPass I can access their web interface--but experienced too many of the issues above. Plus I am a little nervous about a 3rd party having that much power.

I'm sure all of this was my fault, but the end result was I discovered many hidden costs and it felt like I was fighting against them.

Do you store your 1Password keychain in Dropbox? If so, check out the html file they put there. It's 1PasswordAnywhere, which is basically a web interface to 1Password. You would still need to remember your Dropbox login, and of course your master password that encrypts all the 1Password data.

That sounds like 2Passwords to me.

Ha!

I guess you could put it in the Dropbox Public folder. I wouldn't be totally comfortable doing this, but all the 1Password data is encrypted so it should be safe.

The problem with that is once someone DOES get your 1Password database, they can crack it at their leisure. Now sure the encryption is strong, and sure it will take a long, long time, but once the attacker has your 1Password database they only have to keylog your master password once and you're SOL. If you keylog my LastPass account you still need my grid (soon to be SMS 2 factor auth when LastPass implements it).

Yes, 1Password is especially bad at not saving generated passwords to the specific account you are trying to update. However, by changing your settings, you can get a history of all generated passwords, sorted by website. It's a pain, but you can grab that password from the history, and update the login record for the website in question.

Reply on news.ycombinator.com