Hacker News Reader

Comment by zucked | Hacker News Reader

This is going to turn into a thread full of recommendations for PW managers before long, so here's my plug for Bitwarden.

View on HN

I use Keepass + Onedrive sync (Windows + Android). It's been working well for many many years and I see no reason to switch.

If I had to recommend a pw manager to someone I'd probably suggest they just save them in-browser, and use the same browser (Chrome/FF/Edge) across all their devices. Chrome has a pretty good password suggestion feature. Other browsers are probably not far behind.

Came here to say the same thing. Been using Keepass for years without any issue and won't switch. I started it using quite a while ago after someone on here recommended it and haven't looked back since.

Ditto. Keepass + drive sync and I have zero issues and feel like it's a pretty secure system.

Same, though I use Resilio Sync instead. Can also use SyncThing.

Doesn’t chrome store passwords in plain text? Also, a proper password has the advantage of working outside of the browser on android/iOS.

They did at one point but not anymore. But either way any password filling is as secure as plaintext since it's pasted as plaintext, and you can just edit the DOM after it's filled.

As the sibling comment states, it's not stored as plain text.

You're right that external storage lets you use it elsewhere, but IMO using keepass has a lot of friction I personally don't mind but wouldn't initially recommend to most people. Browser password storage fills 99% of most people's needs.

Bitwarden is good for this. I use the browser extensions on desktop and the apps on mobile. It's my go-to recommendation.

I switched. Bitwarden just seems easier to use. Everytime I install Keepass on a new computer I have to spend 15 minutes remembering where all the options are to configure it. Bitwarden feels more like a vault of information while Keepass seems like you gotta fight it to be anything other than URL-username-password.

To be honest though I'm still not 100% moved over, and may never be. I doubt I'll need to transfer the login to the public library from a town I lived in 10 years ago.

The last time I checked, Bitwarden would fill a password into an iframe even if the iframe is for a different domain than the parent. This came up in one of their security audits and changing it was argued against.

This has security implications and what cautioned me against it.

Other password managers don't do this and look at iframe domains before filling them in.

Am I missing something?

Can you give an example of a well known site that does this? Curious to try this out for myself.

I use pass. The provided password manager in linux. passmenu provides a great workflow for inputting the passwords.

I really like how pass saves passwords as a gpg file, so when you sync with a cloud provider you can see specifically what passwords are being synced. When you store everything as a single database file, not only does sync not show you differences, but you have to resync the entire DB file each time you change something.

Pass, the piece of software that, per line of code it possesses, has improved my digital life more than any other. A true gem!

Something that I believe should be added to this thread would be utilities that can take the LastPass export and transform it into structures that other pw managers can easily recognize and import.

Here [1] is an example of migrating passwords from LastPass to KeePassXC. Does anyone have more examples like this for other pw managers?

[1] - https://blog.paranoidpenguin.net/2018/12/migrating-from-last...

When I migrated from Lastpass to Bitwarden, I was able to import the Lastpass export without any transformation needed, if I recall correctly.

KeePass and pass use fully open database formats. (I like MacPass, KeePassHTTP Connector, and Keepassium.) Enpass uses a well-documented database format based on SQLCipher/SQLite (albeit not fully open, you have to piece it together from the white paper and forum posts). They are all local-first, so you own your password information.

I have no reason to believe BitWarden would try to hold my passwords hostage. But I prefer the solution where they can't.

Gonna put a vote in for KeepassXC (and in general the Keepass family of local-first PW managers).

You get full control over how to handle multi-device synchronization because it doesn't attempt to do this at all...

Do you have experience with it working on android? It seems Lastpass is only semi reliable with how android allows auotfilling fields in.

i especially recommend vaultwarden, the community developed self hosted backed.

Reply on news.ycombinator.com