Hacker News Reader

Comment by gilbetron | Hacker News Reader

As a LastPass user, I'm getting a bit nervous. I've looked through various other threads on suggestions, but, since it is inevitable - what do people recommend and why? I'd prefer only answers from people that have been using their solution for at least a couple of years, and even better, people that have been using theirs for even longer and through multiple iterations of "weird things happened to password manager X" cycles :)

View on HN

I've been on 1Password for many many years - looks like I bought it first in 2008, and I've bought every major version since, and then moved to subscription within weeks of it launching. I couldn't be happier with the product, or their customer support. $3 per month for bulletproof password management that integrates so well into iOS and Mac OS isn't even something I think about when renewal time comes along. I'm watching their move to Electron for their apps with caution, but they have such a long track record of shipping great product that I'm not too worried.

I don't love electron, but I do like they now have a Linux client with good platform integration (such as pop up mini window).

They previously had a cli for Linux. It was designed to provide everything you'd need to build a nice ui but since it was a little low-level it didn't have great ux.

I'm using keepassxc, synchronized over pcloud (but Box, Dropbox, gdrive etc would all work just as well). There's an excellent browser plugin, I use keepass2android on my phone and it also functions as my ssh-agent and I use it as my secret-provider for my Linux desktop (essentially a replacement for gnome keyring or kwallet). I'm not sure what reason there would be to use a SAAS.

I’ve used 1Password for around 8 years (maybe longer) and I believe them to be a pretty safe bet currently.

I wasn’t a huge fan of their move to a hosted model but I went with it and even so, I have to say that their service is good, reliable and instilling of confidence.

If I was starting from scratch I’d probably look more closely at Bitwarden (likely to use their hosted service but knowing I have the option later to self-host).

I would suggest that most people would likely be served well by either of these solutions at this point in time.

Same here. If I was starting from scratch, I'd consider Bitwarden, but 1Password has been so flawless for me over the decade and a half I've used it (off and on) that I can only lose by moving.

I've used 1PW since it's inception, happily moving whichever way they went. However, the latest iteration (electron?) is an absolute mess. I blinkin hate it! Shortcuts work, then they don't. Search rarely works. Multiple overlapping modals appear. Modals position themselves over the input boxes. It's really awful after the change. Sadly I didn't find this out until I had already paid for the monthly subscription or I would have dropped it like a hot potato. I'll stick it out for a few months more, but if things don't improve I'll be in the market for something (anything) better.

I've been using pen & paper for a decade. So far it has not been affected by any CVEs, company acquisitions, bugs, quirky updates, outages, mandatory subscriptions or arbitrary account limits, leaks, or other compromises. It's airgapped and works fully offline too. Even if all my computing devices got filled with malware, they would only log the passwords that I actually type in.

I could never trust credentials to my hand writing. :D

bitwarden seems to be the favorite so far - open source, self-hostable if needed, and pretty easy to use.

There's a free reimplementation of its server which also seems to be highly recommended:

https://github.com/dani-garcia/vaultwarden

Second Bitwarden, I moved from Lastpass to it last year and the process was painless. iOS and Browser support were at a parity that I just uninstalled one installed the other and was ready to go.

Been using bitwarden and love it! I don't think it offers 2-factor but you can replace that with Authy or Google Authenticator

I'd like to recommend Aegis Authenticator, which is FOSS. It also encrypts tokens at rest, has password protection and the ability to export tokens.

Lastpass Authenticator does not do that, so I spent an hour yesterday manually resetting all my 2FA.

Vault warden (the recently renamed bitwarden compatible implementation in rust) supports 2fa as well. The providers mentioned are Auth/Google Auth, Yubico, Duoa, WebAuthn, and email.

It does have 2-factor in the paid plan.

I am having a great experience with KeepassXC and KeepassXC-browser. I sync my password database via Seafile, which is hosted by Your Secure Cloud. And I use Strongbox on iOS.

BitWarden. Have been using for 3+ years now (Prior used LastPass).

BitWarden:

* Open-Source

* Affordable pricing

* Good, working browser extensions and desktop app

I used LastPass for a while too, but I then switched to KeePass, using syncthings to have a single db. At first that was great, but after a few save mistakes, and a slight change in need, I've switched to a hosted bitwarden (using vaultwarden).

I've not had a single issue with it since, it's fully compatible with the official bitwarden app (which works rather well), and is much easier to use when other people in your household also need to manage their passwords.

Point of note : the android app syncs the database locally, and can be accessed/used/exported even offline, which is very, very reassuring in case of server/network failure

I use KeyPass and then several different UI’s, based on the platform. I store the KeyPass in my favorite cloud drive so I can use it from wherever.

Where do you store the password for your "favorite cloud drive?"

Same, but I switched a while ago to using Syncthing for the database instead of cloud storage.

If you're going to be paying a subscription anyway, I've been using 1Password for 2.5ish years pretty successfully.

It's also recommended by Troy Hunt, who has a reputation at stake in all of this, since he runs stuff like https://haveibeenpwned.com

Former LastPass user (2+ years) and current 1Password user (2+ years).

There’s no looking back. LastPass was buggy and the UI ugly. That was fine when it was free but when they went to fee based for cross platform support we switched the whole family over to LastPass. Everything works, is pleasant to use, and no slimy tactics.

Another vote for BitWarden. I used LastPass for many years, and jumped ship when they were acquired. I've been using Bitwarden for a few years now and really like it.

Importing from LastPass was easy.

Exactly my experience as well

Reply on news.ycombinator.com