Hacker News Reader

Comment by filereaper | Hacker News Reader

I'm trying to find an alternative to LastPass given their announcement today and was thinking of moving to 1Password.

Many responses here are recommending against 1Password.

What's a good alternative, specifically for families, as I've moved members of my family to LP?

I'll specifically need some recovery mechanism for them in the event they lose access, as they're still getting used to this workflow. Its not ideal but what's needed realistically.

View on HN

Personally I'm a big fan of bitwarden. It's open source so you can host it yourself if you want, the free version is very usable and the pricing for the more advanced features and the family plans is very reasonable.

https://bitwarden.com

Note the official open source version requires a subscription to get a license key. Most people choose to run an alternative server written in Rust called vaultwarden.

they are also doing some ... questionable ... trickery in their on-premises install <https://news.ycombinator.com/item?id=31098608>, so aside from vaultwarden being seemingly infinitely slimmer, it's also a lot easier to reason about from a security PoV

Honestly, ignore them and try 1Password. It's really, really great for families, whereas I found LP to be a fucking nightmare. I can recover family members accounts no problem. Best subscription service I've ever paid for by a long shot. The cost to try it for a month is negligible.

Second this. 1Password is excellent, and when I had a critical support issue, their team (and even CEO, believe it or not) went above and beyond.

The claim that they're censoring critical posts on their forum is fairly baseless until they've had a chance to respond — Occam's razor would suggest there's a much less nefarious reason for posts not showing up.

Finally, the Hacker News crowd has a clear bias towards shitting on Electron apps in the war against perceived crimes of not being performant on ancient systems. I'm sympathetic to that way of thinking, but it's not justified grounds for how much flak 1Pass is taking here.

I moved from 1Password to Bitwarden about a month ago and am perfectly happy. Bitwarden is missing a small number of nice "quality of life" features like Touch ID support on Macs and large type mode, but these aren't even close to dealbreakers. There is a family plan available for up to 6 people, and for recovery there is an "encrypted export" function so you can have an encrypted vault in cold storage. Would recommend.

Bitwarden

Touch ID / Watch unlock are pretty big features to me.

One thing 1PW has been sporadically weak on is delivering consistent high quality UX across the plugins and main application.

It would make a difference to me if BW supported these forms of auth.

What do you mean by "Touch ID support"? Bitwarden has Touch ID support.

I missed LastPass's announcement. can you share?

Edit: here it is: https://blog.lastpass.com/2022/08/notice-of-recent-security-...

Unless there's evidence they're lying about the scope, that alone doesn't seem like reason enough to ditch them. Not that I'm opposed to switching to keepassxc.

When LastPass started to lock in free users to desktop or mobile only, I switched to Bitwarden. Quite happy with it so far. I was able to import my passwords from LP and I believe it has free sharing for one other account, though I've only used it on my own so far.

There's always Keychain if you have multiple Apple devices.

Keychain also works on Windows now!

But autofill doesn't work on non-Safari browsers on your Mac. Yet I truly love Keychain so much in my Apple ecosystem I go to the trouble of exporting my passwords every few weeks to Chrome.

That's on Chrome's and (Firefox's) developers though. The keychain services API is fairly straightforward to implement.

I'd like to see websites make it easier on people who need to copy/paste their login information because they are using some kind of password management system that doesn't support autofill.

One simple change would be to for the site to pick some character that is not legal in user names for that site and make it so that if the login form is submitted with a blank user name but the string in the password field is of the form <string1><X><string2> where <X> is that not-allowed-in-user-name character, then the site tries to do the login with <string1> as the user name and <string2> as the password.

People using copy/paste could then store their user name and password together in that format in the password manager, and only have to to one copy/paste to login.

https://keepass.info/ hosted and shared on dropbox is what my family does.

I've been moving to Enpass. Seems OK so far.

Been using Enpass for years after I gave up the 1Password tax.

Enpass user here since sheesh, probably 2016? It was whenever the 'LostPass' [1-2] security scandal broke and shortly after Logitech acquired LastPass, after which the usual 'corporate suck' had set in. I had used LastPass for a good seven or more years before switching to Enpass.

Enpass has given me good cross platform support, especially like that I'm not a 2nd class citizen on loonix systems. My only gripe would be that it's not open source, but I think the company does a good job of allowing you to keep and sync your data locally, without constant pushes to whore it out to 'the cloud'.

[1] https://www.seancassidy.me/lostpass.html [2] https://betanews.com/2016/01/16/lastpass-lostpass-passwords/

Another vote for Bitwarden.

Bitwarden

Bitwarden.

Reply on news.ycombinator.com