Hacker News Reader

Comment by walteweiss | Hacker News Reader

Why not use some better and entirely open solution, like pass?

https://www.passwordstore.org/

As a user of pass for like 4 years, I enjoy reading all those silly threads on password managers doing this and that. Fantastic. And it’s not even an upgrade to use the GUI app here, I can take any often used password of mine with pure Ctrl + R in my terminal, just a second and it’s here, with no need to do extra backups, all the history is in git, and no party will ever change anything about my passwords.

View on HN

> Why not use some better and entirely open solution, like pass?

Bitwarden is entirely open source?! https://github.com/bitwarden/

You aren't even locked in to using them as the data store.

Pass is just text files encrypted with gpg. I needed just one password on one work computer, where I had my gpg key, but not all my passwords. Decrypted the file and that was it.

Honestly, I cannot get the longing to store your passwords with some company that claims it would be free and open source forever. What is free and open source by the way? Their client? What about their server they store your password? (I assume you can sync that to their server, I’m not their customer.)

The server is open source too and there's even two separate implementations of it. The official one and a community one named Vaultwarden. Bitwarden is fully open source and you can very easily selfhost it.

> What is free and open source by the way? Their client? What about their server they store your password? (I assume you can sync that to their server, I’m not their customer.)

You didn't even bother to click the link and educate yourself did you? The server, client and mobile app are all open source. You can even store the encrypted DB yourself on your own server.

Nearly all of my need for passwords is web-related. Autofill is incredibly convenient and also an anti-phishing measure, because it won't autofill fake sites, which would give me time to notice something was up.

There doesn't seem to be major super popular audited autofill stuff, seems like the ecosystem is mostly smaller projects and the main focus is on the CLI.

The remainder of the times I need passwords are mostly on mobile.

1. There are plugins and web clients: https://www.passwordstore.org/#extensions

2. Of course pass has mobile version, and to my liking it looks and works much better than 1Password that I migrated from. (And to my liking as well Bitwarden looks much worse, if we would ever happen to talk about looks in a password manager, lol. Of course that is highly subjective.)

3. I have shared stored with my work mates. That is different hit repositories that has those text files encrypted with more than one gpg key, and it works so incredibly well. And is free, forever. We manage that with gopass (a fork written in Go), as it’s easier to work with for not-so-techies.

For Android the mobile app seems to be last updated in 2021 and not compatible with the latest Android version. I would switch to pass immediately if they had both a well maintained and audited browser extension and mobile app.

I won’t argue on the mobile Android, as I don’t have the latest and greatest Android, but the app is quite good on Android. My iPhone is fine with latest version, though.

I never use web app, so cannot comment on that.

I hear you, and you're not wrong, but there's no way I can get regular users to do that.

And what about KeepassXC?

Ugly. For a non-nerd average person.

I quite like it when I interacted with it, but personally I prefer pass as way simpler and more elegant solution.

There is keepassxc-cli for nerds like you ;)

Won’t argue with regular users.

Although, I don’t see why I would self-host BitWarden for my family, when their needs are 10 passwords for social media and bank apps. It all stored in their default iPhone (or Android) password managers and I just have the duplicate of sensitive (usually bank) info in my pass vault as well. That works for me very well, as if I would ever need to migrate my mom, aunt, wife or anyone else, I can easily copy those 10 passwords manually. And its zero maintenance system for me.

Reply on news.ycombinator.com