Hacker News Reader

Comment by kjuulh | Hacker News Reader

At this point it is too high of a risk to store my password elsewhere. I've been screwed over by dashlane, lastpass, potentially bitwarden now, I am with 1password now, but I've had my passwords in all these places, and I've had to change them each time, probably missing a few.

I like 1password, it is by far the highest quality product I've used in this category. I moved from BitWarden back then because their browser integration was quite poor.

I think I'll move to something custom, or a selfhosted keepass server, with the rugpulls, incidents, and whatnot, it is becoming too high of a risk.

View on HN

Keepass has been my go to since forever, highly recommend. I never jumped on the SaaS password manager train when they started coming out, always just kept it local. There were times I thought I was missing out on some convenience but I'm glad I never moved.

Depending on your threat model, you can even just keep the .kdbx in cloud storage somewhere and point your keepass client to that. I'd recommend using a keyfile in addition to your master password though so that if anyone does happen to get a hold of the database they can't just make brute force attempts against it.

I’ve found being able to share passwords with my spouse very valuable which we couldn’t easily do with keepass. Also the syncing strategy on iOS is a disaster and corrupted my wife’s keepass db causing her to lose everything.

Is there reasonably priced cloud storage for this use-case? Their offerings are usually for several gigs of data, a kdbx is minuscule

In theory, you can just use a public (free) github repo for this.

keepass files + syncthing works very nicely for me.

For non technical people, I just recommend to use the browser built in password managers. traviso has a good writeup why: https://lock.cmpxchg8b.com/passmgrs.html

I was doing this too until recently. The problem with this setup is more at Syncthing. More specifically, Syncthing Android app has seen some troubling changes in maintainers. The latest maintainer has a very sparse Github profile and an AI generated avatar, so I noped out of installing it right then.

Previously I used keepass + drive. That also works well (I just wanted to avoid storing my password db in the cloud for multiple reasons).

Serious questions: what's wrong with just using Firefox built in password manager?

It is limited to ... well ... Firefox! Sometimes you need passwords elsewhere. Besides that Firefox (or other browser password managers) doesn't support more advanced use cases like shared vaults.

If you only need to manage online passwords, only use Firefox, and aren't using an iOS device, then it's probably fine. But most people may also need to use native apps, other browsers, and iOS devices.

You can absolutely access firefox passwords from any iOS app. You can even configure it as the default password app.

For the same reasons, I imported all my passwords to Firefox and I'm satisfied with it. I have the option to self host if I don't trust Mozilla

Any malware or LLM with user-level filesystem access can attack the outdated KDF [1] and/or wait for Firefox to be running with an unlocked credential store and read the decrypted passwords from Firefox's process memory.

[1] https://bugzilla.mozilla.org/show_bug.cgi?id=973759

Isn't it game over anyway once you have an adversary on your system capable of reading process memory?

How were you screwed over by these products?

Rug-pulls, security incidents, lost passwords, I also don't know if they've kept my passwords behind when i deleted my accounts. The risk of them having them is too high, so i had to swap all of them.

Interesting! I've been a LastPass and then 1Password user since 2009ish.

I left LastPass because of UX paper-cuts, but I've never lost passwords on either of them.

Honestly, it's something I don't want to think about and just need it to work on mobile and desktop, so the switching friction is very high for me. I'm not going to shop around and try different password managers.

Is "rug pull" a cost thing? I'm generally frugal, but pay for a family plan and don't think twice.

Reply on news.ycombinator.com