Comment by sneak | Hacker News Reader

Comment by sneak | Hacker News Reader

If your Yubikey dies, your 1Password vault is toast. This is a bad idea and doesn't really add much to your level of security.

Just use a long and random 1Password, and store it in the OSX Keychain (1Password supports this). Then back up your user keychain with the rest of your files and don't forget your login password. Alternately, Mavericks (which comes out in a week) will sync your Keychain items to iCloud for you.

This is all moot though because 1Password is a pain in the dick to use on iOS, and Apple's using their lack of plugin support for MobileSafari to hinder competition. In Mavericks' Safari, you can now save passwords for forms that specifically attempt to disable password storage, and sync those encrypted passwords to iCloud. This wouldn't matter much... but that sync now works with iOS7's MobileSafari, where 1Password can't load a browser extension to compete.

TL;DR: Cool story, but 1Password unfortunately becomes OS-bundled obsolete in a week.

It's only OS-bundled if you live exclusively in Apple's ecosystem.

I live "exclusively in Apple's ecosystem", but still find 1Password incredibly useful. You can store credit credit card/passport details (so useful when filling in forms and not having to dig around for them), store software licences, create secure notes, store bank account details and a bunch more things.

So it's more than just a secure password storage/generation program, it's a centralised system for all your important, easy to lose/forget details.

I don't know how much work Apple are going to put into Keychain, but it would have to be a lot for me to switch.

Keychain can store credit cards and secure notes too. As for the rest, I'm not sure. Other than passwords, I only use keychain for storing SSH keys.

Yeah - the downside would be if someone got access my 1Password, they'd have EVERYTHING...

Also, I always think that it's well and good having a super secure password/password manager, but that's not going to stop me accidentally typing it into a search box, someone looking over my shoulder, accidentally copying and pasting it into and email, or something equally stupid.

1P has some cool features to help prevent some user error (deletes the copy and paste history after a few seconds, auto locks the phone app, etc) but all it takes is some other dumb error on my part to circumnavigate all of their encryption.

The convenience outweighs the risk for me at the moment.

Yes, I've been a 1Password user for years, but you have to admit that using the database on iOS is hacky - you either have to log into 1Password and copy the username out, switch to Safari, paste it, switch back, copy the password, switch back, paste - or use the built in webview in 1Password to do your browsing, which is clunky but will autofill the forms.

On iOS7, it uses the iCloud keychain (written to by Safari from 10.9 Mavericks) to autocomplete forms. Also, all the iOS tabs are available on the desktop and vice versa.

Yes, I use 1Password to store other data, but its primary function is credentials for websites, and anything that does that inside of MobileSafari automatically blows 1Password out of the water.

I wonder how this will affect Chrome / Firefox share among Mac users. Reading the Mavericks details on Apple's website, they make some claims about Safari's performance that were surprising to me ... But believable if the nitro enhancements are vast.

I switched back to Safari from Chrome this week since installing Mavericks. It's substantially faster in my experience.

I use Yojimbo for storing these kinds of non-password items securely. It lets me encrypt items selectively.

Before that, I used to use secure notes in Keychain.

A copy of the 1Password master password stored on the Yubikey could also be stored offline (safe deposit box).

He mentions this in the article - the long password stored in the Yubikey is printed out and stored securely.

> If your Yubikey dies, your 1Password vault is toast. This is a bad idea and doesn't really add much to your level of security.

I can't speak for 1Password, but in general you can have more than one yubikey so that doesn't happen. I have a couple of backup keys in case something goes wrong myself.

I agree.

Which is why I keep a single GPG encrypted text file with all the login stuff to things that matter. Only one password to remember and everything is backed up regularly.

Additionally, it's a bad idea to assume that having only part of a password makes a password uncrackable.

it should be roughly equivalent to knowing the salt of the hash you're attempting to crack, right?

"Next, I set my 1Password master to a combination of two passwords. "

OP made it clear one of the two items being combined is "short" and hence if the other item is known it would be much easier to brute force.

(In your lingo, it would be like knowing the password and then having to derive the salt, which is easy with a small salt.)

I made no such assumption.

Reply on news.ycombinator.com