Hacker News Reader

Comment by tptacek | Hacker News Reader

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so).

There are four issues that I'm currently aware of with 1Password:

1. They've converted from flat to subscription pricing.

2. They're pushing people to a 1Password-managed cloud sync system instead of the a la carte sync they were doing before.

3. They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults.

4. Now that they have 1Password.com, first-time enrollment in 1Password requires you to interact, once, with 1Password.com.

Of these, only (4) is a serious security concern. Their last release further eliminated the native app's dependency on 1Password.com. I'm confident they'll get all the way towards decoupling them, but I'm not them, so grain of salt.

I have no relationship with 1Password other than as a happy customer and as someone who does research in the field they work in. Having said that: I strongly recommend that you be very careful about what password manager you choose to use. The wrong password manager can be drastically less secure than no password manager. I recommend 1Password, and there's currently no other commercial password manager that I recommend. I'm sorry I can't go into more detail than that. :(

View on HN

"1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords"

That's true - but playing hide and go seek with the non-subscription version is uncool.

I was using an old version of 1Password, it stopped working for me on Sierra so I went to upgrade and the upgrade page had broken images and talked about working on El Capitan. I sent a support ticket (in February) in to make sure the upgrade would work on Sierra and had a back and forth where they ultimately said, "Like you saw, that web page hasn't been updated in awhile as Sierra is the latest macOS. Knowing that there is a better way to do things, in good faith we couldn't continue to sell a lesser product like the stand-alone license. Due to this, we are moving away from the stand-alone license and heading to higher and better pastures."

I got a marketing email about a week later from Dave Teare and replied expressing my disappointment that publicly they're saying the stand-alone model will continue indefinitely but privately, they're "moving away" from the "lesser product" that they couldn't in good conscience sell me any longer. No reply.

The actions of Agile Bits are not matching the words in my experience and that's a big deal given the type of software they sell.

On what planet is this not a concern:

>3. They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults.

1Password has absolutely used local vaults since its inception. They STOPPED supporting them in the latest version which is ridiculous, frustrating, and feels like a bait and switch. Had I known that was going to be their tactic going forward I never would've bought version 4 for Windows.

And no, I don't want to hear about how "version 4 still works just fine" - version 4 has all sorts of bugs, on windows 10 frequently hangs for minutes at a time when unlocking the database, and in general looks like it was written as an after-thought.

I thought I was going crazy fighting with their staff about the existence of this bug.

It makes it maddening trying to get on a website, and having to wait for the vault. Input queues up in the meantime, meaning I can't click or type on other things. Then suddenly, my mouse will shoot around the screen and my characters will get typed to wherever I was.

I use 1Password on Windows 10 (and iOS) and "hanging for minutes at a time" has definitely not been my experience anywhere. It works well enough for daily use. The Chrome integration sometimes does stop working (about once a fortnight or so) but Help > Restart 1Password Helper takes care of that.

Yes the UI is "classic Windows" not "modern UI"[1] but written an afterthought seems a bit harsh.

[1] https://i.agilebits.com/db/2014-04-02_14-11-43.png

I changed from LastPass to 1Password for big part because it was "pay once, use forever" instead of LastPass' subscription service. It hasn't even been 3 years since I switched and I paid what felt like a lot of money, but I figured that it would still be less over all in comparison. Now I can't get my vault to sync on my Windows machine and last time I reinstalled my Mac it was a hunt for the right executable.

I've been considering just going back to LastPass, but it all seems like a hassle. Why am I even paying for these companies if I can't rely on them? I should be paying because I don't want to deal with this shit. Which is ironically why I've toyed around using ownCloud and KeePassXC

What was unreliable about Lastpass? Anecdotally, I've been using it for quite a while and have never had it fail. 2FA, easy sharing, dead mans switch to give access to a loved one if they request the access and enough time elapses, etc. Security wise, despite several network breaches (which should be expected to happen at some point with any networked computer system), the database has remained secure because they do encryption right, and when Tavis sussed out bugs in the client they patched them immediately. You moved from a highly reliable service with a subscription to another service with no subscription that turns out to kinda suck for your needs. No shame in switching back to what works.

You can switch again to a homerolled solution like you are suggesting, but you're not going to "no deal with this shit", you are now your own IT for this shit you homerolled.

I wasn't trying to imply that Lastpass was somehow unreliable, I simply switched away from Lastpass since it had yearly subscriptions VS. 1Passwords 'pay-once-own-for-life' model.

But since now 1Password is changing their subscription model if I were the use Lastpass, what would happen if one day they would shutdown their services? At least with 1Password I have (or had) my local vault in Dropbox/iCloud/whatever and I could still use it.

So next step beyond that would be to roll "my own" (obviously using software written by actually smart people) password management system which used open source and self hosted parts. That way I factor in upfront the "I have to deal with this shit" part and it doesn't come as a surprise years along the line when the company I'm relying on goes belly up, or changes their business strategy or whatever. Obviously it's not perfect, but I have to consider things. It's not wise to just rush into things.

LastPass Premium is $1/mo and your password vault is exportable. It's a pretty cheap service to be locked into.

I use keepassx and Dropbox. Works beautifully everywhere!

I sort of want to go whole hog if I go with KeePassX/C and roll my own cloud as well. I already have the parts set up, with TLS'd ownCloud and KeePassXC vault and I've mirrored my password on it, but I still don't trust it enough to use it over 1Password.

The 1Password situation is complicated because the people who run the company make it so. There's always been a push to get more income with less effort, not that that's wrong. But what frustrated me, and finally moved me off of 1Password, are the instances where the founders and staff responded in an obstinate way that "this is just how we're going to do it, and we've decided not to hear anyone, however loud you may be." Then after sometime when the noise seems high enough to cause damage, they backtrack (like it happened with the MAS-only decision). The only word I can use to describe AgileBits is "disingenuous". It sounds harsh, but it has a history of being so.

AgileBits has also used dark patterns, if I may call them so, on the website to hide or obscure what's available but not considered favorable by the company, and prominently push what's considered favorable by the company as if that were the only option available (one visit to the home page in the last couple of years is adequate to get this). This ought to be shameful for any software company, especially one that claims to care about the users.

When it was originally created and stabilized, 1Password was a great solution, almost like Dropbox in simplicity and value. But the focus has been sorely lacking on other platforms, like Windows (and of course, nothing on Linux). There doesn't seem to be a lot nowadays to justify what the end user gets from the subscription when there are other options out there (that didn't exist several years ago).

Ever since I started using Linux, I've looked for solutions and have been trying Enpass once in a while. [1] It's free on all desktop platforms and has browser integration.

Edit: Of course, it's also been quite sometime since I started using Keychain Access and Safari on OS X/macOS/iOS.

[1]: https://www.enpass.io/

For Windows, there is "1Password for Windows" and 1Password 4. I've never used the "for Windows" version, but I believe it's cloud only. 1Password 4 allows local vaults. However 1Password 4 is in maintenance mode and missing lots of nice features, like searching two vaults at once.

Also they don't sell licenses for 1password 4 on Windows anymore. On Windows after the 30 Day trial your stuck or forced to go cloud...

I have the Mac and the Windows licenses for 1Password. Windows 1Password 4 is a nightmare to use with its terrible UI and its buggy Chrome plugin integration.

I agree, it's not great. I use it in Linux under Wine. But at least it works, and is definitely better than nothing.

> They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults.

1Password 4 for Windows uses local vaults just fine - I'm using it right now. The new 1Password 6 for Windows does not support local vaults.

Right! Sorry. I don't use Windows. Honestly? My recommendation about password managers probably shouldn't extend to Windows; there might be no password manager I confidently recommend on that platform.

That's not a statement about 1Password; it's about the fact that the security models are different on the two platforms, and I'm very familiar with how 1Password works on macOS and less so on Windows.

It would appear making a password store on Windows would be rather simple, wrapping DPAPI:

https://msdn.microsoft.com/en-us/library/ms995355.aspx

At that point you should probably be about as (in)secure as access to the platform is. I don't know how you could improve much on that (assuming secureboot and bitlocker encrypted disk).

Is there some magic going on the MacOS side that somehow improves on this?

Yes! The actual encryption of passwords is not the hard part of a password manager (though, of course, commercial password managers seem plenty capable of screwing that up!)

The hard problem is getting the passwords out of the encrypted store and into form fields in your browser.

Would you consider the KeePassHTTP solution to be adequate (they have a browser plugin that acts as a password manager using the browser's APIs and the passwords are retrieved after authenticating the plugin with the KeePassXC server -- which prompts the user each time and only entries that match the URL are sent).

They also support copying the password to your clipboard (which they then clear after a few seconds). There's also the automated entry system which basically emulates keystrokes.

This is what led me to move to their subscription model (and I'm sure it was intentional).

1P4 for Windows was the last version that was "buy once and forever", but they weren't providing good browser integrations for that version.

I am happy to support them though, and gladly used their products.

I definitely don't want to have to unlock my vaults on their website though.

Apart from 1Password 4, there used to be a lesser known 1Password for Windows Modern Alpha/Beta[1] which was a UWP app and supported local vault. The Windows Modern version is no longer in development as far as I know, but I hope they add local vault support to the 1Password 6 for Windows in the future (even though I'm a happy paying 1Password.com user).

[1]: https://www.microsoft.com/en-us/store/p/1password-alpha/9nbl...

> I recommend 1Password, and there's currently no other commercial password manager that I recommend.

Are there any open source password manager products that you would recommend?

Total aside here, because I know what you mean, but it's interesting that many people include open source software in their definition of "commercial" software, the DOD and other government agencies, for example. https://www.dwheeler.com/essays/commercial-floss.html

A very large number of free software projects are commercial (either because distributions sell support for them, or the project itself costs money). The license for a piece of software has nothing to do with whether you sell it or give it away for free. Richard Stallman used to sell copies of GNU Emacs back in the day.

Very true. But what's interesting and non-obvious about the way the DOD defines "commercial" is that it doesn't depend on money exchange (or lack of money exchange) at all, and that's what that article by David Wheeler is trying to say.

The DOD defines software commerce as anything available to the public and used for any non-government purposes.

http://dodcio.defense.gov/Open-Source-Software-FAQ/#Q:_Is_op...

So to take your comment one step further, for some organizations, the definition of commercial also has nothing to do with whether you sell it or give it away for free, even though many people reasonably assume commerce==sales.

Keepass and its various forks are open source. Keepass itself uses dotNet so Linux guys need mono which not all people like. Those people use KeepassXC (a fork of KeepassX which is Keepass in C++ and is unmaintained).

I use Keepass. Reasonable security but ugly gui in linux due to mono. Has plugins. Completely offline.

ditto.

+ kpcli for TTY use, keepassdroid for android, sync to owncloud, voila.

If you are extra concerned with security after storing your file remotely, you can have it use an addtional external keyfile in addition to the which you manually copy to 'authorize' devices

If you can stomach an electron app Keeweb is a nice keepass compatible alternative.

This looks nice.

How has your experience with it so far?

I have been using keeweb on mac, it's a delight.

I can't. Atom has given me electron trauma (older versions about a couple of years back).

Then forget about it. Keepass2 and KeepassXC (depending on your OS) are the best of the best.

Have you used KeepassXC. I am panning to move to it from lastpass, and want to make sure I am making the right choice.

KeepassXC does not support the latest kdbx 4 format which was recently released with Argon2 support. (which is supposed to be more secure). It will be supported in the next release 2.3.0. So for now I use Keepass until it supports kdbx 4 then I will move back. It has no plugins though compared to keepass.

Other than that it has better gui if that is your thing (Keepass is ugly). It is mostly a fork of keepassx which is still usable but KeepassXC merged all pull requests and fixed a load of bugs in keepassx after the maintainer stopped maintaining. Try it. It works. It also has mutilple releases (snap, appimage etc.).

I've used KeePassXC, and I think it's the best KeePass variant. I don't like stock KeePass because it's horribly slow under Mono (Linux/OS X). And I like but am not as satisfied with KeePassX because it lacks some features I like. From what I recall, the maintainers of KeePassXC got frustrated with the feature set and development pace of KeePassX, so they made their own fork. And they added nice things like TOTP code generation (i.e. Google Authenticator style) and YubiKey support.

I can't yet wean myself off of LastPass though, just because it's synced everywhere and is more reliable when doing form fills on websites. For example, KeePass and its variants don't have a concept of equivalent domains. For "equivalent domains" I should be prompted with the same lists of auto-fillable credentials, such as:

* youtube.com/google.com/gmail.com

* bing.com/hotmail.com/live.com/microsoft.com/msn.com/passport.net/windows.com

* apple.com/icloud.com

LastPass gets this right, but I sadly haven't seen any other password manager that does. I think there's an open issue with KeePassXC to address this but it's not merged or production ready.

With KeePassXC you would do this by adding new entries for each alias and then reference the username and password values of the "base" entry. I believe the feature still isn't in a release, and the UX isn't there at the moment.

The problem is that they can't deviate from the official KeePass database format, so adding something like aliases requires hacks like the above.

KeePass is moving to a new file format, KDBX 4 [1]. It includes Custom Headers feature that might enable plugins to implement URL Aliasing.

KeePassXC doesn't support KDBX yet, but they'r working on it[2].

[1] http://keepass.info/help/kb/kdbx_4.html

[2] https://github.com/keepassxreboot/keepassxc/issues/148

With KeePass you create a new entry for the domain, then make it refer to the original to avoid duplication of user/password. But yes: allowing one single entry to be used for multiple domains would make much more sense.

What's making you want to move?

KeepassXC recently added support for Yubikey OTP too, in case that interests you.

https://keepassxc.org/blog/2017-06-26-2.2.0-released/

I use KeePass on Linux via Mono (Arch and Gentoo). The UI is no worse than on Windows if you sort out your fonts. We have about 20 concurrent users of the same several DBs (one at least of which has many hundreds of entries) on a network share.

It is absolutely rock solid.

I'm not sure that KeepassXC can be considered unmaintained - their last release was in June, this year - https://keepassxc.org/blog/ . Also note the monthly tone of the updates - even the koolist of kool dev kids kant complain that is slow 8)

I think he's saying that KeepassXC is a fork of KeepassX, which is unmaintained.

It's not quite ready for prime time yet, but my company is working on Passit[0], which is going to do open source cloud-based password management. Feel free to check it out; we hope to do a 1.0 release soon.

I've been working on the marketing a bit, and the sense I get in this space is that, like home security, password security is a series of trade-offs. One size doesn't fit all; different situations require different needs, and everyone tries to balance the safety they want to feel with convenience that they desire.

So, in our case, there are a couple of good options. You could operate on a hosted service and get the cloud-based benefits without needing to worry about infrastructure or updates, or you could self-host and trade a bit of hassle in exchange for trusting the host and verifying that the updates will do what they say they're going to do.

[0]: http://passit.io

I use pass, written by zx2c4 of WireGuard fame: https://www.passwordstore.org/

My favorite thing about it is that it uses standard tools I understand, and I can back it up and version it with git.

It doesn't have a browser plugin and will not work with my iPhone... So it's a no-go for me and I guess many others.

pass has a variety of 3rd party browser plugins and phone apps that work with it. Admittedly, it's not a turnkey solution and so is unsuitable for a non-technical audience.

I recommend website-based password managers to my non-technical friends because they're easiest to use and therefore most likely to actually BE used, and the security vulnerabilities noted in the article are very small compared to not using a password manager at all.

I wouldn't let any password manager touch my browser. Giving attackers access to your password manager's APIs via JS or DOM elements is how most (all?) of the dozens of severe LastPass bugs have happened.

Pass - Password Store by Mingshen Sun https://appsto.re/gb/DY13hb.i

As a 1Password customer who's been pretty unhappy with how the company took my money for a full version and has, since, been pushing me towards a subscription (making the non-subscription version/features harder to find, no Windows version, etc), I'm seriously considering switching over to Enpass [1]. The UI is pretty similar to 1Password and most of the features are there. It can sync with Dropbox and a few other cloud storage services and their monetization strategy seems pretty reasonable (desktop is free, mobile costs $9.99). I'd encourage any disgruntled 1Password users to give it a test drive.

[1] https://www.enpass.io/

Have you put much energy into making sure that Enpass is secure? Do you know who's reviewed it, and what their review looked like?

It bothers me when people point to other password managers as alternatives to 1Password because of packaging and pricing issues. It's easy to find other commercial password managers that have attractive packaging and pricing! That's not the hard part!

I happen to like 1Password as a product, but that's not why I recommend it.

Since neither of them are open source, I haven't put energy into making sure either of them is secure. Not being a security researcher or having access to either product's code, I'm not sure how I could be expected to perform that level of evaluation, but I've built systems that have passed security reviews and, from a non-privileged access point of view, I see little difference between the two. Enpass does seem to handle security incidents in a pretty responsible fashion. They post blog updates on vulnerabilities (e.g. https://www.enpass.io/blog/an-update-on-the-reported-vulnera...) after releasing fixes. It's great that you recommend 1Password based some other criteria, but I'm not sure why your recommendation should mean anything to me unless you've been given some privileged access to their code that the rest of the world doesn't have and if you have been given that type of access, it's irresponsible of you to denounce other products unless they've denied you similar access.

What I can see is that 1Password is pushing users towards a model that's fundamentally insecure. Their web-based products require a level of trust in 1Password (the company) that none of us should be willing to place in any company. What we've learned from Snowden is that any cloud provider can be secretly made to bend to their governing body's will. Running closed-source software on our own computers involves a level of trust in the authors of that software. That's just a fact of life when software isn't open source. But when code is pushed out into the world, it can, at least, undergo some scrutiny/testing by people outside the company. This is not true of software running on the company's servers. In so much as the security of 1Password requires executing a single, line of code on servers controlled by 1Password, the product is insecure and fundamentally unauditable because that line of code can be changed at any time without users being made aware.

The other point that should probably not get lost is that we're dealing with levels of security. In advocating for password managers, the interface absolutely does matter. Most computer users haven't adopted any password manager yet. When comparing a secure but difficult to use password manager, a potentially insecure password manager with an easy-to-use UI and a combination of insecure passwords, post-it notes and all the other terrible ways that users have of "managing" their passwords, the middle ground is likely to come out ahead for all but the most technically adept users. Need proof? PGP/GPG passes security reviews but has terrible UIs...what percent of emails are PGP/GPG encrypted? We shouldn't let the perfect be the enemy of the good. There can be different classes of security products for those that need protection from state-level actors and those that don't. Because people who are worried about that level of attack are generally willing to undergo a lot more pain to stay secure than your average user is.

> Have you put much energy into making sure that Enpass is secure? Do you know who's reviewed it, and what their review looked like?

I'd really like to know this as well.

I'm aware that LastPass doesn't have a perfect security record, but because of its prominence it gets lots of attention from hackers and security researchers, security issues tend to be well-reported, and the responses to them seem to be reasonably transparent and proactive.

In contrast, Enpass appears to be a side-project of a small app development house in India. Did a miss a memo where Security Expert X said Enpass is better than LastPass?

I don't understand this mentality of getting angry that a company wants to migrate to a subscription fee so they can have sustainable income. You have a full version, so continue using it, but it's not fair to expect updates for free in perpetuity across platforms and browsers in today's churning software ecosystem.

1Password is an incredibly complex, solid and polished suite of software products that provides an essential security function. It absolutely boggles the mind that people get up in arms over the idea that they would be forced to pay $36 each year to use it.

Did I ever say that I expected "updates in perpetuity"? I said (in another comment from the one you replied to) that I expect the software to "work in perpetuity." That's a very different requirement that requires AgileBits to do absolutely nothing except not tie it to their own cloud services. But I did pay them over $60 a little over a year ago, so I think it's fair to expect a few bug fixes. And it's fair to expect them to not hide the download link for when I need to install it, since that's explicitly allowed by the license I purchased. And, since the software auto-updates, I think it's fair to expect them to not push out updates that make it harder to use the software or otherwise push me towards a subscription model that I'm never going to accept.

It boggles my mind that people are so quick to support a company that's making changes solely for their own benefit to the detriment of their customers. I want AgileBits to succeed too. That's why I bought the software despite having access to a license from work. But try this for math...if they release a major update to their software every year and charge, say, $36 to update, it costs the same exact amount to stay on the latest version. As a bonus to them, they get the money all up-front and get to collect what little interest you can get these days. The main difference is that I don't have to worry about their company imploding and taking all my passwords with it. My software will work in perpetuity without any cloud service they provide. That's piece of mind that I need when it comes to my passwords.

Passbolt, give it a try! https://www.passbolt.com/

> 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords

1Password v6 for Windows doesn't work with local vaults, it requires 1password.com

This won't help new users, but for people who own a previous release (before it turned into a "modern app") you can still download 1Password v4 for Windows.

https://app-updates.agilebits.com/

I have it and it's terrible IMO.

As another opinion, I use 1Password 4 for Windows, and am quite happy with it.

Did they add OTP support to version 4 of the windows client? Last I saw it was not supported, so it was not super useful to me.

Not that I know of? I'm not really familiar with OTP, nor do I use it.

I'm happy with it with Google Chrome, which is what I use on my Windows gaming desktop.

However, on my Surface Pro 4 I use Edge, because it supposedly uses less power than Chrome.

If I've understood the 1Password forums correctly, the Edge integration that they are working on will only be in the subscription version. Those of us staying on 4 will be stuck with manually looking up passwords in 1Password.

Fair enough, I don't actually use any of the browser integrations.

Then you clearly don't have to use multiple vaults... I've tried using 4 and 6 together - but that resulted only in tears. Enpass looks ok-ish, although a lot more limited with some questionable UI decisions and features (last used in my browser extension? really?)

Enpass doesn't seem to support multiple vaults at all though...

1Password for Windows v6 is a apparently a complete rewrite and not yet feature complete. It will support local vaults in the future, although 1Password has always been very slow about updates for their Windows product.

https://discussions.agilebits.com/discussion/comment/340062/...

Lastpass doesn't necessarily have the best track record, and you said you couldn't go into detail, but I'm curious so will ask - if you feel comfortable sharing, what securities issues do you see with lastpass besides storing secrets in some companies cloud?

The problem I tend to think of is that they store the urls in the clear, so an attacker (who can bypass SSL) will potentially be able see which sites you have passwords saved for. There's a writeup that mentions it here: http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...

To start, the LastPass browser extension auto logout feature has critical bugs. I've come back to my computer after several days and found it still logged in with full access to the vault (no master password re-entry required) even with auto logout set to 15 minutes of inactivity. After that happened several times, I lost trust in the product.

There is also a serious bug regarding 2FA. There is a race condition where if you know a users master password you can bypass 2FA for 1 single login.

Apparently someone commented below that is a documented "feature". Wow.

It's a "feature" because it relies on a local cache. So it means that the attacker must be using your own unlocked computer (which contains the cache) to bypass 2FA through this "race"; and in that case it might as well install a key-logger instead or worse. The worse it can be said is that it is very confusing and breaks the usual pattern of what "logging off" means, but users should be taught to lock their computer, not log off stuff hoping not to leave nothing behind.

By default the browser plugin is configured in such a way that 2FA is completely bypassed for a second when logging in. This is officially documented, so we can likely assume that it will never be fixed.

https://lastpass.com/support.php?cmd=showfaq&id=2775

This "second" became very noticeable to me once I moved to Sydney. I was actually able to log in to my Gmail before my 2FA kicked in. Right then I decided that, despite being a loyal LastPass user for the last 10+ years, it was time to try something else.

I would prefer a tool that works for teams if anyone has suggestions. I care about how my team manages and shares their passwords. Looking for something that works across devices, and where I can share access but not necessarily share the actual passwords if I can avoid it. I really like LastPass, it's a shame about some of their issues.

I'm not an expert and i haven't tried this, but i would think you could use the pass tool and encrypt the files to multiple gpg keys, and share those files using a git server which you control. That sounds like a rather easy homebrew password manager that supports shared logins, i would think.

Disclosure: happy user of pass, but haven't tried encrypting to multiple identities.

Writing good security software is difficult, but that doesn't stop places who really shouldn't be doing it from trying and succeeding in a business sense. https://thycotic.com/products/secret-server/ passes JSON in URLs, and we're not even talking base64 here. Also, it's called "thycotic" like you're holding your tongue and saying "psychotic". There are more problems that I won't go into.

This isn't a bug, this is due to the offline access option. If your machine has the database locally cached, 2FA won't do anything because your database won't be encrypted with 2FA (not possible), just your master password. An attacker could just copy the cached database and decrypt it with your master password. All 2FA does is restrict who can download your database (both initial and updates), not decrypt it. If you don't like this behavior, disable offline mode.

This is just fear mongering.

> This isn't a bug

Boo hoo. Did I say it's a bug? I said it's a security issue. It's also an exceptionally stupid thing to have as standard behavior without warning. It demonstrates poor priorities and ideas about safety on the part of LastPass.

Well. Not to defend LP, but for those who don't click through, offline mode can (and should be?) disabled.

Perhaps this is a case where a feature that makes some sense in some cases was added, the problem is, outside that scope it's a really bad idea. But then someone said "We'll make it optional..." and the rest was history?

I wouldn't agree that it necessarily should be disabled. Sometimes I'm on my computer with no internet access... If offline access is disabled, I have no access to passwords for locally installed applications.

Makes sense.

What would I do? I'd probably set up a second Chrome user and the LP for that user/browser would be auth creds for only stuff I'd need offline.

That would allow the main LP vault to have it disabled. This mitigates exposure.

> 3. They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults.

Windows had local vault, I used the local vault version synced via dropbox for years.

@tptacek, isn't the fact that you can now no longer separate "developer" and "cloud provider" a security concern as well?

(You can no longer use other clouds than their own...?)

I just keep copies of a heavily encrypted txt file with all of my passwords, and while it's a bit less convenient in theory, in practice I've never had to worry about it or change my system. It's as secure as I choose to make it, and while I've been actually laughed at for this, I'm not in a position to have to trust a company that's monetizing my security as they "evolve" as a business.

> [t]here's currently no other commercial password manager that I recommend. I'm sorry I can't go into more detail than that

Sounds like there's something about to blow?

I just get yelled at here when I leave out that sentence.

Aye, the alternate interpretation occurred to me shortly after posting. Apologies.

There's a couple of ways to translate that. There's the way you did:

> "I know about some security flaws (or behind-the-scenes issues with the dev teams) in other products, but I can't reveal them publicly because of NDAs, etc"

But there is also:

> "I know enough to recommend this product, but I don't know enough about the other products -- not necessarily because I lack the skill, but because I haven't spent the time -- to endorse/recommend them."

Why couldn't they offer the native app with local vaults and subscription pricing?

I don't mind a recurring fee, its just that I want a native (cloud-free) password manager.

I think you can currently do this? The subscription gives you access to 1Password.com syncing, but you should still be able to sync via Dropbox (or not at all).

I assumed not, but after reading this thread it seems this may be possible?

It's crazy that it isn't clear.

Can you clarify if you use the app in some sort of "family" mode, or do you mean solely for an individual's use case? I'm looking for a password manager for me and my wife, so I imagine there's some extra security considerations there, unless I guess we just share a single master password.

Me and my partner use 1Password in family mode. We have a private vault each, and also a shared vault that we can both see. Entries can be moved from vault to vault without re-entering. It's pretty good.

How do you feel about in-browser password managers--Chrome in particular?

I'd just be sure to set your own sync phrase for Chrome, otherwise it's just encrypted using your google account.

The Chrome people, who I respect, recommend it.

But Steve Thomas, who I also respect, has a lot of specific bad things to say about it.

I don't think it will destroy you. But it is not my first choice.

Are these remarks of Steve (not a person I know, but I wouldn't expect to...) public somewhere?

Yes, they're on Twitter.

> as someone who does research in the field

> ...

> there's currently no other commercial password manager that I recommend.

> I'm sorry I can't go into more detail than that.

Hmm. OK. Well. How about this?

Without getting into specific products, can you list the top 10 things a good password manager must do, offer or implement in order to secure the recommendation of someone doing research in the field?

Reply on news.ycombinator.com