Hacker News Reader

Comment by sagichmal | Hacker News Reader

> Ever since they went to the cloud, I stopped using and recommending them to friends and family.

The whole point of using a password manager is that the passwords I create and use on my {desktop, laptop, work machine, phone} are immediately and seamlessly available to me on all of the other platforms.

As far as I know it is Cloud integration which enables this absolutely necessary and table-stakes functionality. Is that not true? Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind?

View on HN

1password had (maybe still has?) integrations with services like Dropbox where your vault would be stored on a 3rd party service like Dropbox to achieve the cross-device syncing your describing.

IMO this was the more secure implementation (assuming 1password was only storing fully encrypted files on your 3rd party cloud preference) - even if someone broke in your Dropbox, they can’t decrypt your passwords without your master pass.

An end-to-end cloud solution provided natively by 1pass is much more user friendly and easier, but requires putting an order of magnitude more trust in 1password’s security architecture (which of course is closed source).

The fundamentals are still the same, everything is encrypted with your master password before being sent to 1Password's cloud. So even if someone infiltrates 1Password's storage, all they get is encrypted files, same with Dropbox.

If that’s true, than the point I made about better security with Dropbox is moot.

As an end user, it’s abundantly clear that all encryption/decryption is done locally when using the Dropbox integration since you can see the files directly in your Dropbox. I guess I didn’t make the same assumption about the 1pass cloud service for some reason.

This option [1Pwd vault stored in Dropbox] is still available; I've been using it for years. Highly recommended!

Just adding to this accurate statement, you can also sync a vault in iCloud. So there are at least three syncing methods:

1. 1Password Cloud

2. iCloud

3. Dropbox

And at least 2 and 3 can be used simultaneously, which is what I do, with my main vault in iCloud, and temporary vaults, e.g., passwords for a particular job, in Dropbox.

There’s also still the WiFi sync method which you can use to sync between devices without that information ever leaving your local network.

I trust 1Password 100x more than I trust any individual to keep password information safe.

> 1password had (maybe still has?) integrations with services like Dropbox

It's not as seamless as having the functionality built-in. You have to deal with logins, authorizations, etc. I wish it could be as easy as "Do you allow 1Password to use Dropbox? (Y/N)".

It isn’t more secure, unless you’re asserting Dropbox cloud is more secure than 1Password. 1Password still encrypts it on the client side.

> The whole point of using a password manager is that the passwords I create and use on my {desktop, laptop, work machine, phone} are immediately and seamlessly available to me on all of the other platforms.

That isn’t the whole point of 1PW though, or at least it wasn’t at the beginning, as I saw it. It was a way to avoid having to remember a unique, secure (read: probably hard to remember) password for every service that requires one. A place to store them all so you don’t have to remember, or worse, reuse the ones you can remember, and/or use easy-to-remember ones (read: less secure). It’s in the name: one password gets you access to all your passwords. Automatic form filling and cloud sync are definitely selling points and certainly convenient, but they are also risk vectors. I’d not call cloud sync essential; I get by fine without it. I just use the WiFi sync option.

If the goal is to avoid having to remember strong passwords, then a strong password generator + a paper journal is resistant to more threat models and should be preferred.

Password managers without transparent sync and autofill UX are a half-product at best.

It’s probably similar but I’m not convinced it’s preferred. If I lose that journal anyone can read it. If I lose my computer it is most likely locked already, and if not it (as well as 1PW) autolocks itself after a short time.

Also like I mentioned elsewhere, I do sync my vaults, but only using the local WiFi option.

There are nearly infinite vectors to exfiltrate files from your computer, the vast majority of which are currently unknown to you, and would be entirely undetected. And what's more, most of those vectors can be done from anywhere on the planet.

There is only one way to exfiltrate information from a notebook, it requires physical proximity, and it's very likely that you would notice.

Every rational threat model for almost every human on the planet (excepting perhaps major political, cultural, or economic figures) would conclude in the paper journal being the better (safer) choice.

You made a lot of good points here. Thanks for sticking with me and having a nice conversation!

Typing a long, complex password on a mobile device is tedious. Much easier to use 1Password.

The pain of doing that is nonzero, but much less than the pain of keeping the passwords synced manually, or through an intermediary like Dropbox (permissions, having Dropbox installed and running on my phone, etc.)

> Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind?

For what it's worth, I use it with an ssh plugin, so I only store the database on one machine, and connect using ssh on desktop/Android.

It's also pretty straightforward to set up something like syncthing, making it easier for average person.

I'm not in a rush to put the holy grail of my personal info into someone's cloud service that I can't manage or securely delete. I think that KeePass + [Dropbox,Google Drive,etc] is the best solution. You can easily get these files on to your phone for passwords on the go.

> You can easily get these files on to your phone for passwords on the go.

Something like 80% of the value prop of my password manager use is one-tap login (with FaceID) on mobile.

Handwaving this away is failing to understand the product and market at a fundamental level.

edit: literally a paper notebook with my passwords written in it is a better solution in essentially every dimension than a non-syncing password manager.

I definitely see the benefit of storing my passwords locally and not some single point of failure, but I also wouldn't ever claim it's simple or even a good solution. It does help me ease up on creating new account to places I don't need because I think about having to create and sync up a new password between my devices.

How is that a single point of failure? You have downloaded copies on all your devices and the database is encrypted with your own master key, so even if 1Password is hacked there isn’t really a problem, just like LastPass hasn’t died when it had one.

This makes zero sense. You don't want to store passwords in the cloud, but you store your passwords in the cloud anyway!

The concern, which is fair, is that 1password's cloud is a target. And those targeting it have only one intention, which is to steal people's passwords and other information stored in the 1password cloud. In contrast, of course using the dropbox sync approach with 1password does put your information in the cloud as well. But, it's in your personal dropbox account. That dropbox account could absolutely be hacked, but very unlikely by someone with such clear intent to steal your 1password vault. Basically, 1password's cloud is the ultimate target, and your 1password vault in your personal dropbox account is not.

As a non-user of 1password, what's the value of the vault on it's own? don't you need a master password to unlock it?

Exactly.

A cloud you can control yourself.

> As far as I know it is Cloud integration which enables this absolutely necessary and table-stakes functionality. Is that not true? Does e.g. Keepass provide this essential functionality without a Cloud integration of some kind?

Just store it in your regular sync solution. Syncthing works great, and I don't remember any issues with Dropbox back when I used that. I'd imagine that iCloud or SkyDrive would work fine too, for the masochistically inclined.

Reply on news.ycombinator.com