Hacker News Reader

Comment by mholt | Hacker News Reader

Cool project. Unfortunately, the reality with password managers is that if I'm going to use it, then it needs to support Windows, Mac, Linux; have a good CLI; support all major browsers; and have apps and autofill on most mobile devices. And they need to sync, through my own server. Most password manager projects have one or two of these, but it's gonna need the whole package for me to switch to it.

View on HN

Looks like https://bitwarden.com/ meets all your requirements

Its open source(https://github.com/bitwarden), so self hosting is possible as well => https://help.bitwarden.com/article/install-on-premise/

Disclosure: I've been using it for a year now. $10 per year paid plan. Just renewed again.

How are bitwarden/1password better than password manager for chrome and other browsers?

They work outside the browser. They work in more than one browser. They have more features.

This.

I use it across my iPhones and iPads, and all the major browsers on my Mac. Plus, my business partner and I have a shared vault in 1Password for commonly needed account passwords. It’s super useful.

Thanks!

This project has it all except autofill. Okay, to be really honest then on mobile you need to access secrets via browser (UI is responsive though) and there's no separate app for that.

Autofill is not supported and I don't plan to add it on purpose. It's even written in the core project (https://github.com/jarmo/secrets) README:

"does not auto-fill any passwords anywhere (you don't want that anyway) - it's up to you how you will fill your passwords;".

There's one link to an article regarding possible problems with autofills https://freedom-to-tinker.com/2017/12/27/no-boundaries-for-u...

When it comes to mobile apps then I don't find them that important to add yet another possible attack vector (also mentioned in the README) since it's pretty easy to copy-paste whatever is needed.

Add a security team on top of that. Unless I'm a crypto expert, it's unlikely that I'll use some DIY password manager on my desktop. Also agree that browser support is quite a major reality of password managers today. Unless you can do that, you're basically a "secrets storage".

That's a good principle in theory, but how do you know that using any 3rd party password manager is any better? There has been plenty of security problems with all of the major providers as far as I'm concerned.

At least with all these DIY password managers which are open-source you can see all the code, which is not true for any 3rd party custom made solutions.

Also, one of the reasons why I went with libsodium as an encryption solution is the exact same reason - I'm not a cryptograper and libsodium offers an easy and fool-proof API to not mess things up accidentally. This is not true for many other (popular) cryptography solutions.

https://1password.com/downloads

Windows, Mac, Linux, CLI, supports all major browser and supports filling on iOS (Don't have experience with Android). It's just not open source but it's a pretty great package and I'm using it for a long time already.

Have you heard of "pass"? It's a minimal but very practical password manager best used on *nix terminal, but has great extensions and works on Android and iOS. (the iOS app is the main thing keeping me on my iPhone...). Everything is free and open-source.

https://www.passwordstore.org/

Caveat: It's self-hosted.

There's also https://github.com/gopasspw/gopass if you want a compatible Go version.

and this is why I use a Google Sheet as mine :) I know most will say I'm nuts... but I'm sure I'm not the only one out there and I get everything you just described for free.

*edit... well except the autofill, but that's why there is good old copy and paste :)

> I get everything you just described for free.

You get one additional feature that others don't get, and that's Google and likely all sorts of government agencies being able to record all your passwords. Great feature.

I don't kid myself... I'm not that important... no one is looking through the crap I have on my Google Drive.

Yea you have zero security w/ this solution. I doubt it's even encrypted.

I do something similar except the passwords in my gdoc are secured with https://securemypw.appspot.com/ (disclaimer: I wrote this 5 years ago so I could share passwords with my wife).

This is a really simple and definitely a better solution than not using any password manager at all (if we leave out possible government/Google issues, which I personally would definitely not leave out).

But yeah, as already mentioned - it breaks the privacy and security principles. I would recommend you try anything else, which is actually meant for storing passwords/secrets and when switching, then change all your passwords :)

Reply on news.ycombinator.com