Hacker News Reader

Comment by kitsunesoba | Hacker News Reader

Similar here, I don’t mind the subscription fee and even like that I can effortlessly pull my passwords from whichever device I need to at the moment. The new electron app is a mess though, even if its data layer is done in Rust. It feels like a cheap imitation of the old one with so many little details being wrong, along with the general sluggishness that comes with a “modern” web stack.

I’m not really happy with any of the other options either though. Bitwarden is stuck in the browser, and the various KeePass clients vary a lot in polish.

It seems a little ridiculous because the UI involved in this sort of app is trivial to build and make nice in practically any native UI toolkit released in the past 20 years. It’s just list views and text fields… I would’ve expected the hard part of building a password manager to be the functional bits, not the UI.

View on HN

Right!? The hard part is integrating nicely with the OS, which is just not something that's in Electrons bag. The thing Electron "improves" for them is portability for the one thing that users really want to avoid interacting with. It's just such a confusing business decision in my eyes, and to be completely honest, part of the reason I'm looking at switching is literally that they are making a decision like this unprovoked when they have a great native app already, I just don't understand it and don't want to support a business making shit decisions like that.

Someone in this thread suggested Strongbox which looks very promising. I will stick with 1Password until they've decommissioned 7, and then make my decision whether to stay or not I think.

In Apple land you have Strongbox or Keepassium. Both are fine projects based on Keepass technology so you are basically safe and the developers are even in cool terms with themselves.

Looking around, on macOS there’s also MacPass[0] which looks decent (good enough that I could see myself contributing for the last few % of polish), and gnome-passwordsafe[1] looks reasonable on Linux (if a bit too mobile-y for a desktop app). The only notable hole in the platforms I use is Windows… perhaps it’s time to spin up a WinUI Keepass project.

[0]: https://github.com/MacPass/MacPass [1]: https://apps.gnome.org/app/org.gnome.PasswordSafe/

The issue I see with KeePass as an standard password format is that, afaik, it does not have the native concept of OTP which is critical these days. I understand some developers have come up with ways to store the needed information to generate the OTP in some of the metadata fields. But that does not guarantee OTP interoperability between different Keepass implementations accessing the same Keepass database.

For example, using MacPass I can access my KeePass DB managed by Strongbox from iCloud Drive but the OTP field seems to be opaque to MacPass, it does not know what to do with it.

Here's a +1 for Strongbox. It plays nicely with my Keepass/Dropbox sync setup. Been using it for a few years definitely worth the price.

Agreed.

Porting an app as security sensitive as a secrets manager to a client with an attack surface of Electron seems just fundamentally dumb.

The new Mac app has a lot of OS-specific code for those nice integrations. Their new client is a mix of Rust, Electron UI and Swift with all secure processing and OS handoffs done in Rust and Swift.

No one owes 1Password anything but the engineering reviews often seem to miss what they're actually developing.

Reply on news.ycombinator.com