Comment by ravenstine | Hacker News Reader

Comment by ravenstine | Hacker News Reader

Yes, and the only practical answer is to consider how many of these subscriptions you actually need.

For instance, I see no reason why a password manager should be a SaaS. I don't care how long these companies have been around thusfar; in my opinion, using a password manager as-a-service is asking for trouble and is a waste of money. The closer you approach "perfect" security, the more of your personal security you end up handing off to someone else for their profit. Having a handful of sufficiently complex yet memorable passwords and something like Authenticator or Yubikey might be an appropriate compromise.

Image editor? There's Kirta, GIMP, and Inkscape. No, they're not as good as Adobe software, but maybe that's less important to you than not paying Adobe.

Maybe just using Apple Notes can be good enough for you, if you can get used to it. No subscription necessary. Back it up on occasion. There are of course other note taking apps that aren't SaaS.

Too many streaming services? Consider watching less in general. The less you live vicariously through fictional characters, the less those fictional worlds will matter to you. Spend that extra time learning a skill or spending non-screen time with others. Not watching television only seems abnormal in the context of the last half century.

Tired of "live service" games? There's a million older games that you buy once, probably for way cheaper, and don't have a ton of bugs. Nothing is wrong with older games.

Subscriptions are mostly a problem for those with FOMO. Don't care so much about living in the now. Create some distance between you and the technological machine while still being able to interact with it when you think it's sensible. The only way that companies will back off from everything being a subscription is if enough people who don't appreciate it actually take action in their own lives.

> No, they're not as good as Adobe software, but maybe that's less important to you than not paying Adobe.

On the Mac at least, some of the alternatives to Adobe are better for the vast majority of users and aren't on a subscription model.

For example, Affinity has a universal license for $99 where you own Publisher, Designer and Photo for macOS, Windows and iPadOS. This is like being able to buy Photoshop, Illustrator and InDesign from Adobe without a subscription [1]:

    Experience the full power of Version 2 of Affinity apps with the
    Universal License. For just one discounted payment, you can get the
    ENTIRE Affinity suite (including Publisher for iPad!) on all your
    devices, across macOS, Windows and iPadOS.

If you only need one app and not the entire suite, you can do that.

Acorn [2] is a great image editor for macOS that takes much better advantage of the Mac platform than anything Adobe has recently put out. Unlike Adobe, this indie developer doesn't have to make a UI/UX experience that both works on macOS and Windows. It can do much of what other image editors can do, in addition to being programable with AppleScript or JavaScript. The UI is much easier to use than most other mid to high level image editors.

I've been a customer for years because the support is great and the upgrades have always been reasonably priced. A license for Acorn is $40.

OmniGroup provides the best of both worlds with all of its macOS, iOS and iPadOS software: you can purchase a license, pay a monthly subscription or add a web subscription [3].

[1]: https://affinity.serif.com/en-us/

[2]: https://flyingmeat.com/acorn/

[3]: https://support.omnigroup.com/buying-mac-apps/

> why a password manager should be a SaaS

While I fully agree with you, how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering?

While I don't use this feature, but it is common for ppl to share an account. How can I securely share credentials with family members?

But what you're really asking is how can you share them conveniently and quickly.

Maybe the answer is, you can't. Write them down, text each other, call each other and read it over the phone.

Making a spare key for my parents to get in my house isn't "click a button easy," I have to go to the hardware store -- and maybe THAT'S the appropriate level of difficulty.

I'd rather just pay for the subscription, honestly. Especially in a bigger family or team / company context. To each their own.

I'd advise against it.

Again, what many of us are saying is third party password managers are always a bad idea for fundamental reasons. Before, it was just the account owners and the site. Now there's a third party that has some kind of access, and that third party is a juicy target.

Under what guarantee then? Why believe they are safe, especially since time has shown that many are not.

It's dumb, and I will continue to maintain that it's dumb right up until one of these companies offers indemnifcation or some other serious grown-up guarantee.

I will pay for your service if and only if you pay me if/when you mess up.

The modicum of security these companies offer are better than the nonexistent security practices at the places I've worked for, lol. I trust them way more than the average user or small business.

ya got me there. but still, we can do better :)

we can, but the average user not!

if you are tech savvy, like to keep up to date on security and are ok with the hassle of setting up a NAS, sync stuff and know how to keep it secure, perhaps. If you had to pay me to do it for you, a few dollars service fee might be much cheaper...

Don't. Sharing a Netflix account with your family is easy. Send it in the whatsapp group if you need to change the password or something -- how often are you going to do that in your life? Not enough to justify handing over all of your password to a 3rd party and paying them money for it.

Anything more important than a Netflix account you don't share at all. If they need access, just call them.

> how often are you going to do that in your life?

Small startups use password sharing tools to share passwords with new employees (think db passwords or other saas accounts). This happens at least a once per month in a 10 person organization.

That's the intended use case IMO and it absolutely makes sense. I used to share passwords in Slack before and that made me uneasy, the company investing in a password sharing SaaS absolutely made sense. However, I do not manage 100+ people at home and thus have no need of one.

I use Firefox's built in password manager and it syncs across all my devices pretty well. The UX is not great because on mobile I have to navigate to Firefox, go to Logins, type in my phone's passcode, then search for and copy the right password, but it's secure and works well enough.

> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering?

Syncthing. Set up once, runs reliably forever.

> How can I securely share credentials with family members?

I don't do this either (and don't know anyone who does) but I imagine it'd be easy to just create a different shared database for the family for that? With password store, it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though.

Syncthing doesn't work for iOS https://forum.syncthing.net/t/syncthing-for-ios/16045

> it's also possible to set multiple different gpg keys for a specific directory. I don't think the last option is doable for most people though.

this seems really complex...

I used syncthing for years and never heard of those features

keepassxc + syncthing this is the way

android: keepassdx off f-droid + syncthing

Of course it doesn't work on ios. The issue you linked explains that a syncthing ios implementation would be useless because the background process can't run and the way filesystem access is managed makes the whole thing more or less pointless. It's available on all better operating systems though: Windows, macos, gnu/linux, android/linux, I think even chromebooks can run it?

> this seems really complex...

Like I said, it's probably not a solution for many. A second database with shared secret is very straightforward and transparent way that anyone can grasp I think. It would definitely pass the family test for me.

that's on Apple, not on Syncthing. Guess what, when you lock down your devices so much they can't perform many useful functions. Next time, just get a phone you can actually own.

Yes, purchasing a phone from an advertising company hellbent on gathering as much as they can from you sounds much more positive.

You can erase Google's OS on the Pixel phone fairly easily and replace it with your favorite ROM. In fact one of the reasons I switched to Android is adblocking. I can't stand the amount of ads I had to see on iOS, especially from apps like youtube or even the app store itself.

Syncthing is really key, no need to pay for photo sync services, just send it to your Nas or desktop, no need to pay for password managers, just sync it, no need to pay for notetaking apps or todo apps, just sync Obsidian or Joplin.

You can use a keepass file synchronised with syncthing or a similar peer-to-peer sync system. To securely share credentials, you can share a separate password file with a unique password. There might be issue with file conflicts, but I find these can usually be managed manually; You might also be able to use a crontab.

Syncing? Just load it onto some cloud storage provider you already have. That’s what 1Password used for years before they decided to go the subscription route. It worked great.

> how do you sync passwords across my 3 laptops and 3 phones without a SaaS offering?

With 1Password 7 I did this with their built-in local syncing feature. I don’t want my passwords in the cloud. I’m happy to manually sync them once a month (or probably less these days). But they removed it in version 8 and forced users into a subscription so I’m not upgrading. Eventually I’ll move to something else, but it’s still working for now.

I keep a Keepass compatible password database file in my iCloud folder so I can access it from my computer and my phone with appropriate apps.

So it's still SaaS, except you're using it for storage and sync and doing the password stuff yourself.

My passwords are encrypted without a SaaS, they way I want to sync them is using a SaaS, but a different, one of my choosing.

With Bitwarden you can sync on the free plan.

This is exactly correct.

The only things worth paying for as a subscription are things that require continued human working, or at least a human on-call, period.

In my experience, everything else that's worth it ought to be able to survive on donations (either of labor or money).

I disagree with the password manager as an example. If you don't like the SaaS products offered by some password manufacturers, then don't use them? There are many other non SaaS options.

A large chunk of the world lives in the cloud, whether its Azure or AWS, there is an enormous amount of infrastructure that is sitting in the cloud as a service.

For many a SaaS password manager is better security for them than what they're doing now by remembering all of their simple passwords. Many people don't know how to use Yubikey's and the sort.

"Cloud" isn't a reason for password managers IMO. Password managers don't need to sell you cloud subscriptions for you to use cloud in the same way desktop apps don't need to sell you OS licenses for you to use a desktop app.

And yes personally I avoid purchasing them (see post title) but it's just another thing to filter out. Especially since sometimes apps actually have useful/novel cloud integrations and other times they just want the subscription money from making you put it in their choice of cloud.

Reply on news.ycombinator.com