Hacker News Reader

Comment by gonehome | Hacker News Reader

Hasn’t tptacek said to avoid lastpass on here (in favor of 1Password) for the last ten years?

I don’t know if he ever got into the details of why (maybe he couldn’t for contract reasons or something), but his judgement on it looks accurate.

I’d be curious what his thoughts are, or if the risks he was talking about back then we’re unrelated.

View on HN

It's literally a bot autoresponse on our Slack, and I didn't put it there. Don't give me too much credit; it was a widely-held opinion.

Do you know what the basis of that opinion was? As an outsider, how do I know that 1Password is managing its own security better than LastPass has?

I'll copy my reply to a similar "but how do outsiders know they're not cheating us?" comment:

They do what any reasonable security company does, and call in vendors who have negative incentive to lie: https://support.1password.com/security-assessments/

I was especially impressed by the Cure53 ones, where they were provided access to the source code: https://bucket.agilebits.com/security/Cure53-1PW18-report.pd...

It would be weird for a security assessment not to include source code access.

One key feature of 1Password is the use of a secret key in addition to a master password.

See page 10 [1] which explains how the secret key provides extra entropy (which makes it much harder to brute force a user who choses a weak password). Also see Story 1 on page 11 [1].

[1] https://1passwordstatic.com/files/security/1password-white-p...

Interesting, have your recommendations changed?

Curious what you think of dashlane. Personally I find 1pw UI patterns a bit annoying and dashlane somewhat better

Reply on news.ycombinator.com