If you're using a *nix system: https://www.passwordstore.org/ I switched over from LastPass a few months ago. It uses gpg for encryption and supports git for password syncing between systems. Pretty simple to set up and use. There are quite a few third party apps for it already (both desktop and mobile)

Does this still have the problem of leaking metadata (site names, etc.) in plain text? I don't want to manually obfuscate them.

If you don't like manually obfuscating things, just keep your passwords in a txt file.

I've been amazed by Pass, but couldn't find a thorough review between Pass and KeePass(x). Is one safer than the other?

`pass` is based on well-established cryptography implementations: GnuPG. GnuPG is recommended by many security experts and used widely by journalists dealing with sensitive disclosures, e.g. the edward snowden documents.

It also doesn't try to NIH some complicated database format or syncing technology but instead uses well-established software (git, plain directory structure and gpg-encrypted text files) which makes it robust, flexible and future-proof, and also responsive to changes in cryptography as it benefits from upstream GnuPG updates. You can use any PGP key structure you want, or even hardware PGP devices like the YubiKey.

KeePass on the other hand seems to be based on mostly homegrown techniques written by people with no or limited understanding of cryptography. (see e.g. [0]) That said, I don't know how much KeePassX continues this trend - but it's based on the same file format so it presumably has to reimplement at least some of KeePass's homegrown crypto.

I don't know how much more convincing you need, but personally I wouldn't even dare consider using anything other than `pass`.

[0] https://news.ycombinator.com/item?id=9727297

Thanks! I'll definitely migrate to pass soon.

One big difference: pass only encrypts the password. All metadata is plaintext, so anyone can see a full listing of what online accounts you have.

pass is as safe as your gpg installation and your gpg key because that's the encprytion it uses.

That's a dangerous oversimplification. By that logic "LastPass is as safe as AES as that's what it uses" which is obviously not the case.

A system is as secure as its weakest component.

I tried LastPass, but didn't trust them, so I found https://www.passwordstore.org/ some year ago. I can't emphasize enough how good it is, mainly because it is so dead simple and transparent in how it works, and also because it has great bash integration, and uses git which makes it easy to sync between your machines. There is also a firefox plugin that integrates with it, but I don't really see that you need it: it is so easy to use at a prompt.

I use password store to, and it works really well. I'm on MacOS but having it to work under Android and Windows was a breeze.

That's brilliant, thanks a lot!

I never trusted "cloud" (read: not yours) password stores. I have been using KeePass and manual syncing, but I had my doubts about it too.

This looks perfect and simple!

Don't use anything that runs in the DMZ (browser), if you care about your secrets.

I use keepassx, which requires manual search, copy, paste but it can store its vault on a cloud drive, mobile etc. and can have a key file or password.

Worth mentioning that one of the major benefits of Keepass is that it is open source. Many of the other providers mentioned here are not.

What do you mean? Autotype is available in KeepassX.

Autotype is a bit risky because it assumes you've got the correct window/element focused. All it takes to expose your passwords is for a pop-up (e.g. instant message) to appear at the right moment.

Even if you don't hit the enter key/submit the form it is still possible for that incorrect window/app to grab your keystrokes.

I had this once, "auto typed" a password into a messenger window. So be careful it can happen at any time. Better use Ctrl+C and Ctrl+V.

I switched to 1Password after Lastpass got acquired. I obviously have no special knowledge how secure it is but it's serving me well. OSX browser integration excellent, iOS integration mediocre.

Disclosure: I work for AgileBits, makers of 1Password.

If you're interested, all our data formats are well documented for review: https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... You might also be interested in the security white paper for our hosted 1Password service: https://1password.com/security/ (White paper is linked at the bottom of the page.)

How easy is it to migrate from Laspass to 1Password? I've had the worst experience with their tech support (reported 2 bugs that have both been scrapped as WONT FIX) and really don't want to support them as a premium subscriber anymore.

Disclosure: I also work for AgileBits :)

We have a dedicated LastPass import option. See here:

https://support.1password.com/import-lastpass/

If you encounter any trouble please write into support at agilebits dot com and mention "Kyle" somewhere in the body of the email and I'll get notified. You should be fine though, but every once in awhile we have someone encounter trouble with the import from LastPass.

Thanks!

I checked out the pricing model and didn't see anything that made sense to me as an individual user. Is there any plan for an affordable individual plan (in the range of 10-20$/ year)?

As a Mac/IOS user, I don't see myself shelling out 60$ for a desktop license and then another 10$ for an IOS license on top of it. I'm sure your profit margin is great, don't get me wrong, but as a buyer that is just overkill.

The individual plan is the lowest cost subscription option, and standalone is an option if you would like to try to spread the cost out between releases, but you would have to pay for any major upgrades as those are not included.

I'd say many people don't need the Pro features in the iOS version, it's possible that maybe you won't either? Depends on how you use it I guess. Probably the biggest reason to get the Pro features is multiple vault support (you can add additional vaults that were created from the desktop versions). With the free version you only get the one vault.

If you use the app like most people, you'll be using it dozens of times a day. Even if it's in small interactions those do add up. I've been trying to convince the team to add some sort of individual statistics that were stored locally for users to see, but I suspect this would probably help you decide that regardless of price it would be worth while :)

In the end, the choice is yours though. We certainly want to hit the price point for all users that we can, but we do have to keep the lights on or the product disappears. We aren't priced at a point where we're trying to acquire users in bulk so we can sell to another company. AgileBits is privately owned and has never taken outside funding. Something to be aware of when you're talking pricing I suppose. At least one factor.

Kyle

AgileBits

I appreciate the honest response. I couldn't find an easy link on mobile to explain what those Pro features were and it sounds like I don't need them after all. I just need to be able to share a database of passwords between my few devices for personal use.

Purchasing 1Password for 65$ gets the current major release with no updates?

Subscribing to 1Password Families for 5$/month: Lets me sync passwords between all of my desktops and phones? Can I sync an encrypted password database or is this done as a hosted cloud solution by 1Password?

Sorry for the delay in response here. I eventually had to go do some of my regular duties and that meant closing the web browser at some point yesterday :)

$65 gets you a single license for Mac and Windows. This can be installed on multiple Macs or PCs you own, but is generally for 1 single person.

You get all updates to 1Password 6 for Mac for free, and any updates to 1Password 4 for Windows for free. On the Mac side, we are planning a 6.5 release in the next couple months. Most of the changes in this release will center around 1Password Teams/Families/Individuals (the subscription option). Along with bug fixes that likely impact both. We are likely nearing the end of the road on version 6 after that.

With the $5/mo you can technically do two things...

1. You can use the hosted solution 2. You can create local vaults (like the standalone version does) and sync those using Dropbox, iCloud or Wifi (to mobile devices)

So, with the subscription option, you get both. Whether you use the hosted part of it or not is up to you. However, if the subscription goes into frozen state (unpaid) the app will go into Trial mode, which limits you unless you re-subscribe or purchase a standalone license.

I currently use both local vaults and the vaults for my work Team and Family account. Mostly the local vaults are for testing purposes but it all works fine with a subscription.

Let me know if that helps :)

Kyle

AgileBits

Thanks for the informative response! I may try out the subscription.

I put my elderly parents onto 1Password and they "got" it.

The hardest part of the migration for my parents were 1) demystifying the spaghetti mishmash my Dad had in place to manage his passwords, 2) getting Dropbox set up correctly between Mom & Dad for vault sharing, 3) training my Mom how to use, and 4) educating Data on how to manage website edge cases.

I would hope that 1PW has a LP migration tool, but if they don't, Dad was able to clean up his historical garbage one by one. The password capturing process in 1PW is good enough that this worked nearly seemlessly.

Finally, I've had nothing but positive results from posting questions in the 1PW forum.

Long time 1Password user here. I use it on bunch of Machines and I wish you guys supported Linux. :(

Heck 1Password mostly works under Wine, except perhaps there is no unlock on Secure desktop and bunch of other usability things.

Disclaimer: I work for AgileBits, makers of 1Password

Yea, we hear you there. I (and others on the team) wish we could make this happen, but priorities are a tough one. Linux in general didn't fit all that great in our standalone license model before, along with being closed source. Now with the subscription option for individuals (new today), families and teams we have made the payment side a little less of a concern but we still have the closed source nature of things making Linux a harder target to hit.

We're probably in a better position now than before though. Every time I asked a Linux user who wasn't asking for this they said they had no interest in paying for closed source software. I wanted all the positive response I could get to show to the decision makers but I fell short in getting it.

This is all to say it's simply a complicated situation. It has to either make money to pay for its development, or the others have to offset it enough that it's a win for us so we can keep the lights on.

Hope that helps a little anyway. I know it's not the answer you wanted but I hate leaving people like yourself wondering why it feels like we aren't listening.

Kyle

AgileBits

Is there a feature comparrison or reasoning you may have about why 1password may be better than Keepass? I have been using Keepass as I use Linux, Windows, and Phone for accessing my passwords. I am wondering if 1password has some neat helpful features that Keepass doesn't. I am considering switching to a new password manager.

We don't generally do feature comparisons. So many products operate under different sets of requirements that comparison charts can be very easily rigged to make one thing look significantly better than the other.

I can tell you one thing that is indisputably better about 1Password though.

Support.

Quite literally. We have a team of over 30 customer support personnel (in addition to myself and other developers who pitch in for a part of our day). We're here to help if you run into problems, encounter a bug, have feature requests, or generally just want questions answered about how we do things or why something is done the way it's done.

Keepass, as noble as it is to have an open source and free product, is run and improved by volunteers. I realize that not many people on hacker news really care that much about support since we're all typically very capable people, but as someone who has been with AgileBits for nearly 5 years now and seen a whole lot of the weird edge cases that can exist because some webpage is doing something incredibly weird or some particular computer setup is causing problems. It can be really helpful to know that there are people who can look into these things for you instead of having to know it yourself.

1Password does have a 30 day trial (both for our standalone product and for our individual/family/team subscriptions). You can try it yourself and see how it works for you. And as always, if you have questions during this time you're welcome to get in touch (support at agilebits.com, mention my name if you want and it'll notify me) and we'll help you get things setup. We think the product speaks for itself and we're happy to fill in any gaps if you need more :)

Kyle

AgileBits

Out of the year I have been using Keepass I have never had a time where something was wrong that I would need support for.

I am actually not sure what I would need support for either, it seems pretty basic. I am simply storing passwords. It doesn't seem too complicated. And maybe this is because I am a tech person, so maybe I am looking for the more technical reasons why the software may be better rather than how the support excels. Because if keepass had a problem I know ways to get support anyway, either via a Stackexchange site or IRC. So I am definitely a bias group.

However I do not care if the software is open source or not. I know some people do care about that, but the people I talk to do not. People in my age group seem less concerned about open source or closed source.

I'm more curious if there are some kind of features in the product itself that make it better than keepass? I do not have a family so the family cloud version of 1password is not useful, though I would not be opposed to a cloud version of 1password for an individual. I currently store my keepass in dropbox and have that synced to all the devices I use.

An example I like to give for why 1Password Families has helped me is this:

I work remotely for my job. I do travel several times a year as a result and when I'm gone I have other family members watch my house. Before 1Password Families I had to find a way to easily get my wifi password, my garage door code, and various other instructions and information to whoever was watching my house.

With 1Password Families I simply create a vault in my Family, add my items to it and invite the person who will be watching my house as a guest (or in my most recent case, granted my brother access to the vault).

In the first case, the person simply signed up, installed 1Password and they had access to the data. In the second case, my brother simply unlocked 1Password and the vault was there.

When I get back home, I simply remove access and those things disappear from their devices. None of these are so important that I have to change them, but, that's another step as well if necessary.

But that is how easy it is to share and use vaults in 1Password Families (and Teams).

I also love that using this I can add family members, like my parents, and it handles all the syncing for them so I don't have to micro manage it with backups and other stuff. It's a far more seamless experience. And since I hold the keys to the family kingdom, I can also reset their master password for them if they forget it.

Now, you might think you have no use for this, and that's fine, but it's an example of how someone who doesn't have an immediate family (I'm single, and childless) was able to use 1Password Families in a way that wasn't obvious when I first set out to use it for myself.

In terms of features that differentiate us from Keepass, I have never used Keepass so I am not able to speak to what we do differently. I'm sure there are things each of us do better though.

There is a trial version of 1Password, so, you could use it and see how it stacks up for yourself. I'd be very curious what you find better or worse so I can pass that feedback along to our team. Completely optional of course.

Kyle

AgileBits

Sure, I'll give some of my thoughts about it when I first fired up the trial.

The installer gave me an option to create desktop icon, but gave me no option to start the program when it was finished installing. It was odd having to go find and run the program once it was done installing, it is typical for most installers to give me an option to run after install. Not a big deal, but I thought it was worth a mention.

When I opened up 1Password I clicked "I am new to 1Password", and noticed that the prompt to select a location to store my keychain is under the program itself. This is annoying as I have to move it around to properly use the file explorer. Seems like a bug. Here is an image of what I am talking about: http://i.imgur.com/0Z6xTTq.png . Clicking on the file dialogue does not bring it above the 1Password application, it is stuck hiding behind it.

Entering the master password makes me enter my password twice, which makes sense, however it is odd that there is one password strength bar for both the "new" password and "re-enter" password section. The passwords should be identical, why tell me the same thing twice? http://i.imgur.com/ySXxT8g.png

I am quite confused with how I can import Keepass data into 1Password. Some googling shows I may need to use some perl scripts someone made to import them properly. I tried exporting my keepass database to csv and importing that but there were many problems. I used a lot of specific Keepass things like folders, as well as having a duplicate record that makes reference to another password entry.

Scrolling through the list of passwords is quite choppy and not smooth at all.

The search is slower than Keepass.

For the use cases you gave of sharing passwords I'd just print them out on a sheet of paper to be honest. It actually seems easier to me than sharing passwords via a program.

And on the top of micro managing and backups. I just use dropbox which by default keeps version history so managing backups is not really a thing for me.

So in my honest opinion for now I will likely be sticking with Keepass, for the reasons above, as well as because it does not support all of the platforms I use, which in my opinion is quite a critical feature as I want my passwords on every device.

Thanks for the feedback. I'm afraid most of my experience is with the Mac and iOS applications, since I work directly on those. However, the Windows application you are using has more or less been sunset and we're working on a new Windows app that you can read more about here:

https://discussions.agilebits.com/discussion/64591/help-us-w...

We are targeting a release soon. This version is a complete rewrite so it'll be missing some of the things that our Mac, iOS and Android applications have, but over time we'll be continuing to improve it. Having a base we can build on was the critical goal for this upcoming release though.

So, not to brush off your concerns for the version you tried (it is the one that we are making available to users still) there will likely be an entirely different set of concerns with the new one, but mostly because it lacks other features that you may expect to be present. But I do believe it solves most of the concerns you did raise :)

Thanks a ton for taking the time to give it a shot and let me know how it was for you. I am sorry it was, what appears to be anyway, an unpleasant experience. Our Windows app has traditionally been one that has lagged behind our Mac version but we are attempting to right that now.

If we can ever answer any questions for you, or help at all in the future, please let us know!

Thanks again!

Kyle

AgileBits

Coincidentally, a bunch of Dropboxers are working on a version of 1Password for Linux written in Rust (it's Dropbox's "Hack Week" right now). Hopefully we can open source it soon. Looking good so far!

Hi there!

If you have any questions that we might be able to answer, please shoot me an email. kyle at agilebits.com, or support at agilebits.com. I work on our Mac/iOS teams and security teams. I can probably answer most of your questions and at least get them in front of people who can answer them.

I really hope you're not making this work with AgileKeychain, we've put that one out to pasture. :)

Kyle

AgileBits

Purely OPVault!

We've got pretty good OPVault support going, but your guys' RPC protocol is not open, right? Between mini and the browser plugins?

Great to hear you're at least using OPVault :)

And also correct on the mini to extension protocol, there is no public documentation for that, primarily due to that being something we really need to be able to change as necessary.

We are really curious to see what you've come up with though :) So please keep me in the loop if possible!

Kyle

AgileBits

I have been using 1Password since version 3 and highly recommend it. I personally am quite happy with the iOS support, synchronization, and mobile Safari extension.

Dashlane is really good. Running 100% in AWS and leveraging a lot of their security features.

Here is their security white paper : https://www.dashlane.com/download/Dashlane-Security-Whitepap...

I just read the whitepaper (I am a long time Dashlane user) and they have a section on security of their javascript/browser extensions. They say that their extensions all use c++ so execute entirely outside of the javascript context. This would not have prevented the Lastpass exploit since all that was required as a malformed URL, but it is nice to see that Dashlane is thinking about this stuff. Also, had Lastpass not used js this exploit would've been harder to find (though not impossible).

Hello Julsimon, this is Simon from Dashlane's Support team. Thank you for your feedback. We have indeed ran multiple checks on our end and can confirm that we are not vulnerable to this type of issue. The code used for our auto-fill functions is shared on all our platforms and has been audited multiple times.

I've been using Pass for several months and I love it. https://www.passwordstore.org/

Within Pass is there a best practice for sharing passwords with another person or team?

I don't know about best practise but it integrates closely with Git. I store the encrypted passwords in a remote git repository. That means if someone else had the same GPG key and the password for that key, they could simply clone the repo and obtain the passwords. Equally they could add passwords and push them to the repo.

So that seems like a reasonable way for people to share them. However, I only use it for myself so I may not have thought of all the gotchas.

Check out Enpass password manager. https://www.enpass.io/

I found this alternative when LastPass was acquired by log me once. I was not happy with this. This app doesn't have hacking or vulnerability history like LastPass.

They also have a dedicated import for LastPass. https://www.enpass.io/docs/desktop-mac/import_lastpass.html

1Password is very nicely integrated if you're on a Mac and/or iOS. It's not free like LastPass, but I consider it a reasonable one-time* purchase.

*every few major releases

KeePass, but I'm not 100% on that one either.

Why not? I've been using it for about a year now (switched from LastPass) and haven't had any issues. Kind of miss the in-browser features of LastPass, but seeing as how those are what's being exploited, maybe not so much!

There are browser extensions that work with KeePass. This LastPass vulnerability makes me wonder, too. I wish the KeePass site would be 100% HTTPS, though, but the maintainer is a jerk in that regard.

Be careful about browser integration https://github.com/pfn/keepasshttp/issues/258

I use KeePass as well, but I have never tried it with a browser extension. That seems a little dangerous to me.

Any good alternatives for LastPass Enterprise-style multi-user sharing?

(Apart from "don't use services that require you to share passwords for a single account". Alas.)

My team and I have been using 1Password Teams (https://1password.com/teams/) for this. They also have a Families service if for some reason you want to do the same thing with family and friends.

Does it need to have Windows client? I'm guessing yes. If not there is [SFLVault](http://sflvault.org/)

I switched myself and my family to use 1Password Family. Been very happy with it. Syncs across all user and devices (except IE lol)

enpass.io, it supports pretty much every platform

Work on your memory, it's very hard to hack.

That's a very bad recommendation. Very few people are capable of remembering unique 10-character passwords for each site. I have like 100 passwords and accounts for various systems and I'm certainly not able to remember each of them. So either I start reusing passwords or I use a password manager.

You can vary the password based on the domain name with a predictable algorithm that only you know.

And hope you never have to change a password.

For work and home I have nearly 500. The GP recommendation is absolutely terrible advice.