I've stopped worrying about password re-use or compromise. Now I'm teaching my kids to use it and they love it b/c they dont have to make up or remember passwords.
Yes there are other technically equivalent options but the fact I can get it setup on an iOS device in seconds and trust its used is worth every penny.
But to some extent it took her compromised passwords to finally start using everything.
Also zero need to give any application permissions to access my Google Account. Using native google drive apps on all services to sync the file (just using file picker dialogs with drive app installed).
Got my non tech parents setup on this. 0 questions asked once I set it up.
Also have my partner and I on the same setup...just works.
Is there one which is best for most users?
- Website: https://www.keepassdx.com
- F-Droid: https://www.f-droid.org/packages/com.kunzisoft.keepass.libre...
- Source: https://github.com/Kunzisoft/KeePassDX/releases
Another FOSS app called Keepass2Android has the same feature, but recent versions of that app are not on F-Droid.
The same could be said about any password manager though
- Mobile UI is beautiful on 1Password.
- The UX from creating a password entry to auto-filling is easily better on 1Password. Bitwarden doesn't show autofill entries on login forms yet. That's a deal breaker, at least for me.
- Account recovery via a trusted family member.
- Additional security measure: private key in addition to master password.
Personally, the 35 USD fee is justified.
You can setup a trusted family member. You get a master password and private key incase you can't access 2fa. You can setup autofill entries. UI/UX are opinions.
You pay $40 dollars a year for Family, $10 a year for an individual. Cheaper than 1password.
Sure the UI/UX is a bit basic... but honestly most of us should prefer that.
https://community.bitwarden.com/t/overlay-popup-interface/14
Noted about trusted family members on Bitwarden.
I don't understand the private key part for Bitwarden. I am referring to the one here:
https://support.1password.com/secret-key-security/
Is there an equivalent for Bitwarden?
I was able to enable that in the settings, but I've found it very hit or miss compared to when I used LastPass.
https://community.bitwarden.com/t/overlay-popup-interface/14
$620M isn’t for a password manager, it’s financing for a business with an enormous and growing user base.
[0] https://bitwarden.com/pricing/ [1] https://1password.com/teams/pricing/
Yubikey and its likes are advanced features that the overwhelming majority of regular users will never need.
I don't expect everything to be free, I'm perfectly fine with the freemium model when the set of free features is reasonable - as, in my humble opinion, is the case with Bitwarden. So I wouldn't use a word like "crippled" when it's more like "normal for regular users vs enhanced for advanced needs".
This is separate from having TOTP 2FA on the Bitwarden account itself, which is available on the free plan.[4]
[1] https://bitwarden.com/help/authenticator-keys/
[2] https://bitwarden.com/pricing/
Plus like the parent said, proprietary code is a deal break for lots of people.
So then who foots the bill? Password managers are the duct tape used to protect a user because we don't inherently trust application providers.
> proprietary code is a deal break for lots of people
Sort of. First, "lots of people" seems like "lots of people" because we're on HN. The wider population doesn't care whether your application is proprietary or not - they just want something that works. Apple's wall garden is proof of this. Second, you can still charge for a product and it be open source. An application being open source simply provides an audit log of the code and allows for "wisdom of the crowd" when it comes to bug and security issues. So yes I agree that having a password manager be openly auditable is a great feature, but I (and many others) likely would rather have the features of strong UX and known tenure (OSS tools get abandoned all of the time) then we would having an auditable source code.
If you are saying that Bitwarden is worse because it offers a free plan, I disagree. It's nice that Bitwarden offers a security-audited* password manager to those who can't afford a subscription, who aren't ready to pay for one, or who don't have the means to make payments online. Unlike 1Password, Bitwarden is not pressured to deliver high returns to venture capital firms, and Bitwarden can focus on providing its product to its users at superior price points.
* https://bitwarden.com/help/article/is-bitwarden-audited/#thi...
Well said - and this is the important part of the 'non-proprietary' argument of mine (above) - right now I consider 1Password's real customers being their shareholders/investors, not its users - the users are just another tool they use to bring value to their real customers (investors,etc.).
BitWarden's customers are their actual users.
For the record, I'm not. The overall discussion was that charging for a product was somehow bad. Bitwarden does charge for their product, just at higher tier levels. My bigger point is that you do want a provider that is going to stay solvent so charging money (which Bitwarden also does) is not some perverse way of satisfying customers.
Whoever wants to pay. Doesn't mean a product should be dismissed simply because it's "free".
There will be exact examples of the opposite happening.
[1] https://community.bitwarden.com/t/account-switching-log-in-w...
[2] https://community.bitwarden.com/t/bitwarden-roadmap/12865
With 1Password, I also have to reauthenticate all the time, but unlike KeePass, TouchID works.
So I can't habe autofill, automatic saving of new/changed passwords and password creation and also use the same vault for the mobile app (Android). The mobile app can access the self hosted vault without any issue.
I would love to fully migrate to self hosted bitwarden, but the browser extension irks me. Maybe it is possible and I am just too dumb to find the solution.
I could only enter email and password yesterday.
There is a small cog in the top left side where you can change the URL to use when you login, in case you simply overlooked it.
Top left here: https://imgur.com/xCgrot0
If you click on that, the "Server URL" field is where you want to put your private instance: https://imgur.com/Gua3jSb
1Password does a pretty good job of this; as a user I do not need to worry about syncing the database, keeping an app up to date (the website is always up to date) etc.
I have, since the family plan was first introduced, also gotten my aging parents on the plan (so my brother and I — both _far_ from where my parents live — can assist when required) and my brother.
My wife has shifted from merely using 1Password to advocating the use of password managers in general and 1Password in specific (she had a letter read by Peter Mansbridge on his podcast a couple of months ago where she did exactly that).
UI/UX is everything. Apple became the most valuable company in history on the back of UI/UX alone. Their tech is decent but not that much better than anyone else's, but their stuff is at least marginally easier to use and that's worth more than the GDP of quite a few countries combined.
The importance of user experience is only growing as the world becomes more and more time poor and we move more and more into an "attention economy." Saving seconds counts. If it doesn't work instantly it's broken, period.
Here's two ways I can explain it:
(1) If you value your time at $100/hour and you have to spend one hour a month maintaining something "free," that free thing costs $100/month. That's fairly expensive. It only makes sense to do this if you have a lot of surplus time on your hands.
(2) If you have ten million users and make a UI/UX improvement that saves them one minute a month and you value their time at an average of $50/hour, you just created about $8.3 million in value since that's the value of the time you just saved.
A rule of thumb that I use is that every step required to do something halves adoption. So if you have a 10 step install process, only 1 out of 1024 people who look at your product will make it to trying it.
Every developer needs to have "user experience is everything" tattooed on their forehead.
Most users don't want to tweak anything related to their phones, tablets, computers, watches. If everything your app does, isn't reachable within 1-3 clicks/swipes/presses, then forget it.
Someone suggested using two versions KeePass files...one for shared passwords, one for not shared passwords. This is NOT a substitute for clicking Share Password and literally not doing anything else.
Someone suggested storing all your passwords in the browser. This is NOT a substitute for having all of your passwords available at the app level on your iPhone. This is NOT a substitute for sharing passwords with your whole family.
UI/UX is EVERYTHING
I have been hearing about how X11/MOTIF will "end the Windows/Apple hegemony" for decades.
I don't know how often I've heard "X Windows is just as good as Mac OS."
It's like when your vegan friend keeps telling you that "Falafel tastes just like beef."
They have never tasted beef (or they hated the taste), so they don't have anything to compare it to. X Windows is GUI, written by people that hate GUI.
What could possibly go wrong?
All that said, it's a crazy amount of money, and I really feel that the only real work the password manager needs, is to be rewritten in native. Electron is less-than-excellent.
They must have some kind of strategy that goes beyond just being a password wallet.
The alternative "do not use a password manager" is however totally common. So if you want to get someone with limited time or affordance for annoyance (like your wife) to use a password manager, the process of setting it up and using it better be very smooth and frictionless.
1Password is very good at that part.
Bitwarden is not an alternative to 1Password that passes the wife/parent/elder test because the UX is so bad they need to call me everytime something isnt exactly working as before.
I even started self hosting it this year and it continues to "just work" - although I don't recommend it to most people since I now have to manage a server. I was already self hosting a lot of other things last year (wanted to move away from google/apple services) so the "cost" of self hosting Bitwarden was negligible.
Anyway I know I rambled a lot, but just wanted to chime in and throw in my opinion about bitwarden
I mean, I have 1password for work, and Bitwarden for personal..
Spot the difference: https://imgur.com/a/wJQBDjV
- "Folder: No Folder" is a bit confusing, it would be better to just require a folder when creating an entry.
- Collections vs folders is also a little confusing unless you spend time to figure it out.
- 1password shows the password reuse notice right there, instead of needing to go the web vault of bitwarden and specifically click on tools.
- 1password shows the password strength right in the entry as well.
- 1password has nicer display of the items in the vault, with sections by letter.
I really hope that Bitwarden improves their UI and UX, because I really want to like it. But their Collections and sharing feature is very unclear, especially once multiple people/orgs are involved.
I'm afraid to use it because they co-mingle everything in UI and I dont accidently want to share a personal password with another org.
Being worried of sharing a password accidently is very scary UX
This refusal to understand UI/UX goes way way back in hacker culture:
http://catb.org/jargon/html/P/point-and-drool-interface.html
This seems to be a general characteristic of enthusiasts.
To design a good car for people other than car enthusiasts, you have to hate cars or at least be able to place oneself in the shoes of someone who hates cars. People who don't love cars want a car that makes them think about cars as little as possible. The purpose of a car is to carry you from one point to another, not to make you spend time on cars.
It's a bit like climate change. Scientists will warn, people will ignore, and then we will abandon Miami and will probably blame the scientists.
Huh, to me it's both. The UI/UX wouldn't be worth shit if their software ate battery like it was free, crashed often, was frequently janky, hogged resources to the point of being a problem, or all the fancy features underlying their UX didn't work pretty damn well without user fixing or intervention. Software quality is part of why their UX is so good, not just design languages or whatever. You don't get their level of auto-magic if you haven't done a whole bunch of things very right in the underlying code & architecture.
They're far from perfect (practically all consumer-facing software is at least kinda bad, IMO) and one can point to a handful of duds that they just can't seem to get right (Xcode, for instance) but I'd put software quality as my number one reason for using them, and I'd point to that as an absolutely vital element in their UX being well above average. It's that combo that no-one else seems able to touch—in fact, it often seems like no-one else is even trying, and I really wish they would.
Or perhaps nerds do grasp the negative value of anti-patterns in UI/UX, and reject attempts to create interfaces and usage models that remove control from the user, create vendor lock-in, or compromise privacy and security.
This is quite true, but the counterpoint is that nerds enjoy spending that time. We like opening the box, poking at the wires, seeing how the cogs fit together, and tweaking things endlessly. It would be a liability for a normie, but for a nerd whose interest is piqued it's a fun Saturday project. This is why FOSS survives despite the UI/UX problems.
Where us hobbyists go wrong is thinking any large percentage of customers want to do that. Any amount of futzing is too much. Most people want it to "just work."
Edit: agree with the rest
How about you share one KeePass file for all shared passwords and keep another one for your personal ones? KeePassDX on Android can easily handle multiple files. I agree, it's not a perfect solution but it's rather low-tech and something the layperson might still understand.
I loved almost everything about 1P but their reluctance to authenticate with keychain means it's a PITA for me, and an absolute deal breaker for my wife.
Has this changed or do you still have to enter your 1P password every time you log in or your session times out?
But do you believe 7000 years of work is a realistic estimate for how much effort is needed for KeePassXC to catch up?
I don't.
There are a lot of technical enthusiasts and hobbyists, mostly dudes, who optimize for dumb parameters that nobody in the real world actually cares about. In this case, setting up a clunky, but fully open source password manager, when there are alternatives with objectively better UX available for relatively cheap (considering you use the thing many times each day).
In the home theater world, for a long time guys would brag about the disgusting monstrosities they've jankily hooked up in their living rooms, but a setup with high WAF means building something that's actually aesthetically appealing and congruent with the interior decor, hidden cords, not having to switch between 4 remote controls, etc.
But you're right - it should probably be SAF (Spouse Acceptance Factor).
I use pass [0]. To me, it is the best password manager that I've ever used. Command-line-first, free & open source, built on git... it's great, and suits all my needs. From the perspective of someone who spends most of their day behind a CLI, it is "simple" and "just works" more than anything else.
But it's not going to work for my significant other, who is very intelligent but isn't a software engineer. They're not going to learn git so that they can manage passwords, and the app doesn't abstract away git enough for them to avoid needing learning it. Hence, despite its merits, it fails the "SO acceptance factor" or whatever you want to call it.
The parent did no shaming; as you pointed out it’s extremely reasonable to not want to jump through hoops. Any shame is projected by yourself.
I hear the phrase from time to time in aviation. "Have to sell the first plane" / "Doesn't pass the WAF" / "Wife thinks owning two planes it too expensive." I have no reason to believe these folks are not in a loving relationship.
Nothing to do with intelligence.
It seems like it is you who is equating tech illiteracy with intelligence, pal. There is nothing wrong with being technically illiterate (most people are) and I don't think GP is shaming his wife because of it.
Haha. I'm pretty sure browsers build this feature in.
Using a 1password family plan is the only way I've been able to wrangle my parents across their slew of iOS, macs, Android, Windows, and Linux machines to stop typing in passwords.
1password lets you share passwords with other people, even if they don't have a 1password account.
No built-in browser password manager will handle that.
I’m sure a family with multiple users and half a dozen devices will run into issues as well.
Because 1Password is easy enough to use that my wife and I can share a family plan without her getting frustrated. If one of us has a login the other needs, we can easily share it. When I evaluated KeePass, the Wife-Acceptance Factor (WAF) was not there, though maybe it's improved.