News for hackers. Stuff that matters.
Re:1Password delisting forum posts critical of their new Ele... by filereaper on Thursday August 25, 2022 @07:01PM (#32601117)
I'm trying to find an alternative to LastPass given their announcement today and was thinking of moving to 1Password.

Many responses here are recommending against 1Password.

What's a good alternative, specifically for families, as I've moved members of my family to LP?

I'll specifically need some recovery mechanism for them in the event they lose access, as they're still getting used to this workflow. Its not ideal but what's needed realistically.

Re:1Password delisting forum posts critical of their new Ele... by turbocon on Thursday August 25, 2022 @07:05PM (#32601156)
Personally I'm a big fan of bitwarden. It's open source so you can host it yourself if you want, the free version is very usable and the pricing for the more advanced features and the family plans is very reasonable.

https://bitwarden.com

Re:1Password delisting forum posts critical of their new Ele... by yegle on Thursday August 25, 2022 @07:19PM (#32601293)
Note the official open source version requires a subscription to get a license key. Most people choose to run an alternative server written in Rust called vaultwarden.
Re:1Password delisting forum posts critical of their new Ele... by mdaniel on Thursday August 25, 2022 @07:24PM (#32601338)
they are also doing some ... questionable ... trickery in their on-premises install <https://news.ycombinator.com/item?id=31098608>, so aside from vaultwarden being seemingly infinitely slimmer, it's also a lot easier to reason about from a security PoV
Re:1Password delisting forum posts critical of their new Ele... by xyzzy_plugh on Thursday August 25, 2022 @09:04PM (#32602109)
Honestly, ignore them and try 1Password. It's really, really great for families, whereas I found LP to be a fucking nightmare. I can recover family members accounts no problem. Best subscription service I've ever paid for by a long shot. The cost to try it for a month is negligible.
Re:1Password delisting forum posts critical of their new Ele... by thecoppinger on Thursday August 25, 2022 @09:13PM (#32602166)
Second this. 1Password is excellent, and when I had a critical support issue, their team (and even CEO, believe it or not) went above and beyond.

The claim that they're censoring critical posts on their forum is fairly baseless until they've had a chance to respond — Occam's razor would suggest there's a much less nefarious reason for posts not showing up.

Finally, the Hacker News crowd has a clear bias towards shitting on Electron apps in the war against perceived crimes of not being performant on ancient systems. I'm sympathetic to that way of thinking, but it's not justified grounds for how much flak 1Pass is taking here.

Re:1Password delisting forum posts critical of their new Ele... by Analemma_ on Thursday August 25, 2022 @07:05PM (#32601155)
I moved from 1Password to Bitwarden about a month ago and am perfectly happy. Bitwarden is missing a small number of nice "quality of life" features like Touch ID support on Macs and large type mode, but these aren't even close to dealbreakers. There is a family plan available for up to 6 people, and for recovery there is an "encrypted export" function so you can have an encrypted vault in cold storage. Would recommend.
Re:1Password delisting forum posts critical of their new Ele... by bredren on Thursday August 25, 2022 @07:26PM (#32601350)
Touch ID / Watch unlock are pretty big features to me.

One thing 1PW has been sporadically weak on is delivering consistent high quality UX across the plugins and main application.

It would make a difference to me if BW supported these forms of auth.

Re:1Password delisting forum posts critical of their new Ele... by 75central on Thursday August 25, 2022 @07:50PM (#32601546)
What do you mean by "Touch ID support"? Bitwarden has Touch ID support.
Re:1Password delisting forum posts critical of their new Ele... by jacko0 on Thursday August 25, 2022 @07:12PM (#32601220)
Bitwarden
Re:1Password delisting forum posts critical of their new Ele... by abfan1127 on Thursday August 25, 2022 @07:02PM (#32601131)
I missed LastPass's announcement. can you share?

Edit: here it is: https://blog.lastpass.com/2022/08/notice-of-recent-security-...

Re:1Password delisting forum posts critical of their new Ele... by andrewflnr on Thursday August 25, 2022 @07:08PM (#32601183)
Unless there's evidence they're lying about the scope, that alone doesn't seem like reason enough to ditch them. Not that I'm opposed to switching to keepassxc.
Re:1Password delisting forum posts critical of their new Ele... by _nivlac_ on Thursday August 25, 2022 @07:08PM (#32601190)
When LastPass started to lock in free users to desktop or mobile only, I switched to Bitwarden. Quite happy with it so far. I was able to import my passwords from LP and I believe it has free sharing for one other account, though I've only used it on my own so far.
Re:1Password delisting forum posts critical of their new Ele... by Apocryphon on Thursday August 25, 2022 @07:05PM (#32601164)
There's always Keychain if you have multiple Apple devices.
Re:1Password delisting forum posts critical of their new Ele... by DrJokepu on Thursday August 25, 2022 @07:13PM (#32601242)
Keychain also works on Windows now!
Re:1Password delisting forum posts critical of their new Ele... by librarianscott on Thursday August 25, 2022 @09:46PM (#32602397)
But autofill doesn't work on non-Safari browsers on your Mac. Yet I truly love Keychain so much in my Apple ecosystem I go to the trouble of exporting my passwords every few weeks to Chrome.
Re:1Password delisting forum posts critical of their new Ele... by tzs on Thursday August 25, 2022 @11:06PM (#32602928)
I'd like to see websites make it easier on people who need to copy/paste their login information because they are using some kind of password management system that doesn't support autofill.

One simple change would be to for the site to pick some character that is not legal in user names for that site and make it so that if the login form is submitted with a blank user name but the string in the password field is of the form <string1><X><string2> where <X> is that not-allowed-in-user-name character, then the site tries to do the login with <string1> as the user name and <string2> as the password.

People using copy/paste could then store their user name and password together in that format in the password manager, and only have to to one copy/paste to login.

Re:1Password delisting forum posts critical of their new Ele... by DrJokepu on Thursday August 25, 2022 @11:03PM (#32602913)
That's on Chrome's and (Firefox's) developers though. The keychain services API is fairly straightforward to implement.
Re:1Password delisting forum posts critical of their new Ele... by 42e6e8c8-f7b8-4 on Thursday August 25, 2022 @07:07PM (#32601180)
https://keepass.info/ hosted and shared on dropbox is what my family does.
Re:1Password delisting forum posts critical of their new Ele... by wwasilev on Thursday August 25, 2022 @07:33PM (#32601406)
I've been moving to Enpass. Seems OK so far.
Re:1Password delisting forum posts critical of their new Ele... by sysfu on Friday August 26, 2022 @11:19AM (#32608664)
Enpass user here since sheesh, probably 2016? It was whenever the 'LostPass' [1-2] security scandal broke and shortly after Logitech acquired LastPass, after which the usual 'corporate suck' had set in. I had used LastPass for a good seven or more years before switching to Enpass.

Enpass has given me good cross platform support, especially like that I'm not a 2nd class citizen on loonix systems. My only gripe would be that it's not open source, but I think the company does a good job of allowing you to keep and sync your data locally, without constant pushes to whore it out to 'the cloud'.

[1] https://www.seancassidy.me/lostpass.html [2] https://betanews.com/2016/01/16/lastpass-lostpass-passwords/

Re:1Password delisting forum posts critical of their new Ele... by sys_64738 on Thursday August 25, 2022 @08:13PM (#32601737)
Been using Enpass for years after I gave up the 1Password tax.
Re:1Password delisting forum posts critical of their new Ele... by Configure0251 on Thursday August 25, 2022 @07:12PM (#32601226)
Another vote for Bitwarden.
Re:1Password delisting forum posts critical of their new Ele... by sethherr on Thursday August 25, 2022 @07:03PM (#32601139)
Bitwarden
Re:1Password delisting forum posts critical of their new Ele... by mtgx on Thursday August 25, 2022 @07:03PM (#32601136)
Bitwarden.