I'll add a self-hosted option that no one ever mentions: PasswordWallet:

https://www.passwordwallet.com/

I use iCloud Keychain for most of my passwords these days, but my critical passwords I continue to keep in PW as well.

PW also has an occasionally very useful feature that I have not seen in any other password manager: auto type. Sometimes I just need to point my curser somewhere and have the password typed for me.

PW uses Blowfish with 448-bit keys.

There is also "pass", from the author of Wireguard, which is essentially a shell script wrapper around gpg and git:

https://www.passwordstore.org/

I've been using "pass" for years and love it. There is also a very nice iOS app that works well and is open source. I synchronise my devices and backup directly without a central repo. Its only flaw is gpg's poor UX...

There is a fork of pass called "passage" that uses Age for encryption instead: https://github.com/FiloSottile/passage Unfortunately I don't believe any iOS/Android apps exist to work with it so far.

Yeah. Auto-typing of password-related field is a relatively new security feature that got its start in Apple iOS.

While password auto-type is also found in Android, its security model is not quite a firm Bell-LaPadula yet like those implemented in Apple iOS/MacOS.

Exposing API to monitoring keystrokes remains problematic for any OSes.

> relatively new security feature

Maybe I'm misunderstanding the feature, but I've been auto-filling login forms since I was using IE7 with RoboForm. Other than using Touch ID to trigger the auto-fill instead of 1 click, I don't see any improvements in iOS/macOS Safari.

You leave all your password on the iCloud, accessible by AppleID but that AppleID password is so powerful and covers many more sensitive things (AppleWallet, ApplePay, ...)

Whereas, using a separate PIN/passcode at application-level provides a separate (master) password which would be used for all your passwords (in case your AppleID password gets compromised).

I do not use touchID nor FaceID because it violates the Principle of 3 Factors of Authentication: AppleID merges two of three factors:

1. "what you know (memory rote)" with

2. "what you have (biometric)".

https://www.cs.cornell.edu/courses/cs513/2005fa/NNLauthPeopl...

> using a separate PIN/passcode at application-level provides a separate (master) password which would be used for all your passwords (in case your AppleID password gets compromised).

That already happens exactly as you mentioned.

You need a secondary encryption password for encrypted iCloud data as well. Having access to your Apple account isn't enough.

https://support.apple.com/en-ph/HT202303#:~:text=Apple%20wil...

THIS!

Apple finally provides a modicum variant of Zero Knowledge password.

But that is only available in next iOS version 16.2. [1]

But, but ... BUT the Apple macOS/iOS issue of Three Form of Authentication being still being reduced into Two-Form with their merge (OR-logic) of what you have (FaceID/TouchID) and what you know (PIN/passcode) ... remains.

That reduction of authentication is still the greatest weakest link to individual security (whether ADP is used after v16.2 or not).

https://support.apple.com/en-ph/HT202303#:~:text=Apple%20wil...

The auto-typing feature is not the same as autofill. Rather, it literally emulates typing from the keyboard and is useful in contexts where autofill is not supported. I only ever use it on desktop, and it's a feature that PasswordWallet has had for more than a decade.

Ooooooo, if the passwordstore has a bash autocomplete in which to navigate selections of its config file subdirectories, then the solution becomes incredibly robust.

Why would you store critical passwords in two places?

Because you should have backups for critical things.

pass is fine if you like gpg (why?) and the only machines where you need those passwords are Linux/macOS/*nix computers. There are ways to access it on Windows, Android, and iOS, but they are unbearably painful.

Agreed.

Your selection of password manager is going to be invariably dictated by how many different platforms you need to sync up your password manager with.

And those maintainers of their own password manager are in an arms race.

Passwordstore (pass) databases are just a git repo which makes great audit trails, but also gives it syncing for free rather than reinventing the wheel.

It uses PGP rather than rolling its own encryption, which also makes it compatible with hardware tokens, for free.

It's not some complicated project... it's just a thousand or so line shell script.

It's fine if all platforms where you want your passwords can run bash scripts, git and gpg. Linux and macOS can do it fine. Windows might, although it gets flaky. Android and iOS can’t, at least not in any human-friendly way.

Honestly, this is the most secure and sufficiently functional password manager!

Consider Mooltipass a hardware password manager.

Ledger (who are currently back in the sin bin) have a deterministic password mode.

No Bitwarden?

They mentioned vaultwarden, which is a self-hosted backend for Bitwarden

Oh, I see. I hadn't heard of Vaultwarden.

edit: It was recently renamed from bitwarden_rs which I was familiar with.

Except they are different. One is a clone, BitWarden also has a self hostable version of their own backend.

>You can install NordPass on Chrome, Firefox, Safari, Opera, Brave, Vivaldi, and Edge.

So Chrome, Firefox, Safari, Chrome, Chrome, Chrome, and Chrome?

AFAICT, There is nothing Chrome about Edge.

Edge is based on Chromium and can install all the same extensions from the chrome web store directly.

Thanks. Considered myself informed given that I stay away from Edge.

> LassPass, hacked in 2022; remote storage of raw passwords

I know that it's been one dumpster fire after the other in the past few years, but did they actually go as far? The most severe one I remember hearing of was a leak of (possibly insufficiently salted, depending on the age of the account) encrypted password vaults. Still, I'll never again consider or recommend them going forward.

> In pwsafe, unbroken TwoFish algorithm is still being used instead of currently safer Argon2i

This is actually a negative point for it, in my view. AES is just as unbroken, yet has received considerably more scrutiny over the years.

The only place were non-AES symmetric algorithms still make sense these days is platforms where hardware acceleration is not available (e.g. djb's Salsa/Chacha), and even there only for high-throughput applications, which a password safe decidedly isn't.

> The recommended client-wise of PasswordSafe is still Netwrix (formerly MATESO of Germany)

I've never heard of them. Is it open source or at least properly audited?

Problem with AES and Salsa is that salting is required for smaller-sized password and are not considered a "hashing" algorithm; those two are block ciphers, as I recall.

No, MATSO is not open source but with an enterprise license, you can negotiate for the source code.

AES and Twofish are both block ciphers. Neither are hasing algorithms, and you'll need a PBKDF or some other construction to derive a key for either, no?

Salsa is a stream cipher.

Right. thanks for the update. My note should have been consulted as you being correct. Hate my memory nowadays. Need to consult some more notes before speaking.

"AES-KDF in KeePass is only CPU hard, while Argon2 is both CPU and RAM hard. This means that AES-KDF is victim to GPUs and ASICs for fast password cracking. The memory requirements in Argon2 make GPUs and ASICs considerably more expensive to reach similar password cracking speeds."

https://www.reddit.com/r/KeePass/comments/k511o6/comment/ged...

Strongbox is a fantastic KeePass client on iOS and macOS.

- fully native apps

- open source

- fully offline option (Strongbox Zero)

- one time purchase

- solid browser extensions for Chrome and Firefox

- native keychain autofill for Safari and Orion

- compatible with other KeePass apps on other platforms

- multiple sync options iCloud, G Drive, Dropbox, OneDrive, SFTP, WebDav, Syncthing

- support for offline vaults

- biometrics, Apple Watch unlock, and Yubikey support

- TOTP codes, attachments, and markdown notes can be stored

- supports password auditing with Have I Been Pwned

- supports importing 1PW vaults

Most importantly, Strongbox is made by a small and transparent company. Unlike Bitwarden or 1Password, they are solely focused on making high quality macOS and iOS apps.

https://strongboxsafe.com

I really really like Strongbox.

My only resistance from going the route of strongboxsafe is the lack of app-specific PIN, opposed to OS-specific PIN that is still missing from the free version.

While a master password covers the specific database, the PIN covers the app.

This is a two-problem for me there:

1. No OS-specific PIN/passcode in free version

2. No app-specific PIN-passcode in free version.

Ideally, a minimum of either one should be available in a free version. A wider acceptance should borne with this simple feature in the free version.

Also Netwrix is more enterprise-ready with their SOC 2, ISO 27001 and HIPAA ready but that is a moot point for most SMBs, SMEs, family-servers and homelabs.

I do do like the simple fact that Strongbox has it all out with their Github repository.

https://github.com/strongbox-password-safe/Strongbox

You have two options:

1. Pay and support this small developer. A password manager is a critical tool that needs to be constantly updated to support the latest OS. This isn't Adobe, it's a bootstrapped indie developer making an app for a small audience. I think the free version is already quite generous. Plus Strongbox includes a one time purchase for all platforms, no subscription unlike 1Password or Bitwarden.

2. Compile and build from source. It's an open source app, you are free to sideload the app if you want to.

An excellent case for StrongBox Safe, support the indie who did all the hardwork. This would save you, the end-user, from having to do the following:

Sideloading a self-compile app for Apple ecosphere often requires a DUNS ID by Apple App store which in essence will plunge you, the developer, into a yearly subscription.

Sure that one can do a TestApp, but that one-time DUNS ID requirement still remains.

All of the above is only necessary due to Apple's walled garden, which has been shown again to be distributing malware.

On a sane operating system you can just download the binary, install (or "side-load") it and you're done. No need for any crazy bureaucracy or giving apple tons of money for doing nothing of value.

That is not true. To sideload an app a free Apple Developer is required. A 7 day limit is placed on that app before it has to be refreshed. If you pay for Apple's Developer subscription then that limit is increased to 1 year.

Alternatively you can use Altstore [0] and avoid paying for an Apple Developer subscription.

[0] https://altstore.io

Oooooo, that is cool to know.

When you say refresh after 7-day, is the original installation of your downloaded developer app gets affected/disabled or that 7-day is just a time-limit on how often you can upload your development app?

The provisioning profile expires after 7 days; you can transfer your development app to your devices as often as you want. Not sure if you lose data, when the profile expires, though.

Right. My bad: DUNS ID is only required if you want over the air (OTA) update to your Apple devices through the use of Mobile Device Management (MDM) tool. (I was looking for ease of use, easiest, that is.)

Was unclear on how to circumvent this DUNS ID for just the sideloading. of apps.

> I really really like Strongbox.

> still missing from the free version

The obvious solution is to pay. Any reason you are opposed to this?

Not for me. I am currently evaluating Strongbox and will consider a purchase of Strongbox Zero for seemingly unlimited use.

But for others, it should be a caveat that you would not get the full security provided by Strongbox Zero or Strongbox Pro.

> a caveat that you would not get the full security

Paying the developer for access to the full security version, while the free one has more than security than most actually use, seems reasonable to me?

ummm, and you expect me to evaluate a freebie that wont keep my password secured enough.

In short, make the leap before you really safely try it out?

> one time purchase

I can only see a monthly or yearly subscription option?

Strongbox Zero - offline version, upfront one time purchase https://apps.apple.com/us/app/strongbox-zero/id1581589638

Strongbox Pro - upfront one time purchase https://apps.apple.com/us/app/strongbox-pro-lifetime/id14818...

Strongbox - same as Strongbox Pro offers free trial and subscription https://apps.apple.com/us/app/strongbox-password-manager/id8...

Ah thanks for clearing it up. I didn't realise they had 3 different versions of the app.

This might be what I need to finally get off the stupid 1pass treadmill.

> NordPass

I haven't seen a website this aggresive if you dare to open it in uBo in quite some time. Scroll down one screen and it constantly reloads.

I'll stay with 1p.

You don't have any notes on KeePass?

1P is zero knowledge. What does Nordpass really have over 1P?

Nordpass lets you self-host your password database.

1Password stop doing that and makes you use only their own cloud infrastructure.

I trust 1P cloud storage more with their well thought out security concept than Dropbox or self-hosted nextcloud. The 1P security whitepaper goes into great detail why their cloud concept is not at all comparable to just hosting the vault on block storage.

There are companies who are pulling in the rein with regard to placement of sensitive data. That is, going cloud-less (or more accurately, privately-owned public cloud, and more often, private cloud)

SOC 2, HIPAA, and ISO 27001 and various military guidelines are a few reason why.

And yes, apps should also password-protect and event-log the URL configuration field separately from the password used in database(s) as well ... from any change, accidentally or maliciously.

That is following inline with still-so Common Criteria guideline.

> Electron web and its many unverified modules/libraries What do you mean by this? That Electron itself uses unverified modules/libraries, or that 1Password is? And do you have any citations for this?

"Electron web app"

That's the last thing I would worry about. I don't get why people would get annoyed at the implementation of UI if that UI is working well enough. Imagine someone says "although this password manager is very secure and has all the features I need, I don't use it because it uses web UI, even though the difference in performance would not matter at all compared to a native app".

Honestly I find this ridiculous and it is a waste of my time to write this comment. Who

You could wait until you are able to foray deep into the field of cybersecurity and vulnerability assessment and arrive to the same conclusion as I do.

Or you can Google "electron web vulnerabilities" and find out quicker.

Unfortunately 1password has been a requirement in many projects I have been involved with.

You should post the name of those companies in here so we know who not to hire.

But I suspect you would be a contractor and probably would not be able to.

:-)