Hacker Newsnew | past | comments | ask | show | jobs | submitlogin

By using 1Password aren't you already completely trusting the developers?

I mean, it's a proprietary application that you use to store all your passwords and other sensitive data. I'm pretty sure having read/write access to your dropbox folder is the least of your worries if the developers had malicious intentions.



Yes, using 1Password means that you have to trust the developers. Open source would of course be preferable but the open source community has IMHO not managed to provide a comparable suite of apps. Personally, I am more worried about keychains as single points of failure.

Some time ago, the 1Password developers tried to explain why you should trust them:

http://blog.agilebits.com/2013/09/06/1password-and-the-crypt...

In addition, http://learn.agilebits.com/1Password4/Security/keychain-desi... might be interesting with regard to your question.


Yes. If anything, people should be using the open source KeePass:

http://keepass.info/


Please don't turn this into a 'best password manager' war.


Surely we can discuss different threat models without it becoming a "war"?


Sure, but asserting that everyone should be using random password manager X isn't super constructive.


Only for RMS values of "should".

And these are values I very much respect, and I promise I won't act surprised when I get screwed by using proprietary software.

But in terms of user experience, I can't inflict KeePass on the people in my company, especially any non-Windows version.

If you want to train people to handle passwords responsibly, user experience is extremely important, and having to use KeePass would be a punishment.

People would start finding ways to not use it, which is why 1Password is the safer choice in practice, despite being proprietary.


Does it have two-factor auth yet? I'm not dropping Lastpass until it does.


KeePass is a software, not a service, so it doesn't really authenticate you. It uses a key to decrypt database, and that key derivation could be based upon various sources, including 2FA-like setups.

There are various plugins for multi-factor key derivation existing for at least several years already. You just have to chose one that suits you depending on what your second factor is (PKCS#11 token with RSA key, OATH HOTP generator, Bluetooth-based key storage, etc). Platform support may vary, though (so, not sure all options are supported, say, on Android).


You can use a key file in addition to password, so yes.


So not just proprietary software, but saas using a proprietary client? In for a penny, in for a pound I guess.


1Password and KeyPass don't even do "one factor authentication". This is because you are not authenticating to any service as all. Your Master Passwords for these are "encryption" passwords not "authentication passwords".

Authentication is about proving your identity to a system that has the power to grant you access to something. They can have you go through multiple steps. But with 1Password and KeyPass, you already have full access to your data (it is on your disk). Your password is used not to prove your identity, but instead it is used to derive a key which can decrypt the data that you already have access to.

Services that you need to authenticate against face different sorts of threats than those which are based solely on encryption. An authentication system protecting high value data simultaneously make multi factor authentication possible and necessary. For encryption based systems, MFA literally makes no sense.




Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: