Evaluation of five password managers(medium.com) |
Evaluation of five password managers(medium.com) |
On macOS everytime I opened safari it launched a dashlane.com page reminding me to install the plugin. I did not want the plugin, and after much googling never was able to prevent this behavior. I had to uninstall it.
Switched to KeepassXC, its good.
interested to know your experience good/bad/etc...I am considering installing on a vm at home to use for family.
whois lastpass.com
LogMeIn, Inc.
whois bitwarden.com
WhoisGuard, Inc.It’s at the bottom of the page.
So why the discrepancy?
Bitwarden is open source and self-hosted. This is a better trust model than any of the other offerings by a mile.
It's just cobbling together of GPG and git with shell scripts but it works like a normal git repository so you get all your synchronization, from that, your security from GPG which are all things I know and trust without introducing other components that I don't know / understand.
For me the combination of features in pass is just perfect! But it's from the same person that created Wireguard so it's no surprise...
I have recently submitted a bug, be careful when saving a password with duplicate name (it replaces old password without warning); not sure if it has been fixed.[1]
[1]:https://github.com/zeapo/Android-Password-Store/issues/451
Edit: it turns out OTP is one time password, that's neat!
I'm only familiar with that through Erlang and consider it an architectural pattern for supervision trees, would you be willing to expound a teeny bit more on what you mean?
Currently have over 250+ passwords in it, and it's great.
I like it because of its multi-line ability too, which makes it useful for storing blobs of text (such as API keys).
I wrote a bit about that at https://nickjanetakis.com/blog/managing-your-passwords-on-th....
...Huh? 1Password supports all of those platforms (including Linux) https://1password.com/downloads/linux/
> ...at one point during our evaluation we submitted a bug report about Bitwarden through its Github project; one of the product’s maintainers committed a bug fix seventeen minutes later, and just a few days after that the fix was released to the public.
It should ideally take from a few seconds to a few minutes. That's not extremely excellent, it's just good practice.
More than that and it hints towards heavy reliance on manual testing, and that's something I'd be worried about.
EDIT: Despite the parent comment's misguided logic, it seems his/her fears are actually in the right place.
An issue was opened about 6 weeks ago asking where the tests are and it received zero responses from the maintainers: https://github.com/bitwarden/core/issues/399
https://github.com/bitwarden/web/issues/303
Edit: Never mind, I can't find anything opened and fixed in ~17m.
A few requests aren't exactly answered.
https://github.com/bitwarden/website/issues/12
https://community.bitwarden.com/t/who-is-hosting-bitwarden/1...
My impression is that Kyle cares more about spending time writing software than about hyping his company. ;-)
It's an unfortunate flaw in a founder, but not a fatal one if he hires people to do the communication that he doesn't want to be doing. It feels to me like he's moving in that direction.
Apps used for Mac, Linux, windows, browser integration also works fine. All boxes are checked, don't know why isn't it popular among masses or nerd community.
There was never any chance that we would use a product which required every user to set up their own cross-device synchronization. Turnkey synchronization across devices as a first-class feature is a hard requirement for us.
Also, as far as I can tell, Enpass doesn't support sharing credentials between users, another hard requirement for us.
The family of password managers like KeePass and Enpass have their place, but they aren't good solutions to password management for businesses.
But do note that backing up on cloud means, 1 password combination and you'll let your encrypted files infinite local crack attempt.
That's a thorough comparison. I just wanted to make an attempt on why someone should consider using Zoho Vault for password management.
Zoho Vault is an online password manager for teams, used by more than 20,000 small and medium sized companies across the globe. We offer client-side encryption, multi-platform support, auto-fill, auto login websites and cloud apps, fine-grained password sharing, bulk folder sharing with user groups, audit, reports, two-factor & multi-factor authentication, US/EU data centers, browser extensions (Chrome, Firefox, Safari), and mobile apps (iOS, Android, Windows), option to maintain personal vault.
Integrations: G Suite, Microsoft Office 365, Zoho Mail, Zoho Desk, OKTA, OneLogin, Single Sign-On for 90+ Cloud Apps, Windows Active Directory/LDAP, Azure Active Directory
Disclaimer: I work for Zoho Vault. If you need a comparison document of Zoho Vault with any product, drop an email to support@zohovault.com.
huh? I use my yubikey in the Bitwarden browser extension.
Otherwise, a very extensive collection of comparison data. Not surprised to see Bitwarden come out on top.
Bitwarden supports 2FA with Yubico OTP - although there's a bug so it works only for QWERTY layouts. Or you can use Yubikey's static password feature for your master password, I guess.
There's also OpenPGP Card and PIV, which, to my knowledge, is not used/supported by any password manager software except for `pass` and some compatible implementations.
I'm using Windows an Linux and these improvements have come in the past week or so for me. Perhaps they recently updated, I haven't checked.
Worth taking another look if you can.
^^^Yes, this.
In 2018, we reported nine different substantive security holes to LastPass. At least two of them were security issues. All of them took far too long to fix; some of them still aren't fixed.
There's a tenth bug which impacts many of our users on a regular basis which we haven't bothered to report to them because by the time we started running into it, our users were like, "Meh, whatever, that's just LastPass being LastPass." It's not good when you stop reporting bugs to a vendor because you've become convinced that they just don't care.
They've had 12 outages of varying severities and lengths in the past six months.
Pretty much every time I reported a bug to them -- and believe me, most of my bug reports were extremely detailed and often included videos or screenshots demonstrating them -- their first response was, "Try uninstalling and reinstalling your plugin." I hate that. HATE, HATE, HATE it.
https://discussions.agilebits.com/discussion/80105/cant-disa...
BitWarden just famously had one.
I don't understand how this information is actionable. It would be worth knowing whether something has _ever_ been audited (again: most of the major password managers have been), but just knowing an audit has been done isn't sufficient to know whether it's secure.
Our company went through an audit and did quite well, and we fixed most of the findings. However, I know for a fact that there are things we can do to improve that weren't covered.
Not all audits are created equal, no audit will catch everything, and there's no guarantee that findings were patched sufficiently. However, I feel much better knowing that an audit was done, which means the author cares at least somewhat about security.
https://cdn.bitwarden.net/misc/Bitwarden%20Security%20Assess...
The latest appears to be a private bug bounty program, where 9 high priority issues were discovered. Who knows what they where, or whether any of the low priority issues should have been classified differently.
Without transparency, we just trust an empty attestation.
Also in the comments here someone said there are no tests. Does anyone have any info about that? I am interested in the software but no tests would be worrying. (Had no time to browse the code yet.)
It is an Android password manager based on PasswdSafe with USB HID keyboard support to enter paaawords automatically on any device. Also stores TOTP/HOTP.
The idea is, to have a complete offline device (hardend android without network stack/always flight mode on, baseband overwritten, ...).
It's likely that these services have already been zerodayed, and we're just waiting for the shell to drop on an upswing.
Personally I am also not going to use cloud based solution.
Breaking into fifty PHP forum sites running buggy old versions is easy. Figuring out how to get anything from (picking at random since I use pass personally) Lastpass is hard work, and you're more likely to get caught, not worth it.
[1] https://blog.bitwarden.com/bitwarden-completes-third-party-s... [2] https://github.com/bitwarden/
The freedom to do this is important to me regardless of whether I ever actually use it.
Reason? I have too much code to look/trust to add more and I do not keep log-in anywhere during my day, I do my best to avoid web-(cr)app as much as I can and try to live asynchronously connects via Emacs, being capable of operate as much as I can offline...
This silly thing alone would preclude me ever buying an iOS device! (My wife ran into it when I tried to get her up and running with Keepass, she gave up...)
I love keepass's simplicity, no browser plugins with pop up dialog boxes or UIs that conflict with the browser's own password management, just, a list of accounts and passwords.
In fact, iOS's own Files app can be used to access different cloud providers (I have iCloud, Dropbox and Google drive set up).
Do you have any good references pointing to Apple limiting Keepass in that regard?
https://www.enpass.io/docs/desktop-windows/import_export.htm...
Also it has no automated tests, which makes me somewhat wary.
The main selling points for me were that it's open source and they allow you to host it yourself.
Apart from these, I really enjoy the browser addons which don't require any jumping through hoops[1] and that they provide their own Android client and you don't have to play Play Store Columbus to find a decent one. It can also be used as an autofill service which allows it to interact with other apps which is incredibly useful.
But because nothing in this world is perfect, the downsides so far are:
1. Lack of shortcuts to copy only the username or only the password and forcing me to reach for the mouse. That's really annoying.
2. With KeepassXC you could have a keyfile that you was necessary to unlock your database while Bitwarden doesn't have that option. They do provide 2FA[2] but only TOTP and email for the free version (although $10/year for the premium subscription, arguably, is not much).
1: https://keepassxc.org/docs/keepassxc-browser-migration/ 2: https://help.bitwarden.com/article/setup-two-step-login/
too bad the article is quite thin.
They were not evaluating pw managers from point of personal user but as a company. You don't want to share one file with all passwords with all company.
Keypassxc having such features(and apparently the old network protocol was vulnerable lol) is for me a strike against it.
Given macOS's security track record - especially with High Sierra - and how particularly verbose Mach-O binaries tend to be, I'd be kinda worried about something relying so heavily on proprietary APIs (and potentially the system keystore?) Though I'm sure using Keepass with Mono (that the Macpass site lightly implies is the only Keepass macOS alternative) isn't exactly an impenetrable fortress either haha
Got that Hopper license around here somewhere...
I used to use "pass" like others here, but did not like the Android experience.
*edited to add: and we use the 1Password team account at my day job -- and are satisfied customers. I'm sure other products work well too -- just my one data point.
LastPass, on the other hand, is in a different category. It _claims_ to have full Linux support, and for a long time they did, but more recently -- as you point out -- copy/paste in their browser plugins stopped working properly when the binary component of the plugin is enabled on Linux. Since the binary plugin component is required to work with attachments, Linux users have been forced to choose between working copy/paste and the ability to manipulate attachments. They've known about this bug for many months and have not fixed it. In fact, this is one of the unfixed bugs which drove us to finally evaluate alternatives to LastPass.
> full functionality can’t be dependent on an app which is only available on Mac OS and/or Windows.
The existence of 1Password X means that full functionality is not _dependent_ on a MacOS/Windows app. The argument that there should be a graphical (because there _is_ a multi-platform CLI), native app for Linux, which does not depend on any browser, is a perfectly valid one -- but it is also an argument that I don't believe they've made.
I think the article would be a bit more accurate to say there's not native client support for Linux.
I realize this is becoming an increasingly minor problem in the modern world, but it still bothers me. I don't know what future situations I'll find myself in, and I don't want to be locked out of all my accounts.
• What if a new browser comes out that's actually better than Chrome? (I don't want to admit to myself how unlikely this actually is.)
• What happens if I'm using a Windows 10 S device, or a locked-down library computer, or a Wii U, or some other weird gadget with a non-Chrome browser?
Chrome has a feature to export passwords to a CSV file, but I had to enable it via a chrome:flag, so who knows if/when support for this will disappear. This created a bit of a sense of urgency for me, as Google aggressively removes features that they don't want to support.
My employer MITMs all web traffic, so I would never log into my Google account from work. They also have an ridiculously strict password change policy (every 3 months). But having a password manager on my phone lets me store passwords for my various work-related accounts somewhere, which makes each password change fairly easy, and also lets me log into certain work-related apps/sites (e.g. Slack) from home.
If you have multiple accounts on a single website, it's a bit easier to do in a password manager (at least Keepass or Bitwarden).
Chrome is a web browser, so it only remembers passwords to websites. If you have passwords that don't map to a website - e.g. hard drive encryption password, a pgp/ssh key, a wifi password), it's a bit easier to do in a password manager.
Some password managers have OTP generators built-in, which can be convenient.
Firefox has a nifty feature where it doesn't send ALL your data to Google, you could try that.
(1)This is the same-old argument as "there are more copies of Windows installed then Mac" [semantics aside, there is some truth to it]
(2)Don't shit where you eat. You don't use the same tool to protect that you use. [e.g. Windows Defender vs external gateway/firewall]
(3)Between compliance with the government [in contrast to Apple fighting the government with encryption on iphones], and YOU being the product not Chrome; I don't trust Google to keep my secrets 'secret'.
So, I'd say the point stands! You'd potentially be using a worse web browser in exchange for access to your passwords!
KeepassXC is open source too. And it does not require hosting. You can simply store your db onto a synced folder between devices and that's about the same anyway.
As for your comment regarding browser addons, I am not sure what "hoops" you are referring to. I installed the browser addons for KeePassXC and it took 5 minutes to setup and I have had no issue since. And the link you refer to is pretty self explanatory. Maybe Bitwarden makes that even more simple, but it's not that KeePassXC is utterly complex in the first place either.
On Android, KeePassDX is a good client that works with KeePassXC databases.
Thanks for the recommendation for KeePassDX, I will take a look.
This is better than a hosted version in a way you don't reveal the URL of your login screen but yet letting anyone open up the entire vault with 1 password combination is a deal breaker for me.
Why don't online services provide unique URL for their logins for each users, so that no lucky breach happens?
(Like https://unique-id.service.domain)
I'd rather stick with an offline one.
The general consensus of security experts seems to be that they're a bad idea.
I think my setup using `password-store` works great, and arguably is more secure since I rotate my passwords regularly as well.
The main reason I argue my system is more secure is that it has a physical gpg yubikey token to decrypt my password database.
In the 'deterministic password managers', there's no easy way to require that you have physical access to my yubikey in order to decrypt the passwords. You could keylog the master phrase in the case of deterministic ones and have a persistent pwn... heck, just typing the master password into a public slack by accident pwns most deterministic password managers (as pointed out in the above article)
On the other hand, even if someone keylogs my yubikey's user pin, well, they still need to either have the yubikey or to trick me into unlocking the yubikey again for their malicious attacking software. If I accidentally type my user pin into slack, I really don't have to worry all that much.
What if you need to change your password for a site to a different one?
What if the site changes its URL?
This does mean that you need to remember what the version is. Fortunately this information doesn't need to be kept secret. I also have a system that generates emojis based on your settings, so as long as you remember the emoji that goes with the site, you can just increment it until you get the right one, so it's down to you whether you store the version number somewhere or remember the emoji.
I use URLs by default, but you can enter anything you want into the 'purpose' field. It's still pretty raw, but it's at https://github.com/kybernetikos/sinkless
Most of the complaints people have about deterministic systems don't really hold up in practice for me. Protecting them by 2fa would be better of course, which deterministic can't do and lots of the good password managers do, but I really dislike having to worry about syncing state beyond just emailing it to myself.
One thing that would be awesome would be if someone came up with a standard machine readable way of describing the limitations on passwords for sites (allowable characters, number of characters, any restrictions on previous values / sequences etc), and all good sites could embed that information, and poor sites could be looked up in a third-party service.
They also have settings depending on password requirements (no special characters, etc.).
I'm unsure what the URL really has to do with it, you could just generate a new password for the new URL and change it.
Also "a few days" was just a guess. I noticed that it was a problem, then I noticed a few days later that the fix had been release. I don't actually know exactly how long it took to release the fix after it was committed.
I've had maybe 2-3 with 1Password, and all but one was resolved quickly and satisfactorily. The one that wasn't: them telling my Basic Authentication dialogs would not be supported any longer. (The same response from LP, just before I quit them.) I can't really hate on either for this, since BA seems to be quite insecurely done and changes all the freaking time in Chrome (it broke regularly when LP supported it, due to Chrome changes).
But, I was kinda putting myself in the mindset of the GP. They're currently using Chrome's password manager, so they clearly prefer Chrome, and while Safari and Firefox have advantages, there's no overwhelming need for anyone to switch right now. For the sake of a democratized web, I hope that changes some day in the future.
If the yubikey is only used to secure the master passphrase that derives the other deterministic passwords, then relatively little has been gained because the actual derivation of the passwords happens separately and the original concerns are still largely present.
Even if the master password is secured with a yubikey, many of the other flaws are still present, and if you need a yubikey to access your passwords anyway, you might as well encrypt the passwords directly rather than going through this awkward extra step that reduces security.
Just a general "About" page of where it's located, who's behind and a photo of CEO with added bonus if there's a photo of their office.
It's a very security oriented product. Not showing who they're can be taken as hiding.
I don't see why their location is particularly important, but if you care, you can look on Kyle's LinkedIn profile, which I was able to browse my way to in about 45 seconds from a standing start from their web site.
The article I just linked to makes it perfectly clear "who's behind" Bitwarden, and you can find it out easily with a few seconds of Googling like what I just did. They're not trying to hide anything from anyone who cares to spend 30 seconds trying to find out.
I care a lot more about the fact that hundreds of vulnerabilities have been submitted to LastPass's bug bounty program and they haven't chosen to disclose any of them, whereas a much smaller number have been submitted to Bitwarden's program and they've disclosed several. P.S. I, personally have reported three different security issues to LastPass, none of which have been fixed (https://medium.com/@QuantopianCyber/hi-george-a16d88a37355).
It's clear to me that LogMeIn, which owns LastPass and has a big-deal, flashy "About" page, is much less security-focused than Bitwarden. What you're asking for feels more like security theater than anything that's actually relevant to security.
> Limiting the access of unencrypted passwords to only properly setup 1PW applications would seem to eliminate the possible (probable?) web based attack vector to a 1password.com account.
This doesn't make sense. What's a "properly setup 1PW application"? Presumably that's an instance of 1Password that has been given both the master password and account key for the account. But when you use the web-based portal, you have to give it, yep, the master password and account key.
Anyone who is able to access the passwords using the web portal can already set up a local instance of the 1PW application that syncs with the same account.
Ultimately, asking to "disable browser access" is basically the same thing as asking to "disable the syncing API", which would obviously defeat the entire point of having the family account.
I trust the local 1Password apps enough to supply them my master password to unlock vaults locally.
I trust Dropbox enough to not sync the encrypted store somewhere I don't want it ending up.
It's a separation of concerns argument. I likely won't hold up to any targeted attack on my personal property given how careless I am with local devices but I should be somewhat protected against a your typical dragnet / mass attack against either service remotely.
not sure if it would work for your situation, but it's possible to set up different vaults for different groups of people and share them via separate dropbox folders (or even just different share settings on the vault files). i have 5 vaults set up that way.
Turns out, the hardest thing is not the crypto or the browser to app communication, but parsing the HTML to accurately find the login forms. If I remember correctly, the browser plugin on Mac actually sends the entire HTML to the app for parsing. The parser is probably quite complicated and they avoid reimplementing it in extensions that way.
[1] https://medium.com/@paulsc/making-a-1password-client-15dd39a...
Also, great post. I love reading reverse engineering stories.
I believe the browser addons do not share this shortcoming, though.
This hasn't been true since iOS 8 with WKWebView[0].
[0] http://www.iphonehacks.com/2014/06/ios-8-javascript-performa...
EDIT: Oh, you probably didn't mean getting them out and into firefox, you probably wanted to use something different to avoid the same issue (but with firefox) if you switch browsers again in the future.
But I don't think it is able to import them, at least not on my machine. I'm using the latest Chromium/Firefox on the latest Ubuntu, and I just had another look. When I select the option to import data from another browser, I get a dialog that says:
Import Preferences, Bookmarks, History, Passwords and other data from: Chromium
When I select Chromium, I see a list of things I can import:
Select which items to import: [x] Cookies [x] Browsing History
For some reason, "Passwords" does not appear in the list, and when I browse to a site in Firefox, it doesn't use the password that Chromium had stored.
Maybe this is an OS-dependent thing?
> The argument that there should be a graphical (because there _is_ a multi-platform CLI), native app for Linux, which does not depend on any browser, is a perfectly valid one -- but it is also an argument that I don't believe they've made.
I think they're making that argument.
If the 1Password X claims that its functionality is comparable to the native version, then it is lying.
The one for bitwarden being, as you said, disquieting, makes its omission a little suspicious.
We were aiming to evaluate the features / issues we care about against the password managers we were most likely to want to use. We published the results of our evaluation because we thought it might be useful to some people, not because we thought or intended for it to be all things to all people.
We didn't include security audits in our evaluation because, we are skeptical of their value and do not consider them a significant differentiator.
For example, in our experience trying to keep our own application secure, our HackerOne bug-bounty program has identified far more issues than the white-box security audits we've commissioned, at far lower cost.
...so it's not like this app is unheard of, per this thread's parent comment. Super odd that they didn't include it haha
I was always a bit paranoid about this, even though I did it myself.
Added support for CTAP HID authenticators on macOS
It also gives me "Web Authentication" under "Experimental features" in the Develop menu.
https://developer.apple.com/safari/technology-preview/releas...
Firefox has WebAuthn out of the box, and there's a hack behind a pref to half-arse U2F if you still need that.