MaKleSoft
Joined 12 years ago
Karma
265
Submissions
25
Member since
Mar 7
Recent submissions
Comment · 4 years ago
You're right. It's too late to edit it now but I'll keep it in mind for next time.
Comment · 4 years ago
A dedicated import feature for Bitwarden is coming in v4.1 later this week: https://github.com/padloc/padloc/issues/561
Comment · 4 years ago
Well, there is the problem, isn't it? If people aren't willing to pay what amounts to a cup of coffee a month for a service they rely on daily, how are companies supposed to build a sustainable business without raising money?
Comment · 4 years ago
Yes. We've been around for quite a while actually, and have completed three independent audits. One just recently by Radically Open Security [0].
Comment · 4 years ago
Well, yes. But to be fair, I bet there is a 5-year-old HN comment of a Bitwarden founder somewhere saying the same thing...
Comment · 4 years ago
> This doesn't worry me that much. In the event that incentives get skewed (which isn't certain), I guess I could just stop updating the app before that happens, or fork the last good version?
This is easily said, but remember you're talking about a security-sensitive application. Do you really trust yourself to keep your fork secure? I know it doesn't look like it on the surface, but password managers have become wickedly complex, especially if you require things such as shared vaults, audit logs, a zero-knowledge architecture etc. The reality is maintaining your own fork won't be feasible for the vast majority of users, even those with a technical background.
> Why should I trust you (and a product I've only just learned about)?
The simple answer is that you shouldn't. You should ALWAYS be sceptical, and look for possible indicators of a company heading down the path to the dark side. Like taking a 9-figure sum of VC money for example ;)
Comment · 4 years ago
You're absolutely right. Of course there is no guarantee that whatever alternative you seek won't turn out the exact same way. But unfortunately all you can do to punish that kind of behaviour is to vote with your wallet and move somewhere else. And hope it'll turn out better this time... There ARE people out there who are trying to build a profitable, ethical business instead of chasing unsustainable growth. Unfortunately the only way to find out who they are is by giving them a chance...
Comment · 4 years ago
If you're a Bitwarden user and this doesn't worry you, you haven't been paying attention to the history of almost every company that has accepted VC funds.
It doesn't matter how well intentioned the founders are - once you accept that kind of money, it's not your product anymore. You are now in the business of making money, nothing else, and those skewed incentives will start bleeding into their product and business practices sooner or later.
As a company, Bitwarden has been a huge role model for me, and I hope they'll be the exception to the rule. But $100M is a lot of money, and I simply can't imagine it having a net-positive effect on the company and product. But we'll see...
For anyone looking for a bootstrapped, open source alternative to Bitwarden, check out Padloc:
https://padloc.app/ https://github.com/padloc/padloc
(Disclaimer: I'm the founder)
Comment · 7 years ago
https://padloc.app (currently in beta. shoot me an email if you want to try it: [email protected])
Comment · 7 years ago
Allow me to plug my own product: https://padloc.app
The new version (currently in beta) has a "Family" plan which is perfect for this. We're also planning to introduce a "dead man's switch" feature that will grant access to selected family members or friends if you haven't logged into your account for a while. Shoot me an email at [email protected] if you're interested in signing up for the beta!
Comment · 9 years ago
> Don't suppose there's anything out there that can import the lastpass db?
Padlock does: https://padlock.io/howto/lastpass/
Disclaimer: I'm the developer
Comment · 10 years ago
I don't understand why so many password managers go through so much trouble to implement auto-fill. This one has an interesting approach that seems to be slightly less intrusive than what, say, Lastpass is doing but I still don't really see the value outweighing the cost.
Yes, auto-fill - if implemented well - can add some convenience for the user but it usually adds a significant amount of complexity to the codebase and comes with some challenges regarding security. In fact, LastPass' autofill feature is/was the root cause of some very scary vulnerabilities[1].
Copy&paste is simple, broadly understood and supported in much the same way on every single platform. And in my experience, it's really not that much slower than auto-fill.
It seems to me that most password managers these days are to tick off a list of features rather than focussing on security and usability. Mind you, Secret 2 is definitely not the best example for this - I actually quite like the clean look and simple user interface. Still, it seems like most people nowadays are judging the value of a password manager by the number of features rather than, say, security.
<shameless-plug>Padlock[2] is a minimalist, open source password manager without auto-fill, browser-integration or any other 'advanced' features. We believe that when it comes to features, less is often more, and it seems there is plenty of people agree with us.</shameless-plug>
[1]http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...
Comment · 10 years ago
Thanks for adding some clarity here. Apparently I missed some of the finer details.
> What is served over the web?
There is a form for generating passwords right on the front page and it states nowhere that the browser extensions are the more secure / recommended way of using the tool.
Comment · 10 years ago
Came here to point out the same concerns, basically. I'll add this:
5. Its seems like there is no user-specific secret in addition to the master password. If two users happen to use the same master password (which is definitely a possibility, especially with weak or easily memorizable passwords) they will basically have all the same passwords for every site!
6. Rotating your passwords regularly, at least for your highly sensitive accounts, is very important. With this approach, you can't change any one of your passwords without changing the whole lot (i.e. changing your master password) which simply isn't practical.
7. They serve the whole thing over the web, which, as has been pointed out many times over the web[1], is a bad idea.
Overall, its seems like they are looking for a overly simplistic solution for a complicated problem.
<shameless plug>Padlock[2] is a penetration-tested, open source password manager that, while using a battle-tested, 'conventional' encryption scheme for securing data, still tries to be forward thinking and to improve on the overall user experience of other password managers.</shameless plug>
[1]https://www.nccgroup.trust/us/about-us/newsroom-and-events/b...
[2]: https://padlock.io