I really enjoy Proton Pass (but I have a paid subscription so I have passmail aliasses as well). I've been going full passkeys recently, no issues yet.
Before this I used Vaultwarden, but I was always a bit afraid of the self-hosting (of something this critical), and I really didn't like how you share credentials in BitWarden (through organizations), Proton Pass is much more intuitive with just straight up sharing of credentials or sharing whole Vaults. You can also share through public 1-time visit, limited time valid-urls. I use that a lot when I set up people's accounts.
What I don't like is the tight coupling to Proton's services, Pass should have had it's own credentials. But if you're not a Proton user that doesn't matter (or perhaps it doesn't matter t you in any case.)
Im a happy Proton customer since a decade for their email and recently file storage service, but I’m concerned about having my passwords and my files and my emails in the same system. It’s risky to have so much in one company, if I lose my proton access for some reasons I’m out of everything
I migrated from an older 1password to self hosted bitwarden (vaultwarden) using premade configurations which are available for Portman and Docker in the usual places. Mine uses caddy for the Web front, which automates letsencrypt certification. All the client app which talk to bitwarden talk to vaultwarden, but there's no guarantee into the future I guess. I just like self hosted.
The export is through CSV in clear. I wish they agreed to use some pkcs defined superencypherment and a json format so you could avoid the pass through plaintext.
Do this on a machine you trust, offnet I guess.
Bitwarden has corporate options. Password sharing under a reasonable model, group structure.
I moved to self hosted Vaultwarden (Bitwarden server reimplementation that's client-compatible). You can also directly run Bitwarden, but Vaultwarden is easier to self-host, especially OIDCwarden is nice if SSO is your cup of tea.
I don't like Bitwarden's UI as much as 1Password's, but at least it feels faster.
If you switch to a free one, at least you can be sure that your money isn't being funnelled to people who you fundamentally disagree with, even if the creators have shitty beliefs.
He did post at least two blog posts with very questionable political standpoints, while also not displaying a high level of critical thinking, one could say.
Not sure where the point of „should be cancelled“ is reached, but doesn’t paint the best picture of him to say the least.
Probably the worst quote:
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation. [0]
The comparison between shooting wolves here seems definitively bad tase and missing nuance.
n00b question I guess but what is the value of a standalone password manager? Seems like most browsers and operating systems offer this capability nowadays.
1Password offers a lot more functionality than, say, Apple Passwords.
Apple Passwords will store a user/pass combo for a site. That's it, feature list over.
1Password will let you configure how those things autofill, it provides an `op` CLI that you can use with service account tokens, you can store stuff like photos of your passports and licences, it understands 'Sign in with GitHub', it has per-user access per vault for shared accounts, you can add any number of extra fields to each entry, it integrates directly with Claude, it monitors your passwords against Haveibeenpwned, it'll tell you where you could be using 2FA and aren't … and the list goes on.
The fomenting of racial hatred a few tens of kilometres from me? I’m lucky to not be targeted by him and his chosen cause, but a lot of my colleagues are right in his firing line.
Yeah, as long as the tech worker himself isn't on the list to be deported, shot or gassed to death, he has no need to worry.
The total lack of empathy, praise of strongmen like Musk and Trump and DHH, promoting slave labour. This whole view of society is simply disgusting and far too common in the startup circles.
This anti-DHH movement is so weird to me. People seem to read summaries of his views, often based on interpretations that get exaggerated from one article to another until they become something else entirely. At least read the articles yourself, including his other work, so you don’t just cherry-pick the ideas that conform to your existing beliefs. Then form your own opinions.
Yes, I dismissed the reactions as overreaction and the usual drama, until I read what DHH himself has written this summer. He would no longer fit the European far right comfortably to be honest, his current views align better with the 1930's. And that way SV happily invests tens of millions to your collection of dotfiles.
I don‘t think that‘s a fair summary. Reading his own words definitely should create doubt in his political standpoints.
Additionally after the posts created a fair bit of controversy, he never came out publicly and put his statements in a better light. At least to my knowledge.
Well, I'm staying exactly where I am. I'll be keeping my company on 1password, and my family too, because I think it's a good product. I don't personally use Omarchy, but I welcome anything that can bring more people to linux on the desktop, so I support that too. I don't agree with everything DHH says, but I absolutely despise online witch hunts so I guess I support him too just on principle.
Dont know why you are getting downvoted, this is a valid method widely recomended in this day and age. The hacker cant hack your password book locked in your desk drawer!
It's not dumb, it's just a little inconvenient. My passwords are normally 50+ characters and pretty hard to type out, but I could fix that with "Correct Horse Battery Staple" passwords.
Travelling is a little worse. I'd need to carry my little pocket book an risk losing it and now I can't lock my accounts, because I don't have the password for them (I could have a backup).
You know, I'm kinda talking myself into just doing passwords in a pocket book.
Out of pure interest, why not settle down to idk .. 15-20 characters? Why 50+ char (with what I assume lots of symbols and randomized characters) passwords?
Because I just auto-generate them and 50 is the default in 1Password. I rarely change default in any software I use, partly out of laziness and partly to ensure consistency across devices.
Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user.
I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too.
I've used it for about a decade at this point, and it's just perfect.
Do we need another migration guide for Stripe since the CEO personally donated to Omarchy and then tell everyone to stop using Stripe and all of their services?
Huh, I guess TIL there is a controversy around Omarchy. I generally dismissed it as a serious distro after 5 second once realized it encourages using the AUR as your default package feed. The AUR is useful, but to me it’s something to be very aware of when you’re installing some software. Encouraging people to install everything through it is a crazy way to configure a distro. I just assumed it’s a distro for a very different target audience so kept my thoughts to myself
It's not really around Omarchy, but around DHH due to his political beliefs. I'm not deep into this, but I think the majority of the controversy stems from this article:
Wow. I just read this one now, and DHH really makes it hard to defend him. It's definitely possible to make this argument without likening groups of people to wolves and sheep...
There's a bit of a jump here from something appearing good to rapidly becoming very very bad. Here's what I read:
> 1Password has pledged $300,000 over three years in support of David Heinemeier Hansson's Linux distribution known as Omarchy, and is now a “distinguished corporate patron” of Omacom. What a nice brand partnership.
Supporting a Linux distribution sounds nice; I hadn't heard of that one.
But the very next paragraph:
> DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI
> In an internal Slack message leaked to press today 1Password’s Roustem Karimov defended DHH as being attacked for his views...
Perhaps they could support a different Linux distribution.
It's also strongly concerning when someone defends someone with views like that, characterising them as being attacked. In general, toxic, racist, fascist views spread like viruses; when tolerated, through acceptance, they grow. A company needs to root them out. If we trust 1Password with our data, we are trusting a company with those views inside it with our data.
It's mostly extreme hyperbole and twisting of his views if anything.
One of his criticisms was the virulent attacks on anyone that questioned policy during covid. He for example prefered the Danish approach and they still ended up doing better than the UK or US.
I also can't help but see the folks clamoring for mass migration for the past 2 decades in europe against popular will as anything other than blind oikophobes. If you'd look at my capital and other places you'd question who is actually calling for ethnic cleansing.
it doesn't mean it's true (we may never know), but framing as "conspiracy" was a product of conflict of interest where certain scientist were protecting grant money. Since then even some of the scientists who participated in it walked it back and openly said that both natural and lab leak theories were credible: https://www.science.org/doi/10.1126/science.abj0016
> DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI
Leaving aside all the rest of this, I thought "lab leak" was considered a reasonable hypothesis, although not especially likely, these days, rather than some kind of fringe theory.
It's a result of political division in US. If you are on the left then you have to see lab leak as a racist rightie conspiracy theory or you will have issues fitting in. Also lab leak is rejected as a side effect from being confused with intentional leak/bioweapon theory, which is entirely radioactive.
Political right is the other way around.
It is not conclusively proven one way or the other, but most people just made their conclusion: left that it's the market, right that it's the lab (or bioweapon for especially out there).
I believe it was disproved, but regardless, there is a lot between accepting an hypothesis and possibly valid and building a conspiracy around it. I don't about this case, but this conspiracy typically degenerate in anti-science behaviours, perosonal attacks (on researchers or just chiense people) and similar nice things.
I really enjoy Proton Pass (but I have a paid subscription so I have passmail aliasses as well). I've been going full passkeys recently, no issues yet.
Before this I used Vaultwarden, but I was always a bit afraid of the self-hosting (of something this critical), and I really didn't like how you share credentials in BitWarden (through organizations), Proton Pass is much more intuitive with just straight up sharing of credentials or sharing whole Vaults. You can also share through public 1-time visit, limited time valid-urls. I use that a lot when I set up people's accounts.
What I don't like is the tight coupling to Proton's services, Pass should have had it's own credentials. But if you're not a Proton user that doesn't matter (or perhaps it doesn't matter t you in any case.)
Im a happy Proton customer since a decade for their email and recently file storage service, but I’m concerned about having my passwords and my files and my emails in the same system. It’s risky to have so much in one company, if I lose my proton access for some reasons I’m out of everything
You can set an extra password for pass but still.
I for one also have my 2fa with them... I get the feeling.
I migrated from an older 1password to self hosted bitwarden (vaultwarden) using premade configurations which are available for Portman and Docker in the usual places. Mine uses caddy for the Web front, which automates letsencrypt certification. All the client app which talk to bitwarden talk to vaultwarden, but there's no guarantee into the future I guess. I just like self hosted.
The export is through CSV in clear. I wish they agreed to use some pkcs defined superencypherment and a json format so you could avoid the pass through plaintext.
Do this on a machine you trust, offnet I guess.
Bitwarden has corporate options. Password sharing under a reasonable model, group structure.
Here you go, I made a quite wide-ranging set of notes here when I switched: https://taoofmac.com/space/apps/1password
I moved to self hosted Vaultwarden (Bitwarden server reimplementation that's client-compatible). You can also directly run Bitwarden, but Vaultwarden is easier to self-host, especially OIDCwarden is nice if SSO is your cup of tea.
I don't like Bitwarden's UI as much as 1Password's, but at least it feels faster.
Make sure you look closely into politics of anybody connected to the password manager you are switching too, it could be even worse!
If you switch to a free one, at least you can be sure that your money isn't being funnelled to people who you fundamentally disagree with, even if the creators have shitty beliefs.
Does DHH actually deserve to be cancelled, or Omarchy "defunded"? I just read the OOOL on Reddit, and I have to say that I am not entirely convinced. https://www.reddit.com/r/linux/comments/1oa74wh/im_out_of_th...
He did post at least two blog posts with very questionable political standpoints, while also not displaying a high level of critical thinking, one could say. Not sure where the point of „should be cancelled“ is reached, but doesn’t paint the best picture of him to say the least.
Probably the worst quote:
> When wolves get out of control, you shoot them. When gypsies take over public spaces, you deport them. This isn't hard, it isn't cruel. It's the basic logic of self-preservation. [0]
The comparison between shooting wolves here seems definitively bad tase and missing nuance.
[0] https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a
[1] https://world.hey.com/dhh/as-i-remember-london-e7d38e64
Not sure what'll convince you then, if DHH's own rant against immigrants and roma doesn't.
n00b question I guess but what is the value of a standalone password manager? Seems like most browsers and operating systems offer this capability nowadays.
1Password offers a lot more functionality than, say, Apple Passwords.
Apple Passwords will store a user/pass combo for a site. That's it, feature list over.
1Password will let you configure how those things autofill, it provides an `op` CLI that you can use with service account tokens, you can store stuff like photos of your passports and licences, it understands 'Sign in with GitHub', it has per-user access per vault for shared accounts, you can add any number of extra fields to each entry, it integrates directly with Claude, it monitors your passwords against Haveibeenpwned, it'll tell you where you could be using 2FA and aren't … and the list goes on.
To not be tied to a single machine or OS
IMO choosing products over politics is a pointless game. Use the best tool for the job.
100%, but this is unimaginable on HN :)
Can I assume that you’re not someone affected by DHH’s abhorrent views?
Which of his viewpoints is affecting you?
The fomenting of racial hatred a few tens of kilometres from me? I’m lucky to not be targeted by him and his chosen cause, but a lot of my colleagues are right in his firing line.
Yeah, as long as the tech worker himself isn't on the list to be deported, shot or gassed to death, he has no need to worry.
The total lack of empathy, praise of strongmen like Musk and Trump and DHH, promoting slave labour. This whole view of society is simply disgusting and far too common in the startup circles.
> by DHH’s abhorrent views
You know that's just your opinion right? Not an objective truth.
We are on a forum discussing our opinions on things FFS
Been using DropBox + Keepass for over a decade now.
How do you store passkeys?
Oh, I was only storing and using it in AWS KMS because of the pricing issue, but thanks for the comment. I’ll look into it a bit more.
This anti-DHH movement is so weird to me. People seem to read summaries of his views, often based on interpretations that get exaggerated from one article to another until they become something else entirely. At least read the articles yourself, including his other work, so you don’t just cherry-pick the ideas that conform to your existing beliefs. Then form your own opinions.
Reading the sources makes it way worse…
Yes, I dismissed the reactions as overreaction and the usual drama, until I read what DHH himself has written this summer. He would no longer fit the European far right comfortably to be honest, his current views align better with the 1930's. And that way SV happily invests tens of millions to your collection of dotfiles.
Can you post the 1930 view link?
I don‘t think that‘s a fair summary. Reading his own words definitely should create doubt in his political standpoints. Additionally after the posts created a fair bit of controversy, he never came out publicly and put his statements in a better light. At least to my knowledge.
https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a
https://world.hey.com/dhh/as-i-remember-london-e7d38e64
1p is the best.
unix passstore is perfect
Well, I'm staying exactly where I am. I'll be keeping my company on 1password, and my family too, because I think it's a good product. I don't personally use Omarchy, but I welcome anything that can bring more people to linux on the desktop, so I support that too. I don't agree with everything DHH says, but I absolutely despise online witch hunts so I guess I support him too just on principle.
Just felt the need to post that.
piece of paper
Dont know why you are getting downvoted, this is a valid method widely recomended in this day and age. The hacker cant hack your password book locked in your desk drawer!
It's not dumb, it's just a little inconvenient. My passwords are normally 50+ characters and pretty hard to type out, but I could fix that with "Correct Horse Battery Staple" passwords.
Travelling is a little worse. I'd need to carry my little pocket book an risk losing it and now I can't lock my accounts, because I don't have the password for them (I could have a backup).
You know, I'm kinda talking myself into just doing passwords in a pocket book.
Out of pure interest, why not settle down to idk .. 15-20 characters? Why 50+ char (with what I assume lots of symbols and randomized characters) passwords?
Because I just auto-generate them and 50 is the default in 1Password. I rarely change default in any software I use, partly out of laziness and partly to ensure consistency across devices.
Are people in your company moderately technical? If so, I highly recommend https://www.passwordstore.org/ coupled with a PGP key storage dongle (I personally use NitroKey). Then hosting is just a matter of hosting a minuscule git repo per user.
I imagine that a technical company can easily whip up a bespoke simplified interface for its non-technical staff too.
I've used it for about a decade at this point, and it's just perfect.
Oh fuck, 1Password is also part of the DHH crowd?!
Here is the migration guide for 1Password. [0]
The CEO of Stripe also donated $1M to Omarchy.
Do we need another migration guide for Stripe since the CEO personally donated to Omarchy and then tell everyone to stop using Stripe and all of their services?
[0] https://www.patreon.com/violetblue/posts/how-to-migrate-1684...
Huh, I guess TIL there is a controversy around Omarchy. I generally dismissed it as a serious distro after 5 second once realized it encourages using the AUR as your default package feed. The AUR is useful, but to me it’s something to be very aware of when you’re installing some software. Encouraging people to install everything through it is a crazy way to configure a distro. I just assumed it’s a distro for a very different target audience so kept my thoughts to myself
It's not really around Omarchy, but around DHH due to his political beliefs. I'm not deep into this, but I think the majority of the controversy stems from this article:
https://world.hey.com/dhh/as-i-remember-london-e7d38e64
That this controversy goes three levels deep (DHH -> Omarchy -> Supporters of Omarchy (1Password)) is kinda funny to me. At what point does it stop?
A more recent one is https://world.hey.com/dhh/wolves-sheep-and-gypsies-ba44af6a
Wow. I just read this one now, and DHH really makes it hard to defend him. It's definitely possible to make this argument without likening groups of people to wolves and sheep...
Yes, why not?
Yes
There's a bit of a jump here from something appearing good to rapidly becoming very very bad. Here's what I read:
> 1Password has pledged $300,000 over three years in support of David Heinemeier Hansson's Linux distribution known as Omarchy, and is now a “distinguished corporate patron” of Omacom. What a nice brand partnership.
Supporting a Linux distribution sounds nice; I hadn't heard of that one.
But the very next paragraph:
> DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI
> In an internal Slack message leaked to press today 1Password’s Roustem Karimov defended DHH as being attacked for his views...
Perhaps they could support a different Linux distribution.
It's also strongly concerning when someone defends someone with views like that, characterising them as being attacked. In general, toxic, racist, fascist views spread like viruses; when tolerated, through acceptance, they grow. A company needs to root them out. If we trust 1Password with our data, we are trusting a company with those views inside it with our data.
It's mostly extreme hyperbole and twisting of his views if anything.
One of his criticisms was the virulent attacks on anyone that questioned policy during covid. He for example prefered the Danish approach and they still ended up doing better than the UK or US.
I also can't help but see the folks clamoring for mass migration for the past 2 decades in europe against popular will as anything other than blind oikophobes. If you'd look at my capital and other places you'd question who is actually calling for ethnic cleansing.
> Perhaps they could support a different Linux distribution.
They won't. SV/YC loves the guy, that's the only reason they're donating to Linux/OSS (but really just omarchy).
COVID lab leak is not a conspiracy theory.
it doesn't mean it's true (we may never know), but framing as "conspiracy" was a product of conflict of interest where certain scientist were protecting grant money. Since then even some of the scientists who participated in it walked it back and openly said that both natural and lab leak theories were credible: https://www.science.org/doi/10.1126/science.abj0016
> DHH has called for the ethnic cleansing of Europe; he is also an antivaxer, a Covid "truther," a proponent of the "lab leak" conspiracy theory, an 'anti woke' weirdo, and is virulently anti-DEI
Leaving aside all the rest of this, I thought "lab leak" was considered a reasonable hypothesis, although not especially likely, these days, rather than some kind of fringe theory.
It's a result of political division in US. If you are on the left then you have to see lab leak as a racist rightie conspiracy theory or you will have issues fitting in. Also lab leak is rejected as a side effect from being confused with intentional leak/bioweapon theory, which is entirely radioactive.
Political right is the other way around.
It is not conclusively proven one way or the other, but most people just made their conclusion: left that it's the market, right that it's the lab (or bioweapon for especially out there).
The lab leak isn’t considered reasonable outside of pundits as far as I’m aware. Unfortunately the pundits are the ones with the microphone
I believe it was disproved, but regardless, there is a lot between accepting an hypothesis and possibly valid and building a conspiracy around it. I don't about this case, but this conspiracy typically degenerate in anti-science behaviours, perosonal attacks (on researchers or just chiense people) and similar nice things.