Show HN: Secrets 2 – Simple, secure password manager for Mac and iOS

https://outercorner.com/secrets/?utm_source=hn

by pfandrade • 10 years ago

54 60 10 years ago

nixgeek5• 10 years ago

Looks neat. What's the elevator pitch on why to use this, over and above existing solutions like 1Password or LastPass?

thirdsun2• 10 years ago

That was my first question as well. Why use something other than 1Password? And one answer may be the one time expense (Secrets) vs subscription plan (1Password).

Personally I prefer the web access and rock solid reputation of 1Password and gladly pay for it. Other than that Secrets looks fine.

K0nserv• 10 years ago

AFAIK 1Password still has a one time purchase option, but it's slightly harder to find. See https://agilebits.com/store

pfandrade19• 10 years ago

We need a chance to build a reputation :)

pfandrade19• 10 years ago

By using an open standard to store your data besides being as transparent as possible on the storage format which you can verify on your own using third party tools (we have a post about that https://outercorner.com/2016/08/01/storage_format.html) we also benefit for the scrutiny OpenPGP as been through.

We also wanted to make a simpler and safer option (and in our eyes, more pleasant to look at) to existing password managers.

codebeaker3• 10 years ago

1Password's format is also documented [1], though I'm not aware of any 3rd party clients to parse/work with it. That's actually a thing I was thinking about writing (I commented about trying to write something in C++14 in another front page thread, this was it)

1Password also uses standard encryption, from the link [1]:

We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption.
In this document we will refer to “blocks of data”. Unless otherwise stated, blocks are the length of AES blocks, 128 bits (16 bytes).

Edit: apparently Github lists [2] four libraries for reading OPVault, one each in Python, Haskell, Go and Ruby

[1] https://support.1password.com/opvault-design/

[2] https://github.com/search?q=opvault&ref=opensearch

nixgeek5• 10 years ago

Are you able to go into details about implementation, particularly around libraries used in building the iOS and macOS applications, and their pedigrees?

I'd argue that the implementation (or library) matters just as much as the standard (OpenPGP) when considering trust.

mosselman• 10 years ago

With regards to the security: Why is this free?

pfandrade19• 10 years ago

It's "Freemium". It's free to use for up to 10 items. You then unlock unlimited items via an in-app purchase.

kimshibal• 10 years ago

How much IAP?

pfandrade19• 10 years ago

Secrets 2 is out and it's going Freemium!

For the past 6 months since our initial release, we've been squashing bugs, implementing features that didn’t make our MVP and applying polish throughout. At the same time, we’ve been studying various options to provide a trial for users wanting to test Secrets before buying.

To address this need and to show users new to password managers just how easy and efficient using one can be, we're making Secrets and all its features free to use with up to 10 items. Unlocking unlimited items is done via an In-App purchase.

With Secrets we put security first. Secrets stores your data using the OpenPGP standard, a battle proven standard that has already seen a few revisions. This also allows users to easily self verify how their data is stored using third party tools.

We also strived to make it extremely simple to work with, not just from an UX perspective but also from a security perspective. Only the main app will ever handle your passphrase and encryption/decryption. Helper apps, browser extensions, etc must go trough it to get to your data (and require user confirmation).

So if you haven't tried Secrets yet now is the time! Download Secrets for Mac and iOS today.

nixgeek5• 10 years ago

What's the communication path between untrusted <-> trusted components look like and are you doing anything special which might prevent the vulnerabilities which Project Zero recently reported in 1Password[1], LastPass[2], Dashlane[3] et al?

[1] https://bugs.chromium.org/p/project-zero/issues/detail?id=88... [2] https://bugs.chromium.org/p/project-zero/issues/detail?id=88... [3] https://bugs.chromium.org/p/project-zero/issues/detail?id=89...

pfandrade19• 10 years ago

No untrusted component will have access to your data without user confirmation. This means you'll always have to click a button on the main app to fill a login for example.

There are two ways in which logins are filled in the browser:

- One is based on OS X Automation and AppleScript (this will work with Chrome and Safari without our Safari App Extension enabled). Succinctly, with this solution, Secrets will execute a small JS script on your frontmost browser windows to see if there are any logins to be filled. If so, it will present you a "Fill" button. Pressing that button will execute another JS script that will fill that form. In this scenario your data is send via Apple Events.

- When you have the Safari App Extension enabled, the process is similar. But instead of Secrets actively looking for logins forms on frontmost browser windows, the extension will let it know what is available. Again you will still need to press a "Fill" button on Secrets. Once you do your data is placed on a private clipboard that the extension uses to then fill the login.

There are no local servers, and the extension doesn't have access to your data. By design, none of the linked vulnerabilities would apply.

If you're wondering why the two methods, the Safari App Extension came later and the reasons are detailed here: https://outercorner.com/2016/10/19/version_1.4.0.html

mathgeek6• 10 years ago

Better than copying & pasting. Use the Secrets to automatically fill in login information in Safari and Chrome.

Missing a word here?

pfandrade19• 10 years ago

I don't think so. "Secrets" is the name of the app.

mathgeek6• 10 years ago

You meant to refer to it as "the Secrets" and not something along the lines of "the Secrets browser plugin" in that specific case?

nicky0• 10 years ago

Or one too many words. Surely just "Use Secrets to..."

cstuder• 10 years ago

Is it still two-factor-authentication if you're keeping your passwords and your one-time-password-generator in the same application?

nixgeek5• 10 years ago

Feels a bit like MPLS being Layer 2 and Layer 3.

I think it protects you against someone who's capable of sniffing your password on the wire somehow, since every login will require a unique code, and the secret is not transmitted, but you lose the benefit of "knowledge" (password) and "possession" (device, generating TOTP) being separate?

Whether you care about this depends on your threat model. If you're solving for "What if my Secrets vault is stolen by a bad actor and they're able to decrypt it?" then clearly physical possession being separate would be important.

pfandrade19• 10 years ago

We thought about calling it two-step-authentication. But most people know it by two-factor (and that's what most sites call it also).

And you can always have the OTP generator on your iOS device without the accompanying password to be technically accurate with the lingo.

joeblau• 10 years ago

I love all of these products, (this, Dashlane, etc...) but the switching costs are too high for me right now. Unless there is something that is extremely compelling, I can't justify transferring 400+ passwords just for a few features.

mathgeek6• 10 years ago

I'm only familiar with 1Password, but that does have an export feature to something as simple as CSV. Obviously you need to be careful about security and cleaning up after yourself, but there's no need to manually type in everything if the software you're moving to has any sort of import functionality.

pfandrade19• 10 years ago

Indeed. Secrets already supports importing from 1Password and LastPass for example. More could be added if there's demand for them.

kameit00• 10 years ago

The information, that it's free for only 10 items is quite hidden. For me, that is not so confidence-inspiring.

1.) Because the first thing I thought was 'what's their business model?'.

2.) Because why not calling it an unlimited Trial with 10 items, to make it clear it's not free.

Don't get me wrong - I like to pay for software, because I want to honour the work of others.

mathgeek6• 10 years ago

Agreed. This is shareware more than freemium. I actually prefer the correct terminology in this case as freemium implies ads (in my mind).

2T1Qka0rEiPr• 10 years ago

I'd also really expect to have some pricing information somewhere to suggest that you need to pay for it to get the full service.

pfandrade19• 10 years ago

Agreed. We'll be making changes to the site to clear that up.

Edit: We've since updated the site to make this clearer.

Antwan• 10 years ago

Where is that stored ? What's behind ? How could you pretend to be liable if there are no basic explanations.

Just use pass instead and control the things on your own. See https://passwordstore.org

pfandrade19• 10 years ago

It's stored on your local hard drive. We have more information here: https://outercorner.com/2016/08/01/storage_format.html

Angostura• 10 years ago

Err, how is this better than the built-in and free Keychain and iCloud Keychain built into OS X and iOS?

elmigranto• 10 years ago

For one, iOS keychain won't let me see items itself, or their full descriptions. It only allows to paste Safari website passwords. At least I haven't found how to do more than that.

From screenshots, it looks like this app would let you browse your whole collection in full. So there's at least one feature.

pfandrade19• 10 years ago

iCloud Keychain is handy for simple use cases. But it quickly breaks down if you want to have a good password habits.

For example, I use my Apple ID to login to a bunch of different Apple sites. With the keychain that would create separate entries for each site although they are the same. Change your password and you'll end up with items with outdated passwords (which you'll only find out when you try filling them).

The keychain is also cumbersome to create items manually (imagine you need to save an SFTP or VNC login?). Furthermore how would you have access to these items on your iOS device?

You also can store more than just passwords with Secrets.

sdfjkl• 10 years ago

I always wonder about that when people talk about these things. I think the reason is that Keychain Access isn't well advertised and a bit obscure, so most people are simply not aware that there is already a thing that does that on every Mac, with (optional) cloud sync and a standard API used by almost everything on the system (including ssh and Safari -- and Firefox with an extension).

eddieroger2• 10 years ago

I don't use this app, but I do use 1Password, and have thought about why I use something in addition to Keychain. What it comes down to for me is that I can keep other stuff securely in 1Password beyond just notes, and it's indexed and smart and everything. I actually find that I use it more for those other things these days. Additionally, it has had sync before Keychain had good sync, and I control it (and more importantly, can back it up on my own).

xrisk• 10 years ago

Sync to iCloud doesn't seem to be working.

pfandrade19• 10 years ago

Get in touch with support@outercorner.com and we'll help you out.

adambowles• 10 years ago

Can you share (and keep synced) credentials?

pfandrade19• 10 years ago

Yes, you can sync your credentials via iCloud with other Macs or iPhones/iPads.

MaKleSoft• 10 years ago

I don't understand why so many password managers go through so much trouble to implement auto-fill. This one has an interesting approach that seems to be slightly less intrusive than what, say, Lastpass is doing but I still don't really see the value outweighing the cost.

Yes, auto-fill - if implemented well - can add some convenience for the user but it usually adds a significant amount of complexity to the codebase and comes with some challenges regarding security. In fact, LastPass' autofill feature is/was the root cause of some very scary vulnerabilities[1].

Copy&paste is simple, broadly understood and supported in much the same way on every single platform. And in my experience, it's really not that much slower than auto-fill.

It seems to me that most password managers these days are to tick off a list of features rather than focussing on security and usability. Mind you, Secret 2 is definitely not the best example for this - I actually quite like the clean look and simple user interface. Still, it seems like most people nowadays are judging the value of a password manager by the number of features rather than, say, security.

<shameless-plug>Padlock[2] is a minimalist, open source password manager without auto-fill, browser-integration or any other 'advanced' features. We believe that when it comes to features, less is often more, and it seems there is plenty of people agree with us.</shameless-plug>

[1]http://www.martinvigo.com/even-the-lastpass-will-be-stolen-d...

[2]https://padlock.io

Tepix• 10 years ago

What are the advantages of using Secrets over Codebook (formerly known as STRIP)?

Codebook's database backend is open source and it's available for more platforms.

Show HN: Secrets 2 – Simple, secure password manager for Mac and iOS

Related Stories