Require Open Source for Password Managers

[anon49578468]

+1 to the idea. No reason to not have this requirement now that there are good options all around.

[Rasta]

I’d like to see a bit more feature parody first myself.

[donutfreak (DF)]

@Rasta

a bit more feature parody first myself.

Parity or parody?

[Lukas (Lukas Dutovas)]

Parody would probably be a better fit. Bitwarden or Proton Pass features are probably enough for 99% of users.

[ikelatomig]

@thatgirlartemis

“bridge” - and that is reserved for desktops

And requires a Premium account too to use that bridge.

[Lukas (Lukas Dutovas)]

One more reason to remove 1Password and enforce this criteria:

Mention that 1Password is not working correctly on GrapheneOS without GAPPS

Hey there, I’ve been using Bitwarden on my GrapheneOS for years, without any issue. Since 1Password is recommended on PG, I gave it a try, particularly because I enjoy Large Type feature and UX of 1Password. Unfortunately, it has a numerous problems on GAPPS-free environment: App can be only obtained via Google Play, therefore Aurora Store is needed; QR scanner is not working without GAPPS - issue reported multiple times on 1Password forum, it does not let you scan anything. Seems like GAPPS…

[anon49578468]

Hey, just saw this response and a bunch of questions came up.

@thatgirlartemis

On mobile, you’re out of luck and have to find peace with their randomly updated (proprietary) mobile clients. No, thank you.

Do you have a source for their mobile clients being proprietary?

@thatgirlartemis

Also judging the affordability of a service by it’s yearly cost divided by 12 months is disingenuous at best. That’s not how much Proton Pass costs a month and you know it. It’s one Euro/US Dollar more than 1Password. And the only reason it costs so little when billed yearly is because Proton is desperately trying to push a mediocre product that has nothing of value that other password managers don’t have already.

I understand affordability is a big issue, but its “Privacy” guides, and a lot of recommendations (Pixel phones, Yubikeys) are not always affordable. If affordability is a criteria, lets reexamine a bunch of our tools then. Maybe recommend One Drive or Google Drive with Cryptomator for free storage?

@thatgirlartemis

If you’re not sure, then please (!!!) educate yourself on that before you start a thread about removing a very outstanding product.

Is feature availability a privacy criteria? Then I guess most of the recommendations with bad UIs and UXs are out? Lets recommend Gmail or even Microsoft email for the feature laden set of apps and consistent security records?

Ultimately I don’t think PG recommendation would stop you from using whatever software you want to. But it does reflect on the ideals PG wants to push for. I think its always good to remember that PG not listing a tool doesn’t mean you cant use it, it just means PG doesn’t feel it fits the criteria, or promotes practices that PG does not like (for example- being closed source).

If these are the only blockers to adding an open source requirement (none of them privacy based objections), then we should ideally enforce this condition.

And if open source cannot be enforced for password managers, lets start recommending MacOS, iOS, Windows, etc. which are better designed, have more featyres, and sometimes reasonably more secure than the recommended Linux distros and Mobile OSs

[Lukas (Lukas Dutovas)]

@KDEBacon

Edit 1: Idk why they’d recommend 1Password though

That’s the whole point.

We have Proton Pass, Bitwarden, Psono, and all the KeePass clients both with and without sync. There are enough options already.

[KDEBacon]

@Lukas

That’s the whole point.

We have Proton Pass, Bitwarden, Psono, and all the KeePass clients both with and without sync. There is enough options already.

Yeah, It is more understandable when it comes to note taking app. But the password manager recommendation confuses me

[Niek-de-Wilde]

A note here is that we only recommend it because it provides a very good UX for for nontechnical people. We are looking to replace it with with Proton Pass soon as that product continues to mature, and tighten the criteria to require open source.

The side wide policy is that that opensource is preffered, but that close source alternatives are allowed if they provide genuin UX or security improvements.

[Bhaelros]

I can understand if an app doesn’t go through regular audits, has unclear and non-privacy friendly policies, but in 1Password that is not the case.

Yes, being open-source is the ideal scenario, because it lets people to inspect the code, but many other people who doesn’t have deep coding knowledge trusts on audits. In 1Password’s case they are having frequent audits, so I don’t understand why some people are against it.

Yes, there are open source alternatives, but none of them are having functionalities, security features and audits like 1Password.

[TrashPanda]

@Bhaelros

Yes, there are open source alternatives, but none of them are having functionalities, security features and audits like 1Password.

But they do have - all other managers listed on PG are going through regular audits, are feature-rich and are open source. However, I’m with you regarding keeping 1Password listed on PG, since it has good reputation and is indeed private.

[Pragmatic]

What about Bitwarden and Keepass?

[Bhaelros]

Both are already open source but their features are not on par with 1Password. As for audits 1Password has the most audits compared to Bitwarden and Keepass.

Ref:
https://keepass.info/ratings.html

Compliance, Audits, and Certifications | Bitwarden Help Center

Security audits of 1Password

@TrashPanda I agree with you. 1Password is the only exception closed source password manager app which I can consider for PG. I don’t trust rest of the apps unless they prove that they are safe and privacy friendly.

[Lukas (Lukas Dutovas)]

Bitwarden has rewritten some of their apps to have an improved UX and especially UI. Just tried their new Android client, and it’s awesome!

[MMA-block]

@jonah

The SSH agent in particular is kind of a killer 1Password feature for me, although in general that’s probably too niche for most people to care about.

Perhaps I’m approaching this topic in a unique way because I’m still learning and exploring it.

Could it be possible that if a large proportion of users don’t utilize Secure Shell (SSH), it could potentially present challenges for those who are new to the product, as it could be susceptible to misuse by those with malicious intent?

[fria]

Need to revisit this. There are so many open source password managers available now there’s no reason not to make it a requirement.

[mentalfoss]

Revisit what?

18 votes already to something really obvious that should not needed to be voted on.

Password managers are probably the most sensitive apps out there.
Not having an open source criteria for them is just laughable.