Require Open Source for Password Managers

[Anon47486929]

No, but I will make it easier to understand.

1. Jonah said criteria will be changed to ensure “X password manager” doesn’t reach recommendations
2. I say lets take Nordpass, implying if that is on the level of tools for which the criteria can be changed
3. This is followed by me asking if the current situation is this: The criteria will remain unchanged unless a tool you don’t wish to approve reaches it
4. Then I elaborate on why I think this is a bad way to look at it

It is nowhere close to the tired argument you think it is, since it is not about adding every tool or adding nordpass, but pointing out the problem with initial statement. Hopefully this helped

Anyway, I have already left this effort. PG doesn’t feel its a significant difference, and currently no polls floated by the team so far, so I am assuming this issue is shelved till someone from the main team bats for it.

[Parish2555]

So i was right.

Nord would never get recommended because it would not pass community scrutiny. This would not require a criteria change to prevent.

This seems to be what you misunderstood.

Hopefully we are both more clear on the issue. Thanks!

EDIT: always nice when the example were arguing over happens and I am again proven right.

[Anon47486929]

It isn’t about that at all. But I can see a determination to not understand. Cool, you win lol

[win11.shading291]

I agree 100% with @Anon47486929.

If we put a point system (I put score on my personal beliefs, but it could be different)

General criteria page:

• Security +2
• Source Availability: +2
• Cross-Platform Availability: +1
• Active Development: +4 (this should even be a minimum requirement IMO)
• Usability: +2
• Documentation: +1

Password manager minimum criteria (no points here, since its a minimum to enter the category):

• Must utilize strong, standards-based/modern E2EE.
• Must have thoroughly documented encryption and security practices.
• Must have a published audit from a reputable, independent third party.
• All non-essential telemetry must be optional.
• Must not collect more PII than is necessary for billing purposes.

Best-Case criteria:

• Telemetry should be opt-in or not collected at all: +2
• Should be open source and reasonably self-hostable: +2

Some people argued that open-source should not solely be the criteria into determining if a an option is recommended or not. I believe nobody’s saying that. Open-source, though is clearly a plus for the only reason that it brings trust to that option. It is clearly a plus, but not the only criteria.

Based on that logic, if there are already 3-4 password managers that are on par with 1password feature wise, audit, wise, usability wise, security wise, etc. BUT onepassword is the only one not open-source, then IMO it should be removed.

I’m not arguing this is the case though.

Edit: I’m not suggesting a point system be in place. This was just for the sake of demonstration.

[jonah (Jonah Aragon)]

@Anon47486929

The criteria will remain unchanged unless a tool you don’t wish to approve reaches it

I guess the answer is yes. The criteria would remain unchanged unless one of the following is true:

1. The community wants to add something that is clearly so much worse than our recommendations (like Nordpass) that increasing the criteria is necessary to avoid confusion about why Nordpass isn’t recommended.
2. One of the recommendations falls so far behind the others that it no longer makes sense to list.
3. The community wants to add something that is so much radically better than our existing recommendations that it necessitates delisting the existing tools.

None of these 3 three things really apply.

And again, the argument that you and @fria are making is that situation #2 does apply, and I’m countering this argument by saying that source code licensing doesn’t create enough of a quality “delta” between 1Password and the others to say that “it has fallen behind.”

Is this an accurate assessment of where we’re at?

[Anon47486929]

Yup. That summarizes it.

[Encounter5729]

I encourage everybody that hasn’t done it yet to VOTE here on whether to require Source-First, Open-Source or keep allowing proprietary password manager.

So far, it’s a tie between source-first/open-source and proprietary

[Lukas (Lukas Dutovas)]

@Encounter5729

So far, it’s a tie between source-first/open-source and proprietary

It’s sad to see that it’s a tie between freedom and proprietary.

One thing to note is that this proposal has 28 votes, the proposal with the highest votes ever has 30 votes.

[asanyan]

@jonah

As far as I see it, the only reason we would want to add this criteria is if we collectively believe that software being open source is a requirement for privacy/security. I believe this is a minority viewpoint, and it’s a point that we have explicitly tried to downplay in our content, as we prefer to evaluate products based on our current best judgement of how they are as-is.

Then why do you have this criteria in other categories at all? Password management is as mission critical as it possibly gets and therefore it should have the strictest criteria, specially when it comes to anything “cloud-based” and/or that has to connect to the internet.

@jonah

However, is there a substantial reason to remove 1Password from the list today given that it is already on there? No, I don’t think this is the case either.

If that’s the concern, then how about still mentioning it, but separating it from the other recommendations like what you do with e-mail providers? I understand the reason for Tuta being the “3rd option” is different, but I believe such a division would be warranted if you believe that FOSS is an improvement.

[phnx]

@asanyan

Then why do you have this criteria in other categories at all? Password management is as mission critical as it possibly gets and therefore it should have the strictest criteria, specially when it comes to anything “cloud-based” and/or that has to connect to the internet.

This is what I think a lot of users find strange. Obsidian could in many ways be considered the ‘1Password’ of digital notebooks, yet it is not recommended due to being closed-source despite being able to be used fully offline (with lower stakes in general), unlike 1Password.

[Encounter5729]

@Encounter5729

Let’s do a Poll to help us decide. All votes are PUBLIC to prevent people from faking it with burner accounts.

• Votes

• 13 votes Keep the status-quo (proprietary allowed)

  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 

• 9 votes Require source-first as a minimum

  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 
  • 

• 5 votes Require open-source

  • 
  • 
  • 
  • 
  • 

• 3 votes Other

  • 
  • 
  • 

30 voters

30 total votes

With 14 votes against 13 votes, the Privacy Guides community slightly favor open-source/source-first.

I am wondering why the 3 who voted Others choose this?

[patron]

@Encounter5729

I am wondering why the 3 who voted Others choose this?

In my opinion “source available” should be the minimum criterion, so I voted for “Other.”

[Lukas (Lukas Dutovas)]

Am I the only one who sees an obvious issue with other voters knowing what the entire PG team voted for? It might just be me.

Another issue is that some voters love 1Password’s UI and UX and are clearly biased against requiring open-source because their favorite password manager will get removed, but I disgress.

[Encounter5729]

@patron

In my opinion “source available” should be the minimum criterion, so I voted for “Other.”

I am unaware of source-available password manager. I think this is unlikely. Source-available will be something you can’t even build yourself (I think?).

So if you are OK with it, please vote for source-first .

@Lukas

Another issue is that some voters love 1Password’s UI and UX and are clearly biased against requiring open-source because their favorite password manager will get removed, but I disgress.

As Proton Pass catches up with 1 Password, things might change, so that’s a silver of hope.

I am a bit sad PG is ok with proprietaryware.

[patron]

@Encounter5729

I am unaware of source-available password manager. I think this is unlikely. Source-available will be something you can’t even build yourself (I think?).

Just because something doesn’t exist now doesn’t mean it won’t in the future. I find minimal privacy advantages in source-first or open-source compared to source-available, other than the increased chance that more people have reviewed the code. That is my personal opinion.

@Encounter5729

So if you are OK with it, please vote for source-first .

Ultimately, my vote supports changing the current criteria, but I have a different opinion on how extensive those changes should be.

Regardless, I don’t believe this poll will have a major impact on the outcome of our discussion, even though I had hoped it would. The staff seems stuck in their decision, despite what most of their community is expressing.

[win11.shading291]

@Encounter5729

I am wondering why the 3 who voted Others choose this?

On my end, I voted for “other” because the criteria should change with time, as discussed in this thread.

For instance, if at one time, there are only 2 open source softwares in that category, it doesn’t make sense to require open-source in the criteria.

So my “other” vote = change depending on the maturity of the category.

[Anon47486929]

Require Open Source for Password Managers

Let’s do a Poll to help us decide. All votes are PUBLIC to prevent people from faking it with burner accounts. poll

Clearly shows the community consensus, hopefully PG team doesn’t hide behind community consensus as the reason. It is very clear the consensus is towards changing the criteria.

Here is the quote:

@jonah

as a steward of this community I also know and can accept that the general consensus is that it isn’t substantial enough for us to require it. It’s a consensus that has been pretty long established now.

[jonah (Jonah Aragon)]

@Anon47486929

Clearly shows the community consensus

Privacy Guides gets like 8,000 unique visitors every day, and this forum has over 3,000 members. One poll which has 34 votes and is split between 41% / 49% is unfortunately not the clear consensus you are imagining. On the contrary it proves that we can’t proceed too quickly here.

If only it were that easy!

Much like Wikipedia, Privacy Guides is not a democracy, rather we make our decisions based on discussion and consensus. A poll is not a discussion, and this one frankly has hindered this discussion a bit as we are now all talking about the poll itself rather than the merits and drawbacks of this proposal. The polarization here as a result of the poll has really only slowed down the possibility of us making this change.

Do not worry, because we are considering the opinions shared here in this thread, in that poll, and across the wider community as we carefully chart out the best course of action here

[Anon47486929]

Visitors are not community, and PG is not anywhere close to Wikipedia’s governance and consensus structure. Discussions are necessary and integral I agree, but I was merely pointing out the consensus is not so clear as your previous statement led me to believe. I agree PG would be terrible with democracy, and curation and reasoned recommendations are the reason why I choose to invest my time here too.

I understand the responsibility and difficulty of managing something others find useful, but I do think the current slow pace and reactionary rather than proactive change does not lend well to what PG should aspire to be. The poll is just a push for faster changes when they are easy to make, but maybe we disagree that it is an easy change to make. Anyway, hopefully PG moves slightly faster here

Also there are 31 votes for the topic

[Lukas (Lukas Dutovas)]

@jonah

Privacy Guides gets like 8,000 unique visitors every day

How is that calculated when there are things like Tor, VPNs, shared IPs, fingerprint resistant browsers, etc?