Forgiva
Security and privacy
password manager
SHOW HN2016
97points
96comments
#391of 2,264 in 2016
Top 18%of 2016 by points
How HN took it
RoastedHalf or more of the comments are critical
1 positive, 23 neutral or asking, 1 mixed, 30 critical, out of 55 comments about the project. Thread score -0.54.
Idea: 1 for, 8 againstExecution: 0 for, 6 againstPrivacy: 0 for, 6 againstPerformance: 0 for, 4 againstDocs: 0 for, 3 against
The thread, comment by comment
Each row is a top-level comment and its replies, in HN's order. Select a cell to open that comment on HN.
positive neutral or mixed critical about another commenter or something else the maker
What HN said
What people liked
Interesting idea of regenerating passwords instead of storing them
From 2 comments
Ok, cool that you can access it anywhere.
SNvD7vEJ on HNSeems like a really cool idea, as long as the password generator can be proved to be hard enough to break. How long does the retrieval of a password take? Sub-second? 10 seconds?
SNvD7vEJ on HN
Objections
Deterministic generation is not safer than an encrypted password database
From 3 comments
As I see it, the main benefit of deterministic password generation is the convenience of not needing a password database. Indeed, if the scheme is simple and/or portable enough…
SloopJon on HNAs an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when…
blowski on HNYour password will never be secure when you store it on someone else his disk or let someone else encrypt your password. Its not a matter of how, but when there will be a way to…
SpendBig on HN
Password generation is too slow for practical use
From 3 comments
Cool idea, but the main gripe I have with it is that the passwords it generates are clearly not made for remembering, but regenerating them takes multiple seconds.
Fightback on HNThese security experts forgot one really important thing: usability. I'm not going to wait minutes for one password to generate!
Walkman on HNSeems like a really cool idea, as long as the password generator can be proved to be hard enough to break. How long does the retrieval of a password take? Sub-second? 10 seconds?
SNvD7vEJ on HN
Changing passwords and site rules are unclear or unsupported
From 2 comments
What happens then if you want/need to rotate your password? How does it deal with stupid password format restrictions?
cauterized on HNHow does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc. How does…
Canada on HN
Closed-source or non-open licensing with unclear security audit
From 3 comments
How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage…
SNvD7vEJ on HNNC licenses aren't considered "Open Source": http://www.opensource.org/docs/osd
mynameislegion on HNAs an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when…
blowski on HN
Installer signature fails on Windows due to SHA1
From 1 comment
The Windows 64-bit installer is giving a bad signature even though its SHA256 installer hash appears to be correct. It looks like they used SHA1 checks in the installer. I…
KirinDave on HN
Requests
Publish a roadmap and security audit
From 1 comment
As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when…
blowski on HN
Add mobile apps
From 1 comment
No mobile apps?
huxflux2003 on HN
Support shared team folders
From 1 comment
Does this also support shared folders for teams?
Grangar on HN
Use stronger KDFs such as scrypt or argon2
From 2 comments
As I see it, the main benefit of deterministic password generation is the convenience of not needing a password database. Indeed, if the scheme is simple and/or portable enough…
SloopJon on HN>> What does password complexity have to do with the strength of the algorithm used to generate passwords? It is not the algorithm only but if you can look a little bit more…
marcusfrex on HN
Questions
How is password rotation handled
From 2 comments
What happens then if you want/need to rotate your password? How does it deal with stupid password format restrictions?
cauterized on HNHow does this handle situations where the generated password isn't accepted by the site? eg. Is too long, absolutely must have at least one symbol and one number, etc. How does…
Canada on HN
How does it compare to Master Password and KeePass
From 2 comments
How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage…
SNvD7vEJ on HNThis is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free . http://masterpasswordapp.com/
nautical on HN
Alternatives named
Master Password
From 2 comments
This is similar to masterpassword . They have a mobile app and desktop app . Moreover they are completely free . http://masterpasswordapp.com/
nautical on HNThis seems similar to Master Password (http://masterpasswordapp.com/).
boot13 on HN
KeePass
From 1 comment
How does this compare to the KeePass family of pw-managers? (Besides that Forgiva is closed source and KeePass is open source.) Fixes poor passwords, accessibility and storage…
SNvD7vEJ on HN
1Password
From 1 comment
As an end user, I don't care about how the passwords are stored. I care mostly about two things: 1. How hard it is for someone to steal them 2. How easy they are to retrieve when…
blowski on HN
getvau.lt
From 1 comment
I use getvau.lt, how does this compare?
dsego on HN