From the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes.<p>Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors complain about. You really want to see a password manager get the basics right.<p>Notice also that the end of the Cure53 report complains about the project scope and the amount of time given. This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before.
It might be a good alternative to Enpass. They use Rust and libsodium, which is a good sign.<p>But browser integration is the trickiest part in a modern password manager, yet what makes a password manager actually usable for most people.<p>So, give it some time before using the browsers (currently only Chrome) extension. Virtually all other password managers had security issues here.<p>Making these extensions smart (able to guess where login and password fields are, when passwords are being updated, etc) is also far from trivial. It's actually way more complex than password storage.<p>Gonna stick with Enpass for now, but that's definitely a project to watch.
I think they are burying the lede, and being a little disingenuous with the big "Get Started, It's Free" button.<p><i>we will be introducing subscription-based pricing when RememBear leaves the public beta phase. </i><p><a href="https://help.remembear.com/customer/en/portal/articles/2890744-how-much-does-remembear-cost-" rel="nofollow">https://help.remembear.com/customer/en/portal/articles/28907...</a><p>A non-subscription product would be one thing that would get me to move off 1password.
What differentiates RememBear from other password managers? After looking through the blog and website it's not immediately clear to me. What makes (or will make) RememBear better than, say, 1password, which appears to have the same features, is also easy to use, and has a long history with which to work out issues?
Great name! So much more evocative than "Remembr".<p>Let's hope they succeed, and inspire other companies to append a penultimate "a" after the penultimate "e", instead of just removing the penultimate "e".
I'm currently using LastPass and their macOS app seriously annoys me (why do I have to click an OK button every time I save a new password?).<p>They seem to get their UI right at least. Plus, bears are cute.<p>Edit: No support for folders/categories it seems. That sucks a bit.
"Subscription pricing"... if anyone is looking for an actual good business model, is for the upcoming "1password refugees"... and all we want is the same stuff, but not subscription based.
Ooh, what a great example of a brand extension.<p>When I saw "new password manager" in the headline, my first thought was "those guys are fucked". What people want with a password manager is trust and stability, two things not associated with startups. But these folks have millions of users, strong app store ratings, and solid reviews. Going from "trust us with your data and privacy" to "trust us with your passwords" is not a big step.<p>I'd give my current password manager, LastPass, a C- on usability, so I'll be keeping an eye on this. I'd love to have something better to recommend to novices, and might even switch myself.
>Where does RememBear store my passwords and how are they protected?<p>>RememBear encrypts your passwords using both your Master Password and a unique device key generated by the application. It stores your passwords in an encrypted file on your device and on our secure servers for sync and backup purposes. However, RememBear will only encrypt and decrypt the items on your physical device. This means that your passwords and other items are always encrypted during syncing and remain encrypted when in storage on our secure servers. You and ONLY you are ever able to access your items as long as you keep your master password private.<p>Proprietary sync, no thanks.