Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

111–120 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#111
I'm not entirely comfortable with online password managers either.

For company use, I do use online password managers (1password), as they generally offer a good UX experience for less technical users, and there isn't strong rationale to believe companies focussed on password storage/transfer have bad practices in place. I also place some of my passwords in these password managers, generally passwords that don't do high amounts of damage if compromised.

Totally given the choice for a technical team, as many others have pointed to, I like pass or gopass as a team password mechanism, synchronizing passwords over git which is encrypted locally.

I'm pretty sure my reluctance or hesitation around cloud password managers stem from, it's hard to know who to trust. Companies pretty much universally have poor practices, missing controls, and will miss-represent or be susceptible to internal dogma about how good the tools and practices are. Allowing online sync of passwords increases the surface area, more things have to be perfect to prevent a compromise than non-online systems.

The really difficult part though, is it doesn't mean the cloud based manager is actually less secure than a more traditional app, a decent amount of the surface area of both applications intersect. Think of things like a compromise of the build server, unless you're running the app totally isolated from the internet, both online and offline apps can get compromised in the same way, and pick you're favourite offline app may have higher risk then pick your favourite cloud app based on internal controls that aren't talked about.

So with this in mind, for me it comes down to making a choice of trust on very imperfect information, only really with the public history of a vendor and how they present themselves externally. So given that imperfect information, I tend to place a higher weight on solutions with less surface area, there are less pieces for the vendor to get perfect to protect the system. And even with online password managers, I never install the browser autofill extensions, again to limit surface area.

That said, with password handling the choice of password manager and how it operates is also likely a smaller concern. As in most companies have bad password rotation practices when say an employee quits, or their laptop is compromised, etc. It would be cool to see a standard protocol for a password manager to be able to go in and rotate passwords automagically, and continue to see progress towards SSO and U2F/FIDO2 security keys universal adoption.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#112
post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

Please read the following if you use chrome password manager on your phone:

https://www.reddit.com/r/Bitcoin/comments/cxtfak/coinomi_wal...

TL;DR; Someone in google is sniffing autocorrect text and when they find 12 word bitcoin seed phrases they are stealing the bitcoin. This is a serious breach of trust. If someone from Google is reading this please take it seriously.

EDIT: On further research it may not categorically be someone in google if the autocorrect text is sent in plain text. Autocorrect text should not be sent in the clear though. See here for more information: https://avoid-coinomi.com

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#113
post #73
post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

1. Is not necessarily true. If you use an open source browser like firefox, your browser vendor would absolutely not be able to access your passwords (...without creating a huge scandal where users would catch up immediately) 3. Can actually be mitigated, or other options can be used. For example, in my browser I disabled JavaScript clipboard access, so that random websites can't access my passwords. You mention pass…

Regarding point 3, my point really is that just a command-line program is not enough. I need a browser plugin or a keyboard emulator. That's one more piece of software, possibly from another vendor (see point 2). But yes, you're right, using the clipboard is not required for any reasonable password manager. It just might be an easier way sometimes.

Also it's quite difficult to keep up with all the apps on my system and all of them can follow the clipboard. I didn't even consider random websites.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#114
If it helps, Bitwarden, including server, is open source. Of course that isn't a panacea by any means, but you can at least build it yourself and glance over the code. For me I prefer it to closed source for sure, and honestly even if the UI isn’t as pretty Bitwarden checks all of my boxes and tends to work really well across the platforms I use it on, including Linux, and it doesn’t have the same extension security troubles as many other password managers have had (1password prior to 1password X suffered due to communication with a desktop app and the complications that brings. Lastpass doesn’t do that, but has had arbitrary code execution vulnerabilities in their extension.)

And of course, Keepass XC is always a very formidable password manager.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#115

Earlier quoted context omitted.

Your browser sends and receives tons of packets to addresses owned by the browser vendor and third party sites. After all that's its main function. Your open source browser is millions of lines of code. You think it would not be possible to exfiltrate passwords without your notice? It seems a much more practical approach to assume your browser vendor is a "good guy", as the alternative model is that you choose to do…

I think the premise is we would know if it already did that, and incremental code changes can be inspected to see it isn't added. So yeah, it's pretty safe to say open source makes it trustable.

That's pretty reasonable, but if I were a malicious actor looking to do something like this, I'd try to introduce different bugs at different times that combine to leak passwords. That would give plausible deniability, too. Not saying it's an easy scheme to engineer.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#116
post #110
post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

I agree completely with your logic, especially that a password vendor can see passwords anyways. Introducing fewer parties reduces points of failure. I save all money related passwords... Much safer than my faulty memory or having them listed in a doc somewhere.

I have to reset approximately one money related password every two years. Usually it takes a trip to a bank and might cost five euros. I think that's not unreasonable, but I'd love a system I could trust with everything I own.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#117
Online is better than not having a backup, so for your hypothetical mom it is probably a good idea (unless you manage their backups).

I would generally trust them to want to do the right thing, but software vulnerabilities or crypto bugs (weak IV initialization or so) are reasons to not do this. Unlikely, but the impact is large. But the chance (and impact) of losing all your passwords is even larger.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#118
post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

Please read the following if you use chrome password manager on your phone: https://www.reddit.com/r/Bitcoin/comments/cxtfak/coinomi_wal... TL;DR; Someone in google is sniffing autocorrect text and when they find 12 word bitcoin seed phrases they are stealing the bitcoin. This is a serious breach of trust. If someone from Google is reading this please take it seriously. EDIT: On further research it may not categorica…

I'm not sure if I believe that, but I'd never trust anyone with bitcoin seeds. I'm not sure what the risk is for passwords I'd type in my browser anyway and that I could reset with my Gmail account.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#119
post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

It really surprises me that people are using pass or any other password manager developed as open source. Yes, the code is open source, but unless you download the code yourself and compile it, which not many people do on desktop and no one does for mobile clients, you have to trust the deploy process of a random group of people. None of the people even have to be malicious. They just have to have an insecure deploy…

pass is a single ~700 line shell script wrapping gpg and optionally git.

while long for a shell script, that's pretty easy reading for a password manager, and easy enough to understand.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#120
post #21
post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

Not to mention pass, due to its connection to GnuPG, can protect secrets using Yubikey that require 6 digit PIN (will lock after 3 tries) and touching the blinking dot.

How do access your passwords from your phone?
Post reply on HN