Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

Post reply on HN
Print view View original

131–140 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#131

Post by lasdfas »

xhcudjchv wrote: post #119
lasdfas wrote: post #108

Earlier quoted context omitted.

It really surprises me that people are using pass or any other password manager developed as open source. Yes, the code is open source, but unless you download the code yourself and compile it, which not many people do on desktop and no one does for mobile clients, you have to trust the deploy process of a random group of people. None of the people even have to be malicious. They just have to have an insecure deploy…

pass is a single ~700 line shell script wrapping gpg and optionally git. while long for a shell script, that's pretty easy reading for a password manager, and easy enough to understand.

Yeah absolutely. But have you audited the mobile apps or the chrome extensions, etc. (Extensions can update in the background without interaction)? Every time a new release happens? Those products are created by completely different developers.

Not saying that a company could not have a malicious release. It could. I just think the odds are much lower because their release process has better security controls and is generally audited better.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#133

Post by arkem »

drcross wrote: post #112
dancek wrote: post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

Please read the following if you use chrome password manager on your phone: https://www.reddit.com/r/Bitcoin/comments/cxtfak/coinomi_wal... TL;DR; Someone in google is sniffing autocorrect text and when they find 12 word bitcoin seed phrases they are stealing the bitcoin. This is a serious breach of trust. If someone from Google is reading this please take it seriously. EDIT: On further research it may not categorica…

It looks like autocorrect wasn't sent in the clear at least according to one report.

This[1] report on this incident (commissioned by the wallet creators) makes me skeptical that autocorrect or Google was involved at all. I think some sort of malware or phishing to steal the seed was a much more likely attack.

[1] https://medium.com/@cipherblade/how-not-to-react-when-your-c...

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#134

Post by BozeWolf »

nickjj wrote: post #49

I would never trust them, but more importantly I don't want to have to waste brain cycles thinking that the 300+ passwords I have saved could be compromised due to neglect that's out of my control. I just use https://www.passwordstore.org/ and it works great (I have 300+ passwords stored for years). It's a local command line driven password manager and it's pretty great for developer based workflows because you can s…

Does not work on mobile, right? How do you handle passwords there? Copy/paste between mac/iphone (might be insecure). And what if you did not bring your laptop?

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#138

Post by 19ylram49 »

FussyZeus wrote: post #129
kennu wrote: post #93

1Password has always offered the best usability for me. Many other password managers (eg LastPass) have failed, for instance, to work with the AWS sign in page and some other tricky websites. 1Password UX is also well polished in other ways and is nice to use. I consider this kind of good usability to significantly increase my quality of life, since I login to various online services all the time and I want to elimin…

I love 1Password but haven't upgraded specifically because of the cloud service. All my stuff is already in Dropbox, and 1Password essentially came to it's old users touting a subscription fee to a functionally identical service. Why am I paying them every month to store my passwords when I'm already storing them myself? I'm sure I'll have to cave at some point what with the ongoing march of progress, but it leaves a…

I’m actually on the same boat, and I haven’t been able to upgrade to any of the newer releases of 1Password due to this. I feel exactly the same way. I refuse to cave though!

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#139

Post by 19ylram49 »

dancek wrote: post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

That’s an interesting perspective. I wouldn’t do it, but interesting nonetheless

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#140

Post by FreeHugs »

dancek wrote: post #71

You could say I put a lot of trust in Google, as I use the built-in password manager in Chrome. My rationale is the following: 1. My browser vendor can access my browser passwords anyway. 2. It's better to trust fewer vendors and pieces of software. 3. Copying passwords to clipboard is awfully insecure. 4. Trying to remember all passwords is also awfully insecure. I do not save any money-related passwords. I do dream…

    3. Copying passwords to clipboard is awfully insecure.
Not that I am aware of. What would make it insecure?
Post reply on HN