Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

171–180 of 289 posts

Re: Ask HN: Why should I trust password managers?

#171

Post by n4bz0r »

oezi wrote: post #118

My biggest fear with a local password manager is a keylogger stealing the master password. I wished local password managers had a way that they would only disclose a single password when using a yubikey rather than opening/decrypting the whole vault.

Don't know about other managers, but in Keepass you can use key file [0][1] alongside master password.

There is also an option to lock the db behind a Windows account [2]. Not sure if it's a good idea, though.

> One master password decrypts the complete database.

> Alternatively you can use key files. Key files provide better security than master passwords in most cases. You only have to carry the key file with you, for example on a floppy disk, USB stick, or you can burn it onto a CD. Of course, you shouldn't lose this disk then.

> For even more security you can combine the above two methods: the database then requires the key file and the password in order to be unlocked. Even if you lose your key file, the database would remain secure.

[0]: https://keepass.info/features.html#lnkkeys

[1]: https://keepass.info/help/base/keys.html

[2]: https://keepass.info/help/base/keys.html#winuser

Re: Ask HN: Why should I trust password managers?

#172

Post by 0xTJ »

What other option is there? When you've got over a hundred different random passwords, at some point you've got to manage those, so you use a manager.

Though I would never recommend a service-based one, just use something like KeePass and sync that file.

Re: Ask HN: Why should I trust password managers?

#173

Post by ramses0 »

npteljes wrote: post #46
ramses0 wrote: post #34

https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…

Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.

I just see asterisks?

Re: Ask HN: Why should I trust password managers?

#174

Post by mlsmith »

I might be minority here, but I prefer Bitwarden because of it's seamless ability to sync passwords with my wife. There's no way she's going to use something complicated or non-intuitive and she mostly uses iOS. We have nothing to hide from each other so all of our passwords are in the same vault. We also use the secure notes functionality to lookup important family info.

Re: Ask HN: Why should I trust password managers?

#175

Post by steelstraw »

dogman144 wrote: post #154
steelstraw wrote: post #147

Earlier quoted context omitted.

That is terribly low for such a critical issue. There are Ethereum L2s that pay out $2M bounties. https://twitter.com/saurik/status/1491821215924690950

That's a bad analogy, although you point out a possibly good thing for L2/crypto - the bug bounties are massive because the projects have a silly amount of funds. Password managers don't operate with those economic models though.

1Password has raised almost $1B. Surely they could put at least $1M toward a critical bounty?

Re: Ask HN: Why should I trust password managers?

#176

Post by harel »

npteljes wrote: post #46
ramses0 wrote: post #34

https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…

Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.

Start your command with a space to prevent it from reaching history

Re: Ask HN: Why should I trust password managers?

#178

Post by Anthony-G »

npteljes wrote: post #121
burntsushi wrote: post #52

Earlier quoted context omitted.

I think it's just an example to give you a conceptual idea of what 'pass' is doing under the covers. Of course, using 'pass' does not require 'echo'ing your password anywhere. Tangentially, if you precede a command with a space, then it won't show up in your shell history. (Double check to be sure, as this is likely a configurable option of your shell. e.g., 'histignorespace' in zsh.)

I agree with your points, but why showcase a super secure system with a flawed example? Also, so many things can go wrong with this setup, I'm inclined to think that this is one of the upsides of a password manager like KeePass.

I think you may have focused in on the tangential sentence rather than the point about it being a conceptual overview with Unix commands being used as a metaphor, i.e., not a literal example.

E.g., they’re not typing `echo` commands in the same way that they’re not typing `gpg "make-key"` (which is not a real command).

Re: Ask HN: Why should I trust password managers?

#179

Post by dogman144 »

steelstraw wrote: post #175
dogman144 wrote: post #154

Earlier quoted context omitted.

That's a bad analogy, although you point out a possibly good thing for L2/crypto - the bug bounties are massive because the projects have a silly amount of funds. Password managers don't operate with those economic models though.

1Password has raised almost $1B. Surely they could put at least $1M toward a critical bounty?

Depends on the cost/benefit. 3x security engineers to detect/respond vulns and attacks is less expensive but gets similar coverage plus a lot of other work capacity, for instance.
Post reply on HN