1Password started off like that and relied on file syncing services like Dropbox for supporting multiple devices. It's still using the same foundation, but 1Password provides the syncing service itself. (They aren't supposed to see the master password.)
Ask HN: Why do people use password managers?
31–40 of 77 posts
Re: Ask HN: Why do people use password managers?
#32I think the meta point across the other answers in this thread is that when people choose less "secure" options, it's often because they have a different set of input values for their cost/benefit calculation. Too often, I feel like security conscious folks try to convince me to do X rather than Y by explaining to me why Y is insecure, when in reality I'm just not motivated enough to make a change.
Re: Ask HN: Why do people use password managers?
#33Honestly? I have no idea. I use a locally encrypted store, and have done so for almost 10 years. I keep thinking to myself "there's got to be something better, surely I could make an external device..." but it remains to be seen.
So you manually type over the password when you need to log into something on your mobile phone?
Re: Ask HN: Why do people use password managers?
#34Because poor usability just is a vuln.
If you make life unlivable, either for yourself or for a group of people, you can expect security to fall by the wayside.
Real-world security isn't just about digraphs and compendia of named (known!) attack types, listed together with mitigations. (Although all that certainly helps!)
It is, unfortunately, also about maintaining and managing personal systems. No matter how scaled and nuanced, the security of any organization comes down to personal habits.
Password managers make it significantly easier to track, prune, maintain and manage identity across sundry & clastic platforms, and therefore, improve security.
Re: Ask HN: Why do people use password managers?
#35> Obviously, this would be less convinient and wouldn't sync between devices
That's your answer right there ^
Re: Ask HN: Why do people use password managers?
#36> I'm not a security engineer so pardon me this is dumb.
I am a security engineer, and this isn't dumb. It's a very well thought out, smart question.
I'm not going to try to out do the other answers, but will point out, most seem to underweight the importance of social proof, and convenience
Re: Ask HN: Why do people use password managers?
#37I use Bitwarden.
My reasons for doing so are, in roughly descending order of importance:
1) It makes it easy for me to have a unique, complex password for each service/account. This limits my exposure to third-party data breaches. If a service I'm using stores their passwords in plaintext, and they get hacked, my exposure is limited to only the impacted accounts
2) I can easily share it across multiple devices. I regularly use macOS, Linux, Windows, iOS, and iPadOS. Bitwarden has clients available for all of these, and they work "well enough".
3) Convenience. For most services, I store my MFA key in Bitwarden alongside the password. I can therefore log in to those services with a few keystrokes: Cmd/Ctrl+l to fill username/password, and Cmd/Ctrl+v to paste the TOTP value. Of course, this increases my personal exposure and decreases the effectiveness of enabling MFA. For critical services - access to production systems for work, financial services, etc. - I have a hardware token that I use. It's not nearly as convenient, but it's good enough to be usable in the cases where I need a higher level of security
4) Sharing. I have a couple hundred accounts that I share within my immediate family.My wife, my kids, and even my own parents have Bitwarden installed on at least one of their devices. I've set up organizations so I can easily share credentials with them. This makes it much easier to have reasonable security on things like my Blink (security cameras) account while not having to physically access their devices to log in for them the first time.
5) Continuity. By having all of my credentials in one place, I'm able to store a physical copy of my Bitwarden credentials in a safe place. If I die unexpectedly, my heirs will have immediate access to all of my accounts. Because that system is the same one I use day-to-day, I don't have to worry about updating a "backup" or having it drift out of sync. I can also rotate my password frequently where appropriate and be confident that those changes will be propagated to my backup without my having to take additional steps to make it happen.
Obviously, the downside is that Bitwarden is then my single point of failure. I mitigate that to the best of my ability. Sign-ins from new devices requires a TOTP that lives on my hardware token or confirmation from one of my existing devices. If my Bitwarden account were to be breached, it would be a huge pain in my ass for sure. The attacker would be able to impersonate me on multiple sites, and perform some actions - off the top of my head, the most impactful one is that they'd be able to drain my checking account. That account only has my "working cash" for half a month at a time, though. All of my savings and investment accounts require at least a TOTP from my hardware token.
Re: Ask HN: Why do people use password managers?
#38> Just a txt file encrypted with "master password" should be pretty damning to break into.
This is surprisingly hard for non-engineers to get right.
- Where do you put the decrypted file before you can open it up in Notepad?
- Do you copy passwords to the clipboard, where other apps can spy on them in-flight to the destination?
- How do you sync the encrypted file across machines? How do you resolve merge conflicts?
- How do you backup the encrypted file and make sure you don't accidentally upload the decrypted copy?
- How do you share some passwords with your partner, some passwords with your phone plan's virtual family, some passwords with your cofounder, and keep yet other passwords to yourself?
Engineers can solve most of these problems but average non-tech people would probably fail at all of the above.
That said, I use an almost-stateless password generation scheme that involves PBKDF2-HMAC-SHA256 on master password concatenated with domain of service, but that solution isn't for everyone.
Re: Ask HN: Why do people use password managers?
#39I use a browser based password manager (ie 1pass, Lastpass, Internet Explorer, Chrome/Android, Apple/Safari keychain) The major advantage when compared to a separate application (ie encrypted text document) is that the system/browser based url/context reduces Phishing, Clipboard jacking security issues. Why does Okta exist? Primarily for their SCIM configuration (which is different and adds a level of org management)…
If you're fully entrenched in the Apple ecosystem, Keychain is the most seamless option. I don't use its "strong password" recommendation system, however, since it breaks on half the signup flows I try it on, sometimes botching things so badly I have to use the "forgot password" link to log in the very first time.
Re: Ask HN: Why do people use password managers?
#40There are a few convivence features that password managers give:
1. Syncing. You mentioned it, but its actually pretty big. Its hard to do this right, and I don't trust myself. This is especially true on devices without normal OSs like phones.
2. Autofill. Just having a plain text file means I have to constantly go to it. Its a pain, I want autofill.
3. Password generation. Just a text file means I use shitty passwords everywhere. Auto-generated passwords are truly random and much more secure.
4. Recovery. My father passed away a few years ago. The fact that he had all his stuff in a password manager with me as a recovery person meant the transitional period was way easier. Instead of having to deal with tons of customer support for months I was able to manage his affairs the next day.
5. Integrations. For example some managers can plug into TOTP services and autofill that for you. I don't personally use that, I feel its too many eggs in one basket, but some people like that.
6. Team/sharing. My work uses a password manager and its useful to store creds in a secure, audited, sharable way for certain services.
When you put it all together it adds up. It CAN be done with alternative means, and if you are super security conscious you may choose to do so, but for the majority of people its a good tradeoff.