Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How comfortable do you feel using cloud-based password managers?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 199 posts

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#41

Post by spondyl »

tim333 wrote: post #37
spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

I'm guessing "regular ol' pass" is "pass the standard unix password manager" https://www.passwordstore.org/ ? Just thought I'd stick that here to save others the googling.

Ah sorry, yes! I was tapping that out rapidly on my phone because I had gotten excited seeing a password manager thread. Maybe too much because I left the shower running before I realized I better wrap up my comment and stop being wasteful haha

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#42

Post by alpaca128 »

I don't trust them as much as an offline solution, and as enough solid offline solutions are available I avoid these cloud-based services.

Keepass does everything I need and supports all platforms I use. Sync isn't comparable but then again I don't register new accounts or change passwords every single day, so this is an area where sync features beyond what I get with syncthing are pretty irrelevant to me.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#43

Post by lukasm »

I use a hybrid approach with Lastpass used as a password entropy storage. For important services like Github I only store half of the password in LastPass. Then I add a nonce and a generic short password.

The final password is 12-16 random characters for LastPass + 3 chars Nonce that I generate from the service name (in my head) and a short 5 character password.

If LastPass leaks the secrets no one is able to take over the accounts easily.

For services that don't matter much I just store the whole password in LastPass.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#44

Post by woile »

dancek wrote: post #25
spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

I'd love to start using pass but I find managing gpg keys troubling (perhaps due to my lack of knowledge). Does your setup require copying the same key to each device? What would happen if someone got your gpg key? What would happen if you lost the key?

I've made a cheatsheet[1] for gopass, which is the same but also includes multi stores (you could have a personal store, and a shared store with your work team, synchronizing to different git repos).

Edit: to export the public key you can search Google, I'd recommend saving it in a yubikey or in a usb with encryption.

1: https://woile.github.io/gopass-cheat-sheet/

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#45

Post by Twisell »

I tried 1Password but finally resolved to use iCloud keychain after watching this BlackHat 2016 video https://youtu.be/BLGFriOKz6U.

I mean as far as I already trust their OS nothing can really protect me from being spied by them if they are ill intentioned, so as long as they are serious and patch their security flaw on a timely manner I can live with that. Beside it come as a free plan if you don't need more than 5GB of iCloud storage.

I'd figure using an external password manager just add another third party I need to trust and the fact that 1Password offer browser app interface (on top of native) don't reassure me in any way.

Of course if I'd ever need to reassess my threat model because I can't trust Apple anymore, I will quit iCloud service at the same time as their OS and go full FOSS.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#46

Post by vemv »

As an idea, someone could implement a middle ground solution between `pass` (https://www.passwordstore.org) and a cloud solution.

Key design: encryption/decription happens locally, using standard open-source tools such as GnuPG. The cloud provider cannot _possibly_, ever know your actual contents - they only store them so you can't get locked out (which is a very real risk with `pass`; safeguarding our underlying private keys is currently completely left up to us).

Also some a conveniece layer could be offered on top of GnuPG; that should be open source, distributed as a non-binary and paid via honor system (also one can pay just for the mentioned hosting).

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#47

Post by jhanschoo »

lukasm wrote: post #43

I use a hybrid approach with Lastpass used as a password entropy storage. For important services like Github I only store half of the password in LastPass. Then I add a nonce and a generic short password. The final password is 12-16 random characters for LastPass + 3 chars Nonce that I generate from the service name (in my head) and a short 5 character password. If LastPass leaks the secrets no one is able to take ov…

Thanks for sharing your approach. I already use the nonce+generic pass, but had not thought about your method, which I'd like to use from now on.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#48

Post by tbrock »

spondyl wrote: post #9

I've used pretty much every password manager under the sun at one point or another. Lastpass, 1Password, Bitwarden, Dashlane, Remembear, KeePass(X) and I've finally settled on regular ol' pass. I never really understood how it "syncs" but it's just git! Push and pull to update on every device. I use a private repo since site names are still metadata. You could put the whole directory tree in a tomb as well but that e…

Sadly this isn’t a modern solution. People have smartphones and occasionally have to login to Windows (without WSL).

While I’d love for everything I use to provide an easily accessible *nix shell it just isn’t practical for phone use or modern computing environment where you can access cloud data using web services from any internet connected computers/devices.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#49

Post by nickjj »

I would never trust them, but more importantly I don't want to have to waste brain cycles thinking that the 300+ passwords I have saved could be compromised due to neglect that's out of my control.

I just use https://www.passwordstore.org/ and it works great (I have 300+ passwords stored for years). It's a local command line driven password manager and it's pretty great for developer based workflows because you can save multi-line strings which makes it perfect for saving API keys and other sensitive stuff, along with the password you used to sign up to the site.

It's also smart enough to copy the first line of a multi-line entry to your clipboard, so you can access your passwords to login on a site within a few seconds. Especially since you can navigate your entries on the command line with auto complete.

It also leans on GPG encryption instead of trying to invent its own security mechanism.

Re: Ask HN: How comfortable do you feel using cloud-based password managers?

#50

Post by the8472 »

I think conceptually cloud-based password storage is trustworthy if you separate the cloud storage from the password manager software.

If both were provided by the same vendor then security motivations would not align. E.g. the vendor could reason that it's ok to do server-side encryption instead of client-side for whatever reasons. Or they could capture your master keys and decrypt old backups long after you have deleted things when compelled by a secret court order.

Separating storage and software means the software developer should consider the storage provider as potentially hostile and design the password manager accordingly.

Additionally a separate solution also increases data mobility. You can use your home server instead of cloud providers, you can move vendors instead of being locked into a single ecosystem.

That said, storing your key files offline is still another layer of security that has to be breached, storing it publicly accessible means you are only as safe as your hashed password.

Another concern, unrelated to the cloud aspect, is browser integration for password managers. It's something one should avoid since the browser extensions closely interface with the websites. It increases the risk that a bug in the extension allows a site to trick them into revealing the wrong secrets in an automated fashion.

Post reply on HN