Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

41–50 of 289 posts

Re: Ask HN: Why should I trust password managers?

#41

Post by milesvp »

I will tell you a good reason to trust password managers. I know a lawyer who does estate planning. When you start talking about "what happens when I die", passwords are a class of problem that has only gotten worse in the last 2 decades. There are legal ways for estate executors to request passwords, but it is a pain, and can be time consuming. She tends to recommend password managers because they tend to be more consistent than written down passwords in a safe. Further, having a password manager, where someone can be designated as a trustee makes executing a will considerably easier.

Now, none of the above necessarily makes password managers safe. The increasing legal scrutiny that password manager providers face, means that they will tend to be relatively safe, but they're still a single point of failure. At some point you need to decide what trust level you want though, security is a lot about tradeoffs, and ease of access is always at odds with keeping things safe.

Re: Ask HN: Why should I trust password managers?

#42

Post by bee_rider »

Like most of the posters here, I trust my local password manager (keepass) for the most part (well, if my personal machine is compromised to the point where I don't trust programs running on it, I guess I'm truly boned).

I have recently started putting some low-value (social media) passwords in the firefox password store, just for autofill convenience. Does anyone know if there are some massive landmines to this sort of thing?

Re: Ask HN: Why should I trust password managers?

#43

Post by xenocratus »

jreese wrote: post #29
warp wrote: post #22

Earlier quoted context omitted.

You could use a different password for each service and just write them in a paper notebook. Paper is generally not susceptible to malware or other ways passwords can leak from a local or hosted password manager.

But now your password manager (notebook) is vulnerable to fire and water damage, with no backup or recovery options.

And also if you ever need to access anything on-the-go, you either can't or have to keep the notebook with you and make it susceptible to the things you mentioned + theft or snooping.

Re: Ask HN: Why should I trust password managers?

#44

Post by KronisLV »

> I've been having my own methods for safe handling of passwords on the web.

I use a local password manager, KeePass: https://keepass.info/

It's probably the only good middle ground for keeping track of passwords, SSH certificates and other data: a password protected local database that i can move to USB sticks or SD cards for backups, or keep inside of an encrypted 7z archive, or a VeraCrypt file if i cared that much.

You not only get to have a simple way to use it (it's just a file that's compatible with the software, like SQLite is also really easy to use), but also get to pick where/how you want to store that data in an easy to understand manner.

Right now it's great for all of my vaguely relevant access credentials, from numerous e-mail accounts, to online shopping accounts, to even access data for online platforms, hosting solutions, servers etc. with as many separate databases as i choose.

In my eyes, it's also really great for letting you randomly generate secure passwords - i don't know almost any of the non-essential service passwords and because it's so easy to generate new ones for accounts, i'm not plagued by "password-reuse-itis" either. When coupled with 2FA, it's pretty decent from a security standpoint.

It also has a clearly understandable attack surface - infected password manager binaries, stealing passwords when in memory or malware on the system (like keyloggers, clipboard watchers), someone stealing the database AND the master password, asking me nicely for it with a 5$ wrench: https://xkcd.com/538/

For why people use web based ones which aren't so clearly understood or dependable (your list of risks would be a lot longer with those), i'm not sure. It's probably just convenience.

Re: Ask HN: Why should I trust password managers?

#45

Post by barbazoo »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

> they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password

Maybe I'm missing something but sure they can't store its hash but they can and do store the password strongly encrypted. Presumably without the master password, at least, it should be close to impossible to retrieve the passwords. Or is that assumption wrong?

Re: Ask HN: Why should I trust password managers?

#46

Post by npteljes »

ramses0 wrote: post #34

https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…

Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.

Re: Ask HN: Why should I trust password managers?

#47

Post by torstenvl »

antoineMoPa wrote: post #13
josephcsible wrote: post #7

Because if you don't use one, you'll almost certainly instead either reuse passwords across sites, store passwords insecurely, or choose weak passwords.

In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encryption algo or make other silly mistakes). There is not a lot of value in trying to attack a single person's password file, but the value is multiplied by the number of users when using a centralized platform.

> storing passwords in encrypted files

Which you almost certainly access with some kind of software, yes?

A password manager is just a piece of software that stores passwords in encrypted files, and makes it more convenient to edit them, associate them with a website, use them to log in, check them against known breaches, etc.

Re: Ask HN: Why should I trust password managers?

#48

Post by abdullahkhalids »

I trust my password manager (keepassxc) because

(1) I believe in the fundamental goodness of humans.

(2) I believe that keepassxc being a Free Software, was made with honest intentions by competent people.

(3) That human society should be organized on the principle of mutual aid, and that involves trusting (initially at least) those who say they intend to aid you.

Re: Ask HN: Why should I trust password managers?

#49

Post by booi »

barbazoo wrote: post #45
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

> they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password Maybe I'm missing something but sure they can't store its hash but they can and do store the password strongly encrypted. Presumably without the master password, at least, it should be close to impossible to retrieve the passwords. Or is that assumption wrong?

That's exactly what they do and they have the audits[0][1] to prove it.

[0] https://support.1password.com/security-assessments/ [1] https://bitwarden.com/images/resources/Bitwarden-Security-As...

Re: Ask HN: Why should I trust password managers?

#50

Post by tristor »

lixtra wrote: post #36
tristor wrote: post #28

I'm surprised by so many of the comments here out-of-hand dismissing or denigrating any password manager that stores data in the cloud. There are ways to store data securely, one of the simplest methods is to do zero-knowledge encryption of that data by way of key-generation from a password only the user knows at the time of decryption. This is essentially how the vault functionality of most password managers work, w…

> There are ways to store data securely, one of the simplest methods is to do zero-knowledge encryption of that data by way of key-generation from a password only the user knows at the time of decryption. This keeps your passwords save until you enter your master password. At that point you have to trust the software that was downloaded a few days ago from an appstore or a few seconds ago from the company webserver.…

Your argument has nothing to do with cloud storage or password managers generally and seems to be an argument against automatic updates. So, fine, disable automatic updates (although I'd argue you're safer with them).

I also baked in the presumption that the software isn't malicious in my comment and called it out. So, sure, yes malware that leaks your password can exist. That doesn't really have any effect on whether password managers are a good thing or trustworthy.

Post reply on HN