51–60 of 77 posts
There are a few convivence features that password managers give: 1. Syncing. You mentioned it, but its actually pretty big. Its hard to do this right, and I don't trust myself. This is especially true on devices without normal OSs like phones. 2. Autofill. Just having a plain text file means I have to constantly go to it. Its a pain, I want autofill. 3. Password generation. Just a text file means I use shitty passwor…
A password manager is a big database of passwords. There is a master password that decrypts the database and from there you can use your passwords. Notice that hashes are one-way operations thus not used in password managers. The benefits of using a password manager are that that users need to remember and handle only one password, that of their password manager, the rest of the passwords are unique and can be rotated quickly. Ideally, your password manager does a few more things, including taking precautions against leaving traces of passwords in memory etc.
There's another part of commercial password managers which is mostly convenience functionality. Passwords are synced across devices, specific members access specific passwords etc.
Some people do use local password managers, depending on their threat model (i.e., who's after them) and their level of expertise/time on their hands. Setting up something locally requires taking additional precautions (such as permissions, screen locks etc.) that are typically handled by commercial password managers.
Reg. Okta, Okta is an identity provider. In theory, identity providers can provide strong guarantees regarding a user, i.e., "I authenticated him thus I gave him those token to pass around". Strong guarantees can include a number of things, including Multi-factor Authentication, VPN restrictions etc.
Funny story: during an internal red team engagement on a previous employer of mine, we took over the local password manager of a subset of the security org, twice. The first time, they had a VNC, unauthenticated, with the password manager running and the file unlocked. The second time, a team conveniently used Git to sync their password manager file, with their password tracked.
These days I use KeePass but together with Syncthing to have it across all my devices. It's a bit of setup but I am in control and it works flawlessly.
Last word; check out Syncthing, it really is a ridiculously good software.
Good luck cracking that remotely.
Earlier quoted context omitted.
KeepassXC has auto-type
Yes, it's not that the password manager doesn't have autotype. It's that I need to enter passwords on a lot of different machines and I don't want to (and sometimes can't) install a password manager on every machine, nor sync passwords between machines. So I use a standalone password manager on my phone instead.
Or Bluetooth controlled robot hands. I will go with the latter.
> Just a txt file encrypted with "master password" should be pretty damning to break into. This is surprisingly hard for non-engineers to get right. - Where do you put the decrypted file before you can open it up in Notepad? - Do you copy passwords to the clipboard, where other apps can spy on them in-flight to the destination? - How do you sync the encrypted file across machines? How do you resolve merge conflicts?…
Heh, you and I came up with almost the same set of drawbacks. I know I'd mess those up if I tried. Out of curiosity, how do you handle versioning in your scheme? What about password strength requirements, length restrictions, etc.?
I have a JSON file that describes if a particular domain has certain restrictions, e.g. max length, ensure at least 1 symbol, ensure at least 1 uppercase, ensure at least 1 lowercase, etc. and then deterministically edit the password to match any such requirements.
Another way to do appease the idiotic upper/lower/symbol rules is to just append something like "Aa$1" to every password, though it reduces entropy for sites that have a max length.
These requirements are public information, and you could store this JSON file on a public github repo if you wanted.
I also store in this JSON file another piece of information, which is the Nth password on the site. The I run something like 500000+N irritations of PBKDF2 where N is the nth password I use on the site. The value of N for sites not in the JSON file is 0. If I need a 2nd password on a site due to it requiring me to change the password, I increment N and store in the JSON file. For this reason I store the JSON file in a private github repo. I know it's not the best practice but meh the value of N is not that sensitive compared to the master password, which is stored nowhere and has never been entered into a machine I do not own and trust.
Known password managers such as Bitwarden don't simply communicate the master password from client to server in plain text: https://bitwarden.com/help/security-faqs/ , the master password is salted and hashed client-side, then salted and hashed again when stored in Bitwarden servers. Even if you managed to perform a MITM attack, you'd only be able to download your encrypted vault data, which would then require your m…
I honestly don't know. Keepass + syncthing is really fantastic and very secure. I guess some people have bought into this "services are convenient" narrative, which I don't really think is true at all. There's nothing convenient about finding out that your password database has leaked online, verifying your new machine with SMS 2fa, doing everything in a browser in a web app. Having a file in a directory that's just always there and up to date is convenient, adding a new syncthing directory pair when you get a new machine and then being able to forget about it after that is convenient.