Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

61–70 of 289 posts

Re: Ask HN: Why should I trust password managers?

#61

Post by TillE »

hdjjhhvvhga wrote: post #57
geocrasher wrote: post #55

Because my passwords are stored in the cloud but they are only decrypted on my PC. If a nation state or another attacker gets into the password manager I use, they have my encrypted passwords just the same as if they rooted some Linux box I have an account on. The stakes are roughly the same. A passsword manager (PM) makes random passwords easier. A PM keeps me from re-using passwords. A PM gives me a relatively secu…

> they are only decrypted on my PC. The point is, why do you believe it's true?

Why do you trust any software running on your computer? Your password manager is no more likely to have a malicious backdoor than any other program.

Re: Ask HN: Why should I trust password managers?

#62

Post by sleepybrett »

tristor wrote: post #50
lixtra wrote: post #36

Earlier quoted context omitted.

> There are ways to store data securely, one of the simplest methods is to do zero-knowledge encryption of that data by way of key-generation from a password only the user knows at the time of decryption. This keeps your passwords save until you enter your master password. At that point you have to trust the software that was downloaded a few days ago from an appstore or a few seconds ago from the company webserver.…

Your argument has nothing to do with cloud storage or password managers generally and seems to be an argument against automatic updates. So, fine, disable automatic updates (although I'd argue you're safer with them). I also baked in the presumption that the software isn't malicious in my comment and called it out. So, sure, yes malware that leaks your password can exist. That doesn't really have any effect on whethe…

I use 1password7 in a mode where I have to manually sync my vault. I've used other tools to prevent 1password from initiating any network connectivity at all.

Re: Ask HN: Why should I trust password managers?

#64

Post by ams92 »

warp wrote: post #22
tuckerman wrote: post #10

Earlier quoted context omitted.

I guess password managers seem like one of those few decisions that made my life both more convenient and more secure (after the initial adoption). Out of curiosity, what could one use instead of a password manager that would be closer to the “more secure” side of things in your opinion?

You could use a different password for each service and just write them in a paper notebook. Paper is generally not susceptible to malware or other ways passwords can leak from a local or hosted password manager.

You can't possibly believe that this is a viable alternative.

Re: Ask HN: Why should I trust password managers?

#65

Post by stronglikedan »

Because I too had "my own methods for safe handling of passwords on the web", but eventually realized that's a fallacy. Unless you're some memory palace super champion, you're probably using an underlying pattern to remember all your various passwords, perhaps without even realizing it. I didn't realize it until I started using separate passwords for everything, and "everything" started multiplying exponentially year over year. Only then did the pattern emerge to me, and only then did I realize it would emerge to a computer algorithm in about 1 femtosecond flat.

There is no more convenient "safe handling of passwords on the web" than a password manager, in my experience. That said, if you know of a better, but at least as safe, way, then please share.

Insert shameless Bitwarden plug here.

Re: Ask HN: Why should I trust password managers?

#66

Post by lmilcin »

You should not trust password managers with critical stuff.

Even if the product is secure. Even if it actually does end-to-end encryption. Even if it is open-source and you can audit code.

Even if all of the above are met, somebody still can upload a malicious package or commit malicious change that gets propagated to you.

It is probably fine to use password managers for stuff where damage would be limited (accounts to low value things).

But for stuff that matters I know of no better system than a piece of paper, a tamper evident envelope and a logbook.

Re: Ask HN: Why should I trust password managers?

#67

Post by teaearlgraycold »

awill wrote: post #19

IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target. I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.

You're right - although you can pick better or worse providers. At least 1Password doesn't have a long history of breaches (like LastPass lol).

Re: Ask HN: Why should I trust password managers?

#68

Post by DougN7 »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

I do the same thing but worry about a nation state or rich enough hackers to just take over the project and add nefarious code. I’ll never audit the code and make sure it produces the binary I get from the Apple store. So I’ve started adding my own “salt” - I type an extra character or two (same for all passwords) to the end of every password I enter. It’s the easiest way to protect against not being able to trust my local password app that I can think off.

Re: Ask HN: Why should I trust password managers?

#69

Post by jimbob45 »

0x0000000 wrote: post #16

I use a password manager for the hundreds of accounts I have where security is not super important. Mostly as way to not have to reuse passwords (credential stuffing now makes up a significant amount of attack traffic), nor fight the varying password requirements ("shoot, did this website require a special character?"). Tbh, it's nice to have one less thing to worry about. For the increasing number of sites which req…

Came here to say this. When you're on the job hunt, there are a thousand different MyWorkDays you'll need to sign into and what an incredible pain it is to keep track of those manually. Just don't forget to delete all those accounts when you're done hunting.

Re: Ask HN: Why should I trust password managers?

#70

Post by ciphol »

Why are people talking like the choice is between cloud password managers (potentially insecure) and no password manager (impractical unless you reuse passwords)? There's a third option - a local password manager like the one built into your browser. Its one disadvantage versus the cloud is that you have to reenter your password on each of your devices. For normal people who have maybe 2 or 3 devices and don't change their passwords very often, this is a trivial obstacle.
Post reply on HN