Live data from Hacker News

Ask HN: Why do people use password managers?

news.ycombinator.com

61–70 of 77 posts

Re: Ask HN: Why do people use password managers?

#61
> Through these hackers can generally get passwords of all users of these services.

Assuming you mean password manager services. If they can get a copy of the vaults at all, in a well-designed system they have to attack each one individually.

They also serve business use cases for sharing, and revoking access, to other services.

> So, why don't people use local password managers?

Because synchronizing between devices is an important factor in usability, even just for an individual, not even considering groups or businesses that would share access.

Local password manager vaults can also be stolen by malware, would result in the same catastrophic loss you suggest.

> Just a txt file encrypted with "master password" should be pretty damning to break into. And the reward for breaking in would be password for 1 person. (compared to 100k businesses).

Password managers do just "do the thing you'd want them to do", and because they have a well-defined use case, they can support extensive discussion about threat models, and can easily and coherently support lots of people benefiting from the best research and security, without each having to individually roll a solution.

A hosted service without persistent compromise is likely less vulnerable to an old copy of a vault, and an accidentally disclosed master password causing catastrophic failure.

Lastpass has some issues that look egregious in retrospect. The early exceedingly low-strength vaults that were never upgraded (only possible on login).

1password publishes research and pushes forward authentication management beyond password, e.g. passkeys, in a credibly cross-ecosystem way.

Re: Ask HN: Why do people use password managers?

#62
You're approaching this from "what is the optimal way to securely encrypt my own passwords as an expert user". Consider these two perspectives instead:

1. I am an average user and want to store my passwords, and I don't want to have to think about them for more than 5 seconds, ever. I want some solution that will input passwords for me when I go to a website, and I don't much care about the actual security situation; I assume it's fine. From this perspective, an encrypted text file is a much worse user experience, and the potential for a data breach is not something I'm thinking about at all.

2. I am the CISO or similar security professional for a company. I can't let users just use whatever passwords they want: not only do I know it's a terrible idea, I'm bound by the controls in my security framework to do something to enforce password strength and encryption. So, I need users to do something else. Even if it's allowed by my security protocols, I am not going to trust the 500 people in this company to keep an encrypted text file of strong passwords that I have no oversight on. Most of them will use "password123" for everything, I know this for a fact. Instead, I want to enforce some password standards and rotation schedules, and have a dashboard that says "everybody has a strong password" that I can show off at a vendor security review or even just my personal performance review. That implies a SaaS product.

Re: Ask HN: Why do people use password managers?

#63
> So, why do people and companies use Okta, Lastpass, 1pass etc?

Your answer is in your post:

> Obviously, this would be less convinient and wouldn't sync between devices.

That said, any linux user a little bit curious/nerd could use pass + passFF + git (or any self-hosted or not git repo) + password-store (if they want it on their phone too).

Re: Ask HN: Why do people use password managers?

#64
Because my threat profile include script kiddies and encryptor malware from Bangalor, and doesn't include Mossad or NSA. If Mossad would want to do Mossad things to me, no local password manager will help me. If anyone has skills to MITM Lastpass or Okta, well, I concede defeat and grant technical win to that person.

Re: Ask HN: Why do people use password managers?

#65
post #57

Earlier quoted context omitted.

Heh, you and I came up with almost the same set of drawbacks. I know I'd mess those up if I tried. Out of curiosity, how do you handle versioning in your scheme? What about password strength requirements, length restrictions, etc.?

> What about password strength requirements, length restrictions, etc.? I have a JSON file that describes if a particular domain has certain restrictions, e.g. max length, ensure at least 1 symbol, ensure at least 1 uppercase, ensure at least 1 lowercase, etc. and then deterministically edit the password to match any such requirements. Another way to do appease the idiotic upper/lower/symbol rules is to just append s…

That sounds a lot like what I'd do if I had to make that setup. So you could pretty easily make a little tool you could call like `make-password example.com`, have it prompt for your master password on stdin, and write the generated pw to stdout, with only the unsensitive info in a `make-password.json` file.

I think I could get into that for personal use, but would dislike not having a place to store TOTP, recovery codes, usernames, etc. alongside the passwords.

Re: Ask HN: Why do people use password managers?

#67
post #24

Earlier quoted context omitted.

Yes, it's not that the password manager doesn't have autotype. It's that I need to enter passwords on a lot of different machines and I don't want to (and sometimes can't) install a password manager on every machine, nor sync passwords between machines. So I use a standalone password manager on my phone instead.

Someone must have made a dongle that you can plug into the USB port of a machine. The dongle also has Bluetooth connected to your phone, and the dongle acts a virtual keyboard. So your phone can send over Bluetooth what to type, and dongle types that into the machine. Or Bluetooth controlled robot hands. I will go with the latter.

This isn't a problem for me, though, so I don't need a solution. As I said, I consider typing in the passwords by hand to be a good thing, not a bad one.

Re: Ask HN: Why do people use password managers?

#69
You could do it as a single encrypted text file. The UX on it is more difficult. My password manager is frictionless and secure (I currently believe, based on best available info).

With a single keystroke, while in a web browser where the majority of my passwords are requested, I fill in the username and the password for the site I am on.

Vs. an encrypted plain text file, it has the following advantages:

- A single keystroke in the web browser, vs. typing longer commands

- No searching through hundreds of entries. At most a small handful is shown if I have multiple logins.

- No worries about wiping my terminal scrollback buffer or forgetting to remove the temporarily-decrypted file.

- Correct password for correct site, and no thread of lookalike sites

- All devices have access to same password list, via Dropbox sync of encrypted DB files.

- Can store other structured data in addition to passwords. Even binary data like images.

- Can use is as a TOTP, but that is arguably a bad practice. It's convenient though.

Re: Ask HN: Why do people use password managers?

#70
post #8

Local backup strategies are often terrible and untested, if they even exist. While no service is infallible, 1Password and others seem a lot less likely to be lost/stolen/destroyed than a personal laptop. I'm not sure why you're rolling Okta in here, but Okta can a completely different thing depending on what you're referring to. Single sign-on (with something like Okta) makes it so that a user doesn't need to manage…

LastPass also does SSO (and probably other "password managers" as well).

I think at this point all the major ones do. 1Password Business, LastPass Enterprise, and BitWarden Enterprise all do.

I think the commenter was advising on the use of SSO in lieu of passwords where possible (at least in a corrosive context, but personally I use SSO via Azure AD wherever I can at home too.)

Post reply on HN