You need a unique, strong password for every service. Humans are bad at creating unique passwords and bad at memorizing hundreds of unique passwords. Machines are good at both of these. So why would you trust your methods?
Ask HN: Why should I trust password managers?
71–80 of 289 posts
Re: Ask HN: Why should I trust password managers?
#72This question is incomplete without expanding on your "methods for safe handling of passwords on the web." Tell us what those methods are, and you'll get some thoughts on whether you should or shouldn't trust them.
Password manager anxiety is a thing. Maybe you're worried that you'll lose the vault, or that it will be hacked. I didn't like the idea that I couldn't log into something without it. The problem is, without a password manager, my passwords sucked. I had a core secret that I sort of salted for each site.
So my reason for using a password manager (KeePassXC with SyncThing, if you're interested) is that it's better than the alternative.
Re: Ask HN: Why should I trust password managers?
#73Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing.
Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have existed for SSL certificates the other day.
Unfortunately some sites require you to "log in with your ... credentials" rather than doing SSO. But you TOFU those, too, once you've verified they're legit.
Happy Bitwarden user here: the software is all Free, but I trust the company to run their servers securely more than I trust myself to, so I pay them to do so. Extra benefit: if I lose all my infrastructure, I haven't lost my passwords.
Re: Ask HN: Why should I trust password managers?
#74I just checked my Keepass database and it has 192 entries. 192 unique, actually secure passwords. Without a password manager it would be a necessity to reuse passwords or have otherwise insecure passwords in some form.
That's why I use a password manager. The small annoyance it is to keep the db file synced is well worth it.
Re: Ask HN: Why should I trust password managers?
#75Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all.
The Bitwarden browser extension does this. When you add a login, it also adds the URI of the website, so the login info and auto-fill will only show up when you're on the same domain. Of course you can edit and add or remove your own URIs for logins. You can also change the URI matching behaviour.
Re: Ask HN: Why should I trust password managers?
#76Because if you don't use one, you'll almost certainly instead either reuse passwords across sites, store passwords insecurely, or choose weak passwords.
In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encryption algo or make other silly mistakes). There is not a lot of value in trying to attack a single person's password file, but the value is multiplied by the number of users when using a centralized platform.
One feature of 1Password (and other password managers with browser integration) that has saved me at least twice by now: The browser extensions will autofill only for matching domains. If autofill doesn't work on a site I have credentials in 1Password for, chances are it's a phishing attack. That's a last line of defence against well-crafted phishing attacks that I wouldn't want to give up.
Re: Ask HN: Why should I trust password managers?
#77I just checked my Keepass database and it has 192 entries. 192 unique, actually secure passwords. Without a password manager it would be a necessity to reuse passwords or have otherwise insecure passwords in some form. That's why I use a password manager. The small annoyance it is to keep the db file synced is well worth it.
This inspired me to count mine - my 1Password has 1,492 records now!
Re: Ask HN: Why should I trust password managers?
#78I trust hosted Bitwarden because it is open source and uses zero-access/end-to-end encryption.
Re: Ask HN: Why should I trust password managers?
#79Because my passwords are stored in the cloud but they are only decrypted on my PC. If a nation state or another attacker gets into the password manager I use, they have my encrypted passwords just the same as if they rooted some Linux box I have an account on. The stakes are roughly the same. A passsword manager (PM) makes random passwords easier. A PM keeps me from re-using passwords. A PM gives me a relatively secu…
> they are only decrypted on my PC. The point is, why do you believe it's true?
Because if 1Password (to pick an example) were to be found to NOT be using encryption sensibly, the bad publicity would likely sink their company.
Security researchers pay a lot of attention to password managers.
Re: Ask HN: Why should I trust password managers?
#80I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault.