Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why do people use password managers?

news.ycombinator.com

Post reply on HN
Print view View original

71–77 of 77 posts

Re: Ask HN: Why do people use password managers?

#71

Post by TheNewsIsHere »

drKarl wrote: post #56

If you're going to use KeePass, do it right and use KeePassXC (that's what I use). It's cross platform. I sync the password file between my computers and my phone and I use KeePassXC client on my phone as well. And I use a completely different KeePassXC password file for work related passwords which I keep on my work computer. How many times have Okta and LastPass been hacked already? If you have some really sensitiv…

I recently learned about VeraCrypt’s support for EMV cards and PKCS11 compatible tokens as keyfiles. I don’t have a use for that, but it’s a fantastic thing. Effectively giving you hardware MFA for encrypted vaults.

Re: Ask HN: Why do people use password managers?

#72

Post by TheNewsIsHere »

notfed wrote: post #47

> Ask HN: Why do people use [cloud-based] Password Managers? People use cloud-based password managers because they provide data resiliency. If you store your passwords locally only, you will have a day when your hard drive crashes, you've lost all of your passwords, and you will be in a very bad situation. > The key difference here being that this is two way hashing so passwords can be decrypted. There's no such thin…

> The security of a remote password manager will only be as secure as the transport encryption, this is true. But TLS is pretty solid these days, the risk of breaking it is much smaller than other risks involved here.

I would add for the sake of the conversation that any good password manager worth its salt (pun acknowledged) is using end to end encryption that isn’t reliant upon the promises of TLS.

(Authenticated) encryption on the client is key to any syncing password manager being able to fulfill expectations of privacy and security.

Re: Ask HN: Why do people use password managers?

#73

Post by digitalsushi »

I keep a vim encrypted file. If I need a password, I edit the file, get the secret, and then close the file.

I keep the file tidy, in a very simple grammar, and I have some shell functions that, with the passphrase available, can retrieve the secrets programmatically.

I wouldn't trust it with my 401k login. But it's handy for this week's API tokens and the pizza place's phone number.

Re: Ask HN: Why do people use password managers?

#74

Post by redserk »

TheNewsIsHere wrote: post #70
paulddraper wrote: post #9

Earlier quoted context omitted.

LastPass also does SSO (and probably other "password managers" as well).

I think at this point all the major ones do. 1Password Business, LastPass Enterprise, and BitWarden Enterprise all do. I think the commenter was advising on the use of SSO in lieu of passwords where possible (at least in a corrosive context, but personally I use SSO via Azure AD wherever I can at home too.)

This applies more to Okta because once you log in, you get a screen showing all the applications you have access to.

As an end-user, if you click on any tile, you get your application regardless if the authentication scheme is SAML/OIDC/static credentials. In the case where static credentials are required for a service, the end-user doesn't have to get a sheet of paper telling them the username to use. Instead, a script provisions a username/password behind the scenes and Okta is responsible for keeping the username/password safe.

Admittedly, I don't know if the traditional password manager companies offer a system like this, where you get a matrix of apps to choose from and the user is removed from knowing a username/password is being exchanged.

Re: Ask HN: Why do people use password managers?

#76

Post by loxias »

bartvk wrote: post #33
loxias wrote: post #25

Honestly? I have no idea. I use a locally encrypted store, and have done so for almost 10 years. I keep thinking to myself "there's got to be something better, surely I could make an external device..." but it remains to be seen.

So you manually type over the password when you need to log into something on your mobile phone?

With very few exceptions I don't access anything that would need a secure login from my mobile phone.

The few times I have, I've used adb.

Re: Ask HN: Why do people use password managers?

#77

Post by paulddraper »

redserk wrote: post #74
TheNewsIsHere wrote: post #70

Earlier quoted context omitted.

I think at this point all the major ones do. 1Password Business, LastPass Enterprise, and BitWarden Enterprise all do. I think the commenter was advising on the use of SSO in lieu of passwords where possible (at least in a corrosive context, but personally I use SSO via Azure AD wherever I can at home too.)

This applies more to Okta because once you log in, you get a screen showing all the applications you have access to. As an end-user, if you click on any tile, you get your application regardless if the authentication scheme is SAML/OIDC/static credentials. In the case where static credentials are required for a service, the end-user doesn't have to get a sheet of paper telling them the username to use. Instead, a scr…

How is the username/password entered into the site? Using the user's browser right?
Post reply on HN