Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

81–90 of 289 posts

Re: Ask HN: Why should I trust password managers?

#81

Post by slooonz »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password

No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (aka is not "hunter3")

Re: Ask HN: Why should I trust password managers?

#82

Post by pedrogpimenta »

fuzzieozzie wrote: post #53
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

I am the same, but with the enhancement of using Resilio Sync to automatically sync the file between devices.

I do the same, with Nextcloud though, but I doubt SkyMarshal would consider that as an enhancement. He, and others, sync it manually and "offline" for security reasons.

Re: Ask HN: Why should I trust password managers?

#83

Post by prophesi »

It sounds like to me that there are three types of people:

* Layman who reuses passwords unless a techie friend convinces them to use a PW manager.

* HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices.

* Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they connect to.

Just an observation; not making any statements. But if I were to make one, it's to know your own threat level and find the security vs convenience compromise that works for you, and educate your friends & family.

Re: Ask HN: Why should I trust password managers?

#84

Post by TillE »

ciphol wrote: post #70

Why are people talking like the choice is between cloud password managers (potentially insecure) and no password manager (impractical unless you reuse passwords)? There's a third option - a local password manager like the one built into your browser. Its one disadvantage versus the cloud is that you have to reenter your password on each of your devices. For normal people who have maybe 2 or 3 devices and don't change…

A local password manager becomes a "cloud" one trivially if you just stick the database file on a synced drive. You don't have to trust the drive's host at all since it's just an encrypted blob.

KeePass makes this easy, at least in theory, though I was never happy with the phone app.

Re: Ask HN: Why should I trust password managers?

#85

Post by stepchowfun »

prophesi wrote: post #83

It sounds like to me that there are three types of people: * Layman who reuses passwords unless a techie friend convinces them to use a PW manager. * HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices. * Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they c…

I sort of fall into the second category, except I don't sync passwords across devices or even store them at all. I generate them on the fly with [1].

[1] https://chrome.google.com/webstore/detail/hashpass/gkmegkoip...

Re: Ask HN: Why should I trust password managers?

#86

Post by SkyMarshal »

TimTheTinker wrote: post #80
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits

I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.

Re: Ask HN: Why should I trust password managers?

#87

Post by a1445c8b »

andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all.

1Password does this.

Re: Ask HN: Why should I trust password managers?

#88

Post by SkyMarshal »

slooonz wrote: post #81
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (ak…

> as long as your master password stays secure (aka is not "hunter3")

You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been.

I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.

Re: Ask HN: Why should I trust password managers?

#89

Post by whymarrh »

slooonz wrote: post #81
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (ak…

Even if your Master Password is “hunter3”, 1Password, as an example, will mix in a locally generated Secret Key to increase the entropy [1]

[1]: https://blog.1password.com/what-the-secret-key-does/

Post reply on HN