Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Show HN: NoKey, a Distributed Password Manager Without a Master Password

github.com

Post reply on HN
Print view View original

11–20 of 28 posts

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#11

Post by jazoom »

Zinggi wrote: post #2

Hi all! This is my first time posting something to HN, so please be kind. I wanted to show what I’ve been working on for the last 6 months: NoKey, a password manager without a master password. Instead, you can unlock your passwords by confirming from another device. E.g. if you need a password on your PC, you only have to confirm this on your phone. No need to remember any passwords! The vast majority of the code is…

Could someone use Firefox and Chrome extension on the same device as two different devices?

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#12

Post by smittywerben »

craftyguy wrote: post #8
Zinggi wrote: post #7

Earlier quoted context omitted.

> Doesn't this increase your attack surface greatly though? That's true. I suppose it's a trade off between protection against lost vs. smaller attack surface. > Since there's no master key, one has to only compromise the OS to get at everything That's wrong, compromising one device doesn't give an attacker anything useful. Only if two or more devices have been compromised can passwords be decrypted. But in any case,…

> That's wrong, compromising one device doesn't give an attacker anything useful Yea I understand that, but by having a large number of devices with this on it, you increase the chances that any two of them could be compromised. That was my point, I just didn't articulate it well enough.

Does anyone use a password manager for critical accounts?

I use them to generate random passwords for sites like yahoo or neopets (or whatever).

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#13

Post by Zinggi »

jazoom wrote: post #11
Zinggi wrote: post #2

Hi all! This is my first time posting something to HN, so please be kind. I wanted to show what I’ve been working on for the last 6 months: NoKey, a password manager without a master password. Instead, you can unlock your passwords by confirming from another device. E.g. if you need a password on your PC, you only have to confirm this on your phone. No need to remember any passwords! The vast majority of the code is…

Could someone use Firefox and Chrome extension on the same device as two different devices?

Yes, but it's a very bad idea. If you'd do this, you could unlock your passwords with a single device by confirming on Firefox or vice-versa on Chrome. This of course also means that if someone steals this device, they can unlock it too.

So don't do it.

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#15

Post by jazoom »

Zinggi wrote: post #13
jazoom wrote: post #11

Earlier quoted context omitted.

Could someone use Firefox and Chrome extension on the same device as two different devices?

Yes, but it's a very bad idea. If you'd do this, you could unlock your passwords with a single device by confirming on Firefox or vice-versa on Chrome. This of course also means that if someone steals this device, they can unlock it too. So don't do it.

Yeah. That's what I don't want. So how do you prevent someone doing just that? They have Chrome open. They then confirm setup in Firefox using Chrome on the same device.

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#16

Post by Zinggi »

jazoom wrote: post #15
Zinggi wrote: post #13

Earlier quoted context omitted.

Yes, but it's a very bad idea. If you'd do this, you could unlock your passwords with a single device by confirming on Firefox or vice-versa on Chrome. This of course also means that if someone steals this device, they can unlock it too. So don't do it.

Yeah. That's what I don't want. So how do you prevent someone doing just that? They have Chrome open. They then confirm setup in Firefox using Chrome on the same device.

When pairing a new device (or in this case a new browser), that device doesn't automatically get any keys! When adding a new device, to complete the setup you also have to be able to unlock a password group, for which you need another device that already has keys.

In short, a new device doesn't have the same power as the others from the start, first new keys have to be generated which can only happen if you are able to unlock your passwords.

So just don't setup both the Firefox and Chrome extension and you're golden.

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#17

Post by jazoom »

Zinggi wrote: post #16
jazoom wrote: post #15

Earlier quoted context omitted.

Yeah. That's what I don't want. So how do you prevent someone doing just that? They have Chrome open. They then confirm setup in Firefox using Chrome on the same device.

When pairing a new device (or in this case a new browser), that device doesn't automatically get any keys! When adding a new device, to complete the setup you also have to be able to unlock a password group, for which you need another device that already has keys. In short, a new device doesn't have the same power as the others from the start, first new keys have to be generated which can only happen if you are able…

Ah. So you essentially need 2 devices to set up a new device.

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#18

Post by Zinggi »

jazoom wrote: post #17
Zinggi wrote: post #16

Earlier quoted context omitted.

When pairing a new device (or in this case a new browser), that device doesn't automatically get any keys! When adding a new device, to complete the setup you also have to be able to unlock a password group, for which you need another device that already has keys. In short, a new device doesn't have the same power as the others from the start, first new keys have to be generated which can only happen if you are able…

Ah. So you essentially need 2 devices to set up a new device.

Exactly. Or even 3 if you make use of security level 3.

The only exception is at the start when there are no passwords stored yet.

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#19

Post by jazoom »

Zinggi wrote: post #18
jazoom wrote: post #17

Earlier quoted context omitted.

Ah. So you essentially need 2 devices to set up a new device.

Exactly. Or even 3 if you make use of security level 3. The only exception is at the start when there are no passwords stored yet.

That's pretty interesting. It's a trade-off between remembering a password and making sure you have enough devices. I personally would trust my brain (and a backup piece of paper) more than one of my devices that might die at any moment. I use KeePass, but NoKey seems great.

Re: Show HN: NoKey, a Distributed Password Manager Without a Master Password

#20

Post by Zinggi »

jazoom wrote: post #19
Zinggi wrote: post #18

Earlier quoted context omitted.

Exactly. Or even 3 if you make use of security level 3. The only exception is at the start when there are no passwords stored yet.

That's pretty interesting. It's a trade-off between remembering a password and making sure you have enough devices. I personally would trust my brain (and a backup piece of paper) more than one of my devices that might die at any moment. I use KeePass, but NoKey seems great.

But wouldn't you agree that your brain + NoKey instead of a piece of paper as a backup would be more secure? And more convenient, as you don't have to type your passwords anymore.

I don't wanna push you, just wanna give you some things to think about. As long as you use strong and unique passwords everywhere you're good.

Also, it's not a big problem if one of your devices dies, as long as you paired enough devices you won't lose any passwords.

Post reply on HN