Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flaws in deterministic password managers

tonyarcieri.com

Post reply on HN
Print view View original

21–30 of 106 posts

Re: Flaws in deterministic password managers

#21

Post by majelix »

ythn wrote: post #12
zeveb wrote: post #9

Earlier quoted context omitted.

A password like that would probably be guessed by a good password cracker pretty quickly. I've taken the liberty of following your procedure for an un-named domain. If anyone's got a password cracker running, I'd be interested how long it takes to break this SHA256 hash: dae640f98b6894d2f6eab5755b22918be46b0d219ea10d3ceea06ebe538a75d1. Post once you've guessed it. Just use 'pwgen -s 22'; it generates 128-bit password…

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of…

> Seems like way too much work for an attacker to try to figure out.

I dunno, seems like way more work to come up with, maintain, and actually use the generator. Seems easier to just click a bunch in my vault to generate and copy, although I guess you're protected from vault-theft?

Given your example, I had already figured out all the way up to ies/otto are probably foreign numbers (more specifically, otto looks like 8 and 16 looks like double of 8) before even seeing that you just gave the answer away.

Re: Flaws in deterministic password managers

#22

Post by clark800 »

I've been surprised by how negative the opinions of deterministic password managers have been since I've been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it's more secure than cloud-based systems (see point 4).

My take on the points in the post:

1. Out of the 100 or so sites that I use, only a few have password policies that require tweaks, and it usually just requires disabling symbols and or adjusting the length. These tweaks are cached in my browser, so this hasn't been much of an inconvenience.

2. My passwords are rarely revoked, and when they are it is just a counter bump. This is state, but again it is cached in the browser.

3. It's true that they can't store existing secrets, but this can be viewed as out of scope for a password manager.

4. For the application I use, it's not true that exposing just the master password exposes all of your site passwords. There is a 512bit private key that is synchronized once between devices using a QR code. An attacker would need both the master password and the private key file to generate any passwords. Because the private key only exists on devices I physically own, this should be harder to obtain than an encrypted database that lives in the cloud, so I view this system as more secure than KeePass on Dropbox, Lastpass, or 1Password.

My experience over the past two years has been that the advantages are more significant than the disadvantages.

Re: Flaws in deterministic password managers

#23

Post by pwinnski »

clark800 wrote: post #22

I've been surprised by how negative the opinions of deterministic password managers have been since I've been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it's more secure than cloud-based systems (see point 4). My take on the points in the post: 1. Out of the 100 or so sites that I use, only a few have password policies that requir…

If your browser is caching all of your passwords, I think you've got security problems well outside the scope of your choice of password managers.

Re: Flaws in deterministic password managers

#24

Post by pavel_lishin »

dvdkon wrote: post #13

I don't agree with the author on many of his points. 1 and 2 are "merely" convenience features. Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws. 3 is a good argument, but storing existing secrets is by definition out of scope for password generators. It is a usability problem, which makes using a truly stateless password generator as…

> Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws.

If the Deterministic Password Generator does not generate a valid password for a given site, it's certainly a fatal flaw for that site, and a usability nightmare - now I have to remember which sites aren't supported and keep a vault anyway.

And I guess point 2 isn't a fatal flaw until you need to change a password for whatever reason, but after that it becomes quite a problem.

Re: Flaws in deterministic password managers

#25

Post by pavel_lishin »

ythn wrote: post #8
IshKebab wrote: post #5

Earlier quoted context omitted.

> If the site restricts passwords to max 12 characters The problem with this is that most sites are designed by idiots and don't state their pointless password rules on the login page - only on the 'change password' page. So you can be trying your coppercopperYCOMbinator11!! password and thinking "why the hell doesn't this work?", then after 10 minutes you give up and go to change it and see "Your password must be be…

That's very true. I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password. Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet so we can easily look it up and/or publicly shame companies wi…

> I forgot to mention that I also have a spreadsheet that has site-specific password rules so that I can do a lookup and see how I need to adapt my generated password.

So you do have a password manager.

> Maybe what we really need instead of deterministic password generators is an authoritative database that tracks the password rules of all the different sites on the internet

I'm glad to hear you volunteering to look up all of these policies, and keep them up to date!

Re: Flaws in deterministic password managers

#26

Post by pwinnski »

Today I learned that many people on Hacker News have really insecure web security practices. :(

I don't understand the resistance to using a vault-based password manager. Is it inertia? I mean, if you're using the same one or two passwords on every site, then sure, it may not seem worthwhile to us 1Password. But then, enough password hashes have been leaked this year alone to suggest that you need to do something better.

Re: Flaws in deterministic password managers

#27

Post by ogrisel »

libeclipse wrote: post #2

I'm the creator of visionary[0], a deterministic password generator that the article links to. When I thought of the idea (quite a while ago), I thought it was a good idea, and I thought I was the first one there. I was wrong on both accounts. The points that the article makes are right, and people should use conventional passwords over deterministic ones. But I guess it appeals to a certain small subset of people. F…

Funny, I also implemented mine a while ago (mostly un-maintained but I still use it): https://pypi.python.org/pypi/virtualkeyring/

I also thought I was clever and the first to do it ;)

I have been thinking about adding support to keep some state info in a yaml file to deal with revocation and specific varying password policies (e.g. in a dropbox synced folder) but I was too lazy to implement it. If someone wants to do it please feel free to send a PR.

The compromised master password issue is a real issue though.

Re: Flaws in deterministic password managers

#28

Post by eikenberry »

pwinnski wrote: post #23
clark800 wrote: post #22

I've been surprised by how negative the opinions of deterministic password managers have been since I've been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it's more secure than cloud-based systems (see point 4). My take on the points in the post: 1. Out of the 100 or so sites that I use, only a few have password policies that requir…

If your browser is caching all of your passwords, I think you've got security problems well outside the scope of your choice of password managers.

I'd guess he doesn't mean cached, but instead means that his web browser works with this system keyring (or has its own) to save/use the passwords.

Re: Flaws in deterministic password managers

#29

Post by cschmidt »

clark800 wrote: post #22

I've been surprised by how negative the opinions of deterministic password managers have been since I've been using one for over two years and it has been a much better experience overall than using KeePass on Dropbox, and I also think that it's more secure than cloud-based systems (see point 4). My take on the points in the post: 1. Out of the 100 or so sites that I use, only a few have password policies that requir…

What system are you using?
Post reply on HN