Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Horcrux: A Password Manager for Paranoids

arxiv.org

Post reply on HN
Print view View original

11–20 of 168 posts

Re: Horcrux: A Password Manager for Paranoids

#11

Post by kefka »

Santosh83 wrote: post #6
1ba9115454 wrote: post #3

Perhaps this helps with trusting the password manager but it looks a bit complex to me. Personally I'm more concerned about when I enter a master password that if there's a Trojan on my computer it's game over. As most password managers are an encrypted database of sorts once it's encrypted all your passwords are out. The only protection against that is some sort of 2FA.

I guess if your system is compromised then password security becomes gravely threatened, no matter how secure the password manager may be. The only partial solution I can think of is to have the OS sandbox every application from every other.

Yep, pretty much. It really reminds me of this: https://xkcd.com/1200/ for obvious reasons.

The only ways I can think that would be able to prevent this are:

     1. Physical non-networked device password manager
     2. Really creative usage of SELinux
     3. QubesOS
And in reality, #1 is kind of how RSA tokens are used. Of course, physical can be lost, stolen, and all that. QubesOS takes a ton of resources to run effectively, given everything is VM'ed and contained with a capability system.

In all honesty, I could see buying an Android at a Pay as You Go place, and repurpose it to be a offline password manager. Never connect it to wifi, BT, cell. And any APK's you need you load via microSD card and USB.

Re: Horcrux: A Password Manager for Paranoids

#12

Post by fictioncircle »

thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

Re: Horcrux: A Password Manager for Paranoids

#13

Post by MatthewWilkes »

thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

That's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.

Re: Horcrux: A Password Manager for Paranoids

#14

Post by w8rbt »

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often.

Edit: It seems people don't understand what I mean... I just put some code here to better explain: https://github.com/w8rbt/dpg

Re: Horcrux: A Password Manager for Paranoids

#15

Post by thinkMOAR »

fictioncircle wrote: post #12
thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

Re: Horcrux: A Password Manager for Paranoids

#16

Post by _jal »

thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

Are you trying to tell me what my threat model should be? That makes me suspicious...

Re: Horcrux: A Password Manager for Paranoids

#17

Post by fredley »

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

Because passwords need to be changed (e.g., after a breach). Deterministically generating them does not allow this, unless you add additional information (such as appending an index, e.g. news.ycombinator.com|2), but then you need to store that somewhere...

Re: Horcrux: A Password Manager for Paranoids

#18

Post by patrickmn »

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

All such deterministic algorithms are seeded by something. This is their basic flaw. Guess the seed and you get all the passwords.

With a password manager that randomly generates unique passwords, you don't have that problem, but you do have to synchronize the data.

Re: Horcrux: A Password Manager for Paranoids

#19

Post by captbaritone »

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

The fact that different websites have different password requirements/limitations is a big part of it

Re: Horcrux: A Password Manager for Paranoids

#20

Post by phinnaeus »

thinkMOAR wrote: post #15
fictioncircle wrote: post #12

Earlier quoted context omitted.

If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

Make sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.
Post reply on HN