Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Horcrux: A Password Manager for Paranoids

arxiv.org

Post reply on HN
Print view View original

51–60 of 168 posts

Re: Horcrux: A Password Manager for Paranoids

#51

Post by Ajedi32 »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass.

1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on.

2. No decent browser autofill. Yes, there's browserpass, but as far as I can tell it requires manually searching your password database for the site you're on, which is somewhat inconvenient and doesn't help at all against phishing attacks.

3. No InputStick support. This means if I ever have to enter a password on a computer that doesn't have pass installed, I need to open my password DB on my phone and manually retype the necessary password instead of being able to just auto-type it.

4. No autotype on desktop - This isn't quite as big of a deal, since most programs will let you copy/paste passwords just fine, but as far as I can tell no pass desktop clients include support for auto-typing login credentials. For many non-web apps that require passwords that feature is extremely helpful.

If these ever get fixed, there's a decent chance I'd switch.

Re: Horcrux: A Password Manager for Paranoids

#52

Post by snowwrestler »

1ba9115454 wrote: post #3

Perhaps this helps with trusting the password manager but it looks a bit complex to me. Personally I'm more concerned about when I enter a master password that if there's a Trojan on my computer it's game over. As most password managers are an encrypted database of sorts once it's encrypted all your passwords are out. The only protection against that is some sort of 2FA.

Yes, the way to deal with trusting password managers is to use TFA as much as you can.

Re: Horcrux: A Password Manager for Paranoids

#53

Post by laumars »

thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

Rationally I'd say if you are truly paranoid then you'd assume that any security software you did author isn't secure enough since you acknowledge that humans, including yourself, are fallible. Thus you would prefer to use independently audited, battle tested, solutions (albeit ones that don't sync to the cloud).

Re: Horcrux: A Password Manager for Paranoids

#54

Post by YCode »

pitaa wrote: post #48
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that…

I suspect it's the same reasons nuclear launch facilities use floppy disks -- the solution is approved, and getting a new solution approved is viewed as too expensive/infeasible.

Not saying the argument is valid, just that it may be the reason.

Re: Horcrux: A Password Manager for Paranoids

#55

Post by schoen »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

While these systems shouldn't have these length limits, a 25-character pure alphanumeric random password already has nearly 149 bits of entropy, which might be stronger than other cryptographic primitives that are use in these systems, if you trust that there are no effective attacks against your RNG. Brute force against such a password may already not be the easiest way to attack the systems that use it.

Re: Horcrux: A Password Manager for Paranoids

#56

Post by 0x6c6f6c »

Ajedi32 wrote: post #51
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

1. Check out [pass-tomb](https://github.com/roddhjav/pass-tomb). Unfortunately this only resolves that issue on Linux. Their websites [here](https://www.dyne.org/software/tomb/).

The others are things I've noticed as well, and do wish to see implemented.

Re: Horcrux: A Password Manager for Paranoids

#57

Post by andai »

simias wrote: post #27
arianvanp wrote: post #24

Earlier quoted context omitted.

A very easy scheme could be: password = hmac(url++nonce, master_key) You then store url and nonce. it's no problem that this info is public as far as I know, but perhaps you could again encrypt both the URL and the Nonce using symmetric encryption using the master key Every time you need to change your password, (because it leaked), you simply generate a new nonce. You only store the nonce and the URL and this seems…

I tried doing that a few years ago, random password constraints made it highly impractical. And if you end up using a database for storing your nonces and hashing schemes you'll end up with the same limitations and attack vectors the parent was complaining about.

Hmm, sounds like you need a deterministic password weakener!

Re: Horcrux: A Password Manager for Paranoids

#58

Post by curiousGambler »

kodablah wrote: post #46
baby wrote: post #9

Earlier quoted context omitted.

This sounds pretty cool! What I'm wondering, is how they are intercepting the POST request and at what level?

I have not read yet, but my guess is they are taking all HTTP requests from the page and looking for their dummy username/password and replacing that. Not every login form (though we would like it) is in a form tag w/ an explicit action. Some SPA's will do an AJAX post of JSON w/ the credentials embedded (which is bad practice, but happens). Actually, the more I think about it, I don't think I want this extension to…

Out of curiosity, why is an AJAX post of JSON with credentials embedded bad practice?

Re: Horcrux: A Password Manager for Paranoids

#59

Post by 9to5isdead »

baby wrote: post #9
Nyubis wrote: post #4

The trick of entering a dummy username and password, which is then modified in the post request sounds a whole lot better than playing clipboard roulette or messing with the DOM.

This sounds pretty cool! What I'm wondering, is how they are intercepting the POST request and at what level?

FYI Service workers can intercept and modify requests.

Re: Horcrux: A Password Manager for Paranoids

#60

Post by kybernetikos »

MatthewWilkes wrote: post #13
thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

That's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.

I recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts.

https://github.com/kybernetikos/sinkless

I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.

Post reply on HN