Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Horcrux: A Password Manager for Paranoids

arxiv.org

Post reply on HN
Print view View original

61–70 of 168 posts

Re: Horcrux: A Password Manager for Paranoids

#61

Post by Ajedi32 »

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

Deterministic (stateless) password managers have lots of usability issues which make them a pain to use in practice. Here's a good summary that I wrote up a while back: https://security.stackexchange.com/a/94128/29865

Re: Horcrux: A Password Manager for Paranoids

#62

Post by nkuttler »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Oh, this looks wonderful. I've used one big gpg encrypted file for years, still better than all password managers I tried.

I'm wondering if there is a way to combine find and show with pass though. Like pass find and show the password in one command. I realize I could probably use the grep command, but then I'd have to put the keyword into the encrypted file as well, and I'd need to decrypt all files to find it.

Edit: Gah, I was just thinking this should just be an alias, but the output of pass find can't just be fed to show either..

Re: Horcrux: A Password Manager for Paranoids

#64

Post by [deleted] »

kybernetikos wrote: post #60
MatthewWilkes wrote: post #13

Earlier quoted context omitted.

That's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.

I recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts. https://github.com/kybernetikos/sinkless I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.

[deleted]

Re: Horcrux: A Password Manager for Paranoids

#65

Post by agentgt »

w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

I do this as well and wrote my own script also: https://github.com/agentgt/ezpwdgen

I mean sure its not the most secure thing and yeah you have to remember which iteration you are on once the site has some sort of databreach or makes you change your password but it generally works pretty well.

Re: Horcrux: A Password Manager for Paranoids

#66

Post by theossuary »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

I used pass for a while before I moved on to gopass. It's a drop-in replacement for pass with a bunch of useful features (like encrypting a password-store for multiple people, or "mounting" password stores). Hope it gets picked up and supported more, it's pretty nice.

https://github.com/justwatchcom/gopass

Re: Horcrux: A Password Manager for Paranoids

#67

Post by tom4000 »

Ajedi32 wrote: post #51
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

1. In pass everything is encrypted but you have to give names to each gpg encrypted password file.

2. Right. I use rofi-pass on Linux which fills in the selected password or other login data without any clipboard action.

3. True. Never thought about this but sounds clever.

4. Same answer as in 2.

Plus I have a good password history through the git commits. Of course I push it just in my local network.

And I use more then just one password store. And inside you can folder based decide who can decrypt the passwords and who not.

Re: Horcrux: A Password Manager for Paranoids

#68

Post by agentgt »

jacobwg wrote: post #21
w8rbt wrote: post #14

I think all password managers that store passwords are flawed. Storage is a burden. The store must be synced between devices, secured, backed-up, etc. and it can be stolen. I believe that passwords should be deterministically generated when needed, not retrieved from a store. I'm not sure why this approach is not seen more often. Edit: It seems people don't understand what I mean... I just put some code here to bette…

Because then you're out of luck when you need to update your password, say, due to a data breach at your target site. Or when the deterministically generated password doesn't meet the specific password requirements of the website. Or if somebody can capture your input "seed", they can generate all your passwords without needing to capture your password database like they would in another password manager.

Loosing the master password (or key or whatever) that is used to generate the passwords for a deterministic password generator is fairly similar to loosing the password database.

One is really not that much more secure than the other particularly when dealing with online websites.

But yeah if the site gets hacked you have to pick and remember an iterated password (ie a next iteration) or regenerate a new master password.

Of course if you are really paranoid you can always generate a password with dice and write that password down somewhere in safe place (ie offline password generation).

Re: Horcrux: A Password Manager for Paranoids

#70

Post by ryanisnan »

baby wrote: post #9
Nyubis wrote: post #4

The trick of entering a dummy username and password, which is then modified in the post request sounds a whole lot better than playing clipboard roulette or messing with the DOM.

This sounds pretty cool! What I'm wondering, is how they are intercepting the POST request and at what level?

Also it is quite common that extensions ask for to be able to read all traffic. What would be stopping other extensions from being jerks?
Post reply on HN