Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Horcrux: A Password Manager for Paranoids

arxiv.org

Post reply on HN
Print view View original

71–80 of 168 posts

Re: Horcrux: A Password Manager for Paranoids

#71

Post by kodablah »

curiousGambler wrote: post #58
kodablah wrote: post #46

Earlier quoted context omitted.

I have not read yet, but my guess is they are taking all HTTP requests from the page and looking for their dummy username/password and replacing that. Not every login form (though we would like it) is in a form tag w/ an explicit action. Some SPA's will do an AJAX post of JSON w/ the credentials embedded (which is bad practice, but happens). Actually, the more I think about it, I don't think I want this extension to…

Out of curiosity, why is an AJAX post of JSON with credentials embedded bad practice?

Not bad practice from a security perspective per se, just annoying to users that don't want JS, or like the non-password fields to support their browser's features like autocomplete, etc. Granted if it's a SPA, some of that usability shop has sailed. And while any AJAX post is secure normally, many JS implemented login solutions open themselves up to CSRF and other problems.

Re: Horcrux: A Password Manager for Paranoids

#72

Post by haberman »

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are.

People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID).

And yet I see no movement towards this from the industry. Are we stuck in this terrible state forever?

If I could see into the future I would dearly hope that in 10 years we are not seeing HN front page articles about the newest innovations in password managers.

Re: Horcrux: A Password Manager for Paranoids

#73

Post by taeric »

haberman wrote: post #72

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are. People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID). And yet I see no movement towards this from the industry. Ar…

I'm not sure I actually agree with this. Do you know of any studies that go into this?

My concern is around having a single source of failure/attack. Which, to be fair, is probably not that different than most people's scenarios. That is, most people just let their browsers and phones remember passwords. So, in practice this already happens. I just don't feel like it is safe. I'm highly interested in being challenged on this.

Re: Horcrux: A Password Manager for Paranoids

#74

Post by haberman »

Ajedi32 wrote: post #51
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

I use KeePassX, but I haven't figured out how to do any of these fancy things. What do you use for browser autofill, InputStick, autotype, etc?

Also how do you store your password file and sync across devices?

And what do you use on iOS? I haven't found a very convenient workflow for my phone. No phone app I've found can keep synced with a password file that's stored on Google Drive.

Re: Horcrux: A Password Manager for Paranoids

#75

Post by tanderson92 »

Ajedi32 wrote: post #51
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

> 4. No autotype on desktop - This isn't quite as big of a deal, since most programs will let you copy/paste passwords just fine, but as far as I can tell no pass desktop clients include support for auto-typing login credentials. For many non-web apps that require passwords that feature is extremely helpful.

I may not understand what you mean by "autotype on desktop", but I use the dmenu password-store extension which is the executable "passmenu". It allows the command line option "--type" which is quite close I think to what you desire.

Re: Horcrux: A Password Manager for Paranoids

#76

Post by haberman »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Link (slightly tricky to find): https://www.passwordstore.org/

Re: Horcrux: A Password Manager for Paranoids

#77

Post by johnfn »

pitaa wrote: post #48
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that…

One time I found I couldn't log in to my bank account online. Called them up.

"Oh, we changed your username as a security measure."

Oh.

Wait, username??

Re: Horcrux: A Password Manager for Paranoids

#78

Post by haberman »

taeric wrote: post #73
haberman wrote: post #72

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are. People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID). And yet I see no movement towards this from the industry. Ar…

I'm not sure I actually agree with this. Do you know of any studies that go into this? My concern is around having a single source of failure/attack. Which, to be fair, is probably not that different than most people's scenarios. That is, most people just let their browsers and phones remember passwords. So, in practice this already happens. I just don't feel like it is safe. I'm highly interested in being challenged…

I think the only way you avoid a single source of failure is if your brain is actually capable of remembering a separate, high-entropy password for every website you visit.

If you use the same password (even a high-entropy one) on every website, any hack of a single site compromises you on every website.

If you use a password manager to store high-entropy passwords for every site you visit, then the password manager is a single point of failure.

Both of these attacks happen in the real world. But securing a single authentication system like a phone app/Yubikey/TouchID/etc. seems more tractable than securing every website that you visit.

Password managers are available today, but since the websites you are using don't actually know about them, the integration and ease of use are not as great as they could be.

My vision is that you can use a phone app/Yubikey/TouchID/etc. to create as many identities as you want, and then you can use these to robustly authenticate to any website. To the website you would just be a GUID: an opaque identifier that it doesn't know anything about unless you tell it more. And all the app/Yubikey/TouchID does is let the website know (securely) that you are the same GUID that logged in last time.

Re: Horcrux: A Password Manager for Paranoids

#79

Post by cbhl »

xfer wrote: post #69
cbhl wrote: post #63

Does anyone else think it's cool that Harry Potter fans are now old enough to be getting crypto papers published?

You are assuming Harry potter fans are all ≤12?

Well, I assume that there's a bell curve, with the median around 8, because I was eight when the books were first published in the US. (Scholastic is often associated with publishing kids books, too.)

Re: Horcrux: A Password Manager for Paranoids

#80

Post by Ajedi32 »

tanderson92 wrote: post #75
Ajedi32 wrote: post #51

Earlier quoted context omitted.

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

> 4. No autotype on desktop - This isn't quite as big of a deal, since most programs will let you copy/paste passwords just fine, but as far as I can tell no pass desktop clients include support for auto-typing login credentials. For many non-web apps that require passwords that feature is extremely helpful. I may not understand what you mean by "autotype on desktop", but I use the dmenu password-store extension whic…

Yeah, that's basically what autotype is on KeePass; except KeePass is a bit more flexible since it lets you configure custom autotype sequences (e.g. ``) on a per-application basis.

This seems like a fairly decent substitute if you're on Linux. Doesn't look like it'll work on Windows or MacOS though.

Post reply on HN