Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Horcrux: A Password Manager for Paranoids

arxiv.org

Post reply on HN
Print view View original

81–90 of 168 posts

Re: Horcrux: A Password Manager for Paranoids

#81

Post by ravirajx7 »

pitaa wrote: post #48
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

What is it with banks and their annoyingly terrible "security" requirements? My old bank once sent me an email saying I had to reset my password. The email seemed legit, but upon following the link therein something didn't seem quite right. So I use another device to visit my bank's site directly. Upon trying to login, I get redirected to the same form I reached from the email link and had a sinking realization that…

Talking about bank, when i tried changing my transaction password my bank sent me an acknowledgment letter which had to be submitted physically to the bank again with all the details filled onto the form then you have to wait in the queue to get signatures and approval. All being said the worst part was that the letter took more than 2 weeks to arrive at my home and the letter had transaction password which you have to change again.

Re: Horcrux: A Password Manager for Paranoids

#82

Post by PeterisP »

haberman wrote: post #72

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are. People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID). And yet I see no movement towards this from the industry. Ar…

Username/password is the least common denominator that's supported by everything and everyone.

If I make an integration with Yubikey or iPhone, then that works only for that style of authentication.

On the other hand, if I make simple username/password authentication, then all password managers in all browsers and with all devices will work for securely storing the authentication tokens.

The whole point is that sites don't (and shouldn't) make a decision about how the user should store all their credentials, otherwise some users would be prevented from using the password management process of their choice. Instead, they just ask for a random password and the user (or his/her devices) can store it however they want.

Re: Horcrux: A Password Manager for Paranoids

#83

Post by Ajedi32 »

haberman wrote: post #74
Ajedi32 wrote: post #51

Earlier quoted context omitted.

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

I use KeePassX, but I haven't figured out how to do any of these fancy things. What do you use for browser autofill, InputStick, autotype, etc? Also how do you store your password file and sync across devices? And what do you use on iOS? I haven't found a very convenient workflow for my phone. No phone app I've found can keep synced with a password file that's stored on Google Drive.

I'm using KeePass Professional Edition, not KeePassX. Pretty sure they both use the same database format and are both cross-platform, so you should be able to switch pretty easily if KeePassX doesn't do everything you want.

For browser autofill I'm using the KeePassHttp plugin with ChromeIPass.

For InputStick I'm using Keepass2Android with KP2A InputStick.

Autotype is a built-in feature of KeePass on desktop.

Password database is stored on Google Drive, encrypted with a 2-part file and password based key. The file-based component of the key is stored locally offline on all my devices. Changes to the database get synced automatically by Google Drive on my PCs and by Keepass2Android on my phone.

I'm not sure about iOS, unfortunately. My phone is running Android, so I haven't really looked into KeePass clients for iOS.

Re: Horcrux: A Password Manager for Paranoids

#84

Post by Shoop »

Ajedi32 wrote: post #80
tanderson92 wrote: post #75

Earlier quoted context omitted.

> 4. No autotype on desktop - This isn't quite as big of a deal, since most programs will let you copy/paste passwords just fine, but as far as I can tell no pass desktop clients include support for auto-typing login credentials. For many non-web apps that require passwords that feature is extremely helpful. I may not understand what you mean by "autotype on desktop", but I use the dmenu password-store extension whic…

Yeah, that's basically what autotype is on KeePass; except KeePass is a bit more flexible since it lets you configure custom autotype sequences (e.g. ` `) on a per-application basis. This seems like a fairly decent substitute if you're on Linux. Doesn't look like it'll work on Windows or MacOS though.

rofi-pass (based on rofi, a dmenu alternative) allows for custom autotype sequences.

Re: Horcrux: A Password Manager for Paranoids

#85

Post by bumblebeard »

haberman wrote: post #74
Ajedi32 wrote: post #51

Earlier quoted context omitted.

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

I use KeePassX, but I haven't figured out how to do any of these fancy things. What do you use for browser autofill, InputStick, autotype, etc? Also how do you store your password file and sync across devices? And what do you use on iOS? I haven't found a very convenient workflow for my phone. No phone app I've found can keep synced with a password file that's stored on Google Drive.

Not OP but I do some of these things with KeePass as well.

For autofill, KeeFox works well for me on Firefox - there's probably something similar for Chrome. I think KeePass will do autotype if you right-click on an entry but it's not a feature that I really use so I'm not sure.

I store my password DB in my home folder and use syncthing to synchronize it to my other computers and my phone.

I don't know about iOS but I use KeePassDroid on Android and it works pretty well.

Re: Horcrux: A Password Manager for Paranoids

#87

Post by Ajedi32 »

tom4000 wrote: post #67
Ajedi32 wrote: post #51

Earlier quoted context omitted.

Pass looks great. There are still a few reasons though why I can't bring myself to switch to it from KeePass. 1. As far as I can tell, only the passwords are encrypted; not the entire database. This is a little annoying from a privacy standpoint; since it means I have to trust whatever cloud storage system I'm using with a list of every site I have an account on. 2. No decent browser autofill. Yes, there's browserpas…

1. In pass everything is encrypted but you have to give names to each gpg encrypted password file. 2. Right. I use rofi-pass on Linux which fills in the selected password or other login data without any clipboard action. 3. True. Never thought about this but sounds clever. 4. Same answer as in 2. Plus I have a good password history through the git commits. Of course I push it just in my local network. And I use more…

1. Right, that's what I meant; the file and directory names aren't encrypted, which probably reveals which sites you have an account on. Sorry for the confusion.

2. Is that really auto-fill though? Seems more like KeePass's auto-type. I meant like a browser extension that knows what site you're on and fills in the appropriate username/password combo automatically.

4. Cool, that looks like a decent solution for auto-typing. I hadn't heard of that before. Linux-only though from what I can tell, so it won't work for me in the general case.

KeePass has built-in password history too, but I do really like the idea of using git for that; that's one of the reasons why I'm interested in pass.

Re: Horcrux: A Password Manager for Paranoids

#88

Post by haberman »

Ajedi32 wrote: post #83
haberman wrote: post #74

Earlier quoted context omitted.

I use KeePassX, but I haven't figured out how to do any of these fancy things. What do you use for browser autofill, InputStick, autotype, etc? Also how do you store your password file and sync across devices? And what do you use on iOS? I haven't found a very convenient workflow for my phone. No phone app I've found can keep synced with a password file that's stored on Google Drive.

I'm using KeePass Professional Edition, not KeePassX. Pretty sure they both use the same database format and are both cross-platform, so you should be able to switch pretty easily if KeePassX doesn't do everything you want. For browser autofill I'm using the KeePassHttp plugin with ChromeIPass. For InputStick I'm using Keepass2Android with KP2A InputStick. Autotype is a built-in feature of KeePass on desktop. Passwor…

What is KeePass Professional Edition? When I Googled for that the best thing I could find is "Professional Edition" on this page: http://keepass.info/download.html

Is that what you mean? It looks like it's written using Mono for non-Windows platforms. I might have shied away for that reason. What platform do you use it on? I'd love to know if it works well on non-Windows platforms (OS X, Linux).

Re: Horcrux: A Password Manager for Paranoids

#89

Post by taeric »

haberman wrote: post #78
taeric wrote: post #73

Earlier quoted context omitted.

I'm not sure I actually agree with this. Do you know of any studies that go into this? My concern is around having a single source of failure/attack. Which, to be fair, is probably not that different than most people's scenarios. That is, most people just let their browsers and phones remember passwords. So, in practice this already happens. I just don't feel like it is safe. I'm highly interested in being challenged…

I think the only way you avoid a single source of failure is if your brain is actually capable of remembering a separate, high-entropy password for every website you visit. If you use the same password (even a high-entropy one) on every website, any hack of a single site compromises you on every website. If you use a password manager to store high-entropy passwords for every site you visit, then the password manager…

I primarily rely on resets, oddly. Drives me crazy when folks think I will actively try to remember a password that I do not use daily for more than a few days. If you have my email, you have everything you need to let me initiate a reset.

Which, I fully cede is also a single point of failure. Basically, I think we have plenty of weak links in the chains. I'm not too keen on codifying any new ones. If you have something that increases the strength of everything, I'm game to try it. And I am highly interested in studies that look into different strategies.

Re: Horcrux: A Password Manager for Paranoids

#90

Post by ademarre »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Side note; I thought Yubikey was not open source. Am I mistaken?

https://www.yubico.com/2016/05/secure-hardware-vs-open-sourc...

Post reply on HN