They might be flawed but they provide easy-to-use solutions that add value to a huge user base. If you think a solution is better, at least make it so you don't need to reeducate everybody on Earth. It's like that saying: would you rather be right or be happy?
Why traditional password managers are flawed
31–40 of 64 posts
Re: Why traditional password managers are flawed
#32Earlier quoted context omitted.
> Also, even if it were true, storing the actual passwords means that you have a single point of failure - if the password storage is compromised the whole thing is compromised. How is your system different? If I get ahold of your master key, your entire thing is compromised.
This is true, but on the other hand the master key is never stored anywhere, so your chance of getting hold of it is reduced. EDIT: as pointed out, no sensible system stores the master password. I do stand by the earlier 'single point of failure' point though. If you store a password vault somewhere and it goes down, or is encrypted by malware, or you lose the ability to access that storage for whatever reason you're…
It's reduced but by how much? For example, 1Password uses PBKDF2 with something like 10k or 100K rounds to encrypt the local vault. If you were looking at ways that could be compromised, is it really likely that you need to worry about an attacker getting a copy and dedicating a lot of expensive hardware to brute-forcing it anywhere near as much as the attacker getting malware on your system which captures those keystrokes?
Re: Why traditional password managers are flawed
#33Earlier quoted context omitted.
This is true, but on the other hand the master key is never stored anywhere, so your chance of getting hold of it is reduced. EDIT: as pointed out, no sensible system stores the master password. I do stand by the earlier 'single point of failure' point though. If you store a password vault somewhere and it goes down, or is encrypted by malware, or you lose the ability to access that storage for whatever reason you're…
It's reduced but by how much? For example, 1Password uses PBKDF2 with something like 10k or 100K rounds to encrypt the local vault. If you were looking at ways that could be compromised, is it really likely that you need to worry about an attacker getting a copy and dedicating a lot of expensive hardware to brute-forcing it anywhere near as much as the attacker getting malware on your system which captures those keys…
Except 1Password is also pwnd if an attacker gets mallware on your system? They just snatch the database and record keystrokes when you unlock it.
Re: Why traditional password managers are flawed
#34$ dpg "The sentence" word Doesn't this store all your secret info in your .bash_history file, an unencrypted plain text file, with a convenient marker for finding it in the history file? This is no better than just storing the password that DGP generates directly; it's deterministic and trivial to derive the password. For somebody concerned about a "master password" being insecure, this is a far far worse solution.
Yes. And this is a great example of why titles like this one undermine any point the author hopes to make.
I'm a full time and, I hope, very capable developer. But I'm not a full time, capable password manager developer. Simply by virtue of the number of hours available in the day, the homebrew password manager I create in my spare time will never be as secure as the one made by someone who dedicates themselves to this area. So I'll just go ahead and use the one they made.
Re: Why traditional password managers are flawed
#35> Use the same sentence everywhere. Commit it to memory. Sounds like a master password to me
That's what I was just thinking. I really wonder what the response is to this objection.
Re: Why traditional password managers are flawed
#36"Password Safe" isn't a traditional password manager?
Re: Why traditional password managers are flawed
#37Earlier quoted context omitted.
I use a system that I wrote https://github.com/kybernetikos/sinkless (incidentally it uses a similar system to this article - PBKDF with SHA512 - in browser plugins) that supports many of these situations. * The character sets can be entered manually. They form public information and are stored locally, can easily be exported as csv. * Each password has a 'version' which you can increment. The version is considered p…
An alphabet isn't enough to describe some [stupid] bank password requirements (I do admit the banks are really the problem here though). Two banks I've worked with recently: * No consecutive digits, not your initials. Numbers cant be your day, month or year of birth. * No repeating any symbol in the entire password. Cannot contain a subset of a previous key (I don't know how long the subset is to trigger this, but I…
* is assigned by the system and cannot be changed easily (stupid in itself, but exists nonetheless)
Re: Why traditional password managers are flawed
#38When it comes to security tools, I strongly recommend not to use pet projects maintained by a single person over well-established open source tools. If you are looking for a cross-platform, reliable, secure password manager, KeePassXC is an excellent choice.
Re: Why traditional password managers are flawed
#39Despite the inflammatory title, these kinds of password "managers" that are stateless and rely instead on a hash system come up quite frequently but they never have an answer for some basic problems that plague real-life accounts and passwords. * Requirements of character sets used on different services. One upper case, two special characters, and 18 octothorps required. * Differing rotation schedules. ___ Bank force…
I use a system that I wrote https://github.com/kybernetikos/sinkless (incidentally it uses a similar system to this article - PBKDF with SHA512 - in browser plugins) that supports many of these situations. * The character sets can be entered manually. They form public information and are stored locally, can easily be exported as csv. * Each password has a 'version' which you can increment. The version is considered p…
What is the advantage of this over a traditional password manager? You need to sync a file so you can obtain the state needed to generate a password, just like a password manager. Your CSV file can be stored in a publicly accessible location without losing security, but the same is true of a password manager's database. Both are useless without the master password, and both unlock everything if the master password is compromised.
It seems to me that generating a password from a master password and some settings in a file is equivalent, both in terms of convenience and security, to decrypting a password from a master password and an encrypted password store.
Re: Why traditional password managers are flawed
#40Earlier quoted context omitted.
It's reduced but by how much? For example, 1Password uses PBKDF2 with something like 10k or 100K rounds to encrypt the local vault. If you were looking at ways that could be compromised, is it really likely that you need to worry about an attacker getting a copy and dedicating a lot of expensive hardware to brute-forcing it anywhere near as much as the attacker getting malware on your system which captures those keys…
Except 1Password is also pwnd if an attacker gets mallware on your system? They just snatch the database and record keystrokes when you unlock it.
[deleted]