On Password Managers • Hacker News Board

Re: On Password Managers

#41

Post by tptacek » Thu, Jul 20, 2017, 4:54 PM UTC

AlexandrB wrote: post #38

tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

> They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults. 1Password 4 for Windows uses local vaults just fine - I'm using it right now. The new 1Password 6 for Windows does not support local vaults.

Right! Sorry. I don't use Windows. Honestly? My recommendation about password managers probably shouldn't extend to Windows; there might be no password manager I confidently recommend on that platform.

That's not a statement about 1Password; it's about the fact that the security models are different on the two platforms, and I'm very familiar with how 1Password works on macOS and less so on Windows.

Re: On Password Managers

#42

Post by sbarre » Thu, Jul 20, 2017, 4:55 PM UTC

AlexandrB wrote: post #38

tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

> They're promoting cloud vaults and hiding local vaults, and the Windows version of 1Password has apparently never used local vaults. 1Password 4 for Windows uses local vaults just fine - I'm using it right now. The new 1Password 6 for Windows does not support local vaults.

This is what led me to move to their subscription model (and I'm sure it was intentional).

1P4 for Windows was the last version that was "buy once and forever", but they weren't providing good browser integrations for that version.

I am happy to support them though, and gladly used their products.

I definitely don't want to have to unlock my vaults on their website though.

Re: On Password Managers

#43

Post by tptacek » Thu, Jul 20, 2017, 4:58 PM UTC

kchoudhu wrote: post #31

tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

> [t]here's currently no other commercial password manager that I recommend. I'm sorry I can't go into more detail than that Sounds like there's something about to blow?

I just get yelled at here when I leave out that sentence.

Re: On Password Managers

#44

Post by amelius » Thu, Jul 20, 2017, 4:58 PM UTC

If only I had a keyboard with an NFC chip, and some password software on my phone ...

Re: On Password Managers

#45

Post by tedmiston » Thu, Jul 20, 2017, 4:59 PM UTC

jrowley wrote: post #18

tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

Lastpass doesn't necessarily have the best track record, and you said you couldn't go into detail, but I'm curious so will ask - if you feel comfortable sharing, what securities issues do you see with lastpass besides storing secrets in some companies cloud?

To start, the LastPass browser extension auto logout feature has critical bugs. I've come back to my computer after several days and found it still logged in with full access to the vault (no master password re-entry required) even with auto logout set to 15 minutes of inactivity. After that happened several times, I lost trust in the product.

Re: On Password Managers

#46

Post by rkeene2 » Thu, Jul 20, 2017, 4:59 PM UTC

bsilvereagle wrote: post #2

Encryption Wizard [1] solves issues 1-4, but is severely lacking on #5 (device syncing). It also has no mobile support. I've performed a cursory search to see if any OSS password manager comes close to EW on features, but didn't find anything: * Supports CAC encryption/decryption * Allows you to store contacts public certs * Allows keys to decrypt * Generates passphrases * Allows multiple keychains to be opened at on…

hunter2 supports using DOD CACs (or any other smartcard) to encrypt and share passwords. In hunter2, users are identified by their public keys. Each password can be shared with any user by any user that can decrypt that password.

The DB used is a flat, sorted, text file so it can be stored in a version control system.

https://chiselapp.com/user/rkeene/repository/hunter2/

I'm interested in taking you up on your offer for an app-ified version. How should I proceed ?

Re: On Password Managers

#47

Post by raverbashing » Thu, Jul 20, 2017, 4:59 PM UTC

I use password managers, but I think the usual way of thinking about them is wrong

Besides password reuse being not recommended, the main issue is: most websites don't give a eff about whether they store your password correctly or not

It's a trust asymmetry, they ask you to provide a password (and most ask one with a lot of BS restrictions) THEN md5 it and put it on the database, or worse

And as said by the article (and implied by the above paragraph), there are better ways of obtaining someone's password - pwd managers are not the weakest link, at least not now

Re: On Password Managers

#48

Post by jmcphers » Thu, Jul 20, 2017, 4:59 PM UTC

danirod wrote: post #25

peterkshultz wrote: post #9

Any password manager recommendations such that people don't need to deal with 1Password's cloud-based storage?

I use KeePass to store my passwords plus other sensible data. It's multiplatform and I can have access to my passwords file on macOS using MacPass, on Linux and Windows using KeePassX, and on Android using KeePass2Android. I use Dropbox to sync the file through multiple computers including my Android phone. I don't fully trust Dropbox for sensible stuff, but since the passwords file is encrypted by KeePass, I conside…

This is exactly what I've done for years. The only difference is that I'm so paranoid about losing my keyfile (and with it all my passwords) that I also put it on the cloud -- just not on the same cloud provider as the keepass database.

Re: On Password Managers

#49

Post by dahart » Thu, Jul 20, 2017, 4:59 PM UTC

sprice wrote: post #33

tptacek wrote: post #5

The 1Password situation is complicated, and is a lot less sketchy than Bray's summary would lead you to believe. 1Password has not in fact phased out their native applications or required people to use 1Password.com to store passwords (it would be insane for them to do so). There are four issues that I'm currently aware of with 1Password: 1. They've converted from flat to subscription pricing. 2. They're pushing peop…

> I recommend 1Password, and there's currently no other commercial password manager that I recommend. Are there any open source password manager products that you would recommend?

Total aside here, because I know what you mean, but it's interesting that many people include open source software in their definition of "commercial" software, the DOD and other government agencies, for example. https://www.dwheeler.com/essays/commercial-floss.html

Re: On Password Managers

#50

Post by guelo » Thu, Jul 20, 2017, 5:01 PM UTC

Against all recommendations I reject all password managers. I feel like all security software is eventually compromised, most frequently by business folks as in this case. Instead I use a tiny notebook that I keep in my wallet. I pick long 12+ character passwords myself, not super randomized but I haven't heard of a brute forcing attack in a long time. It allows me to easily meet weird password requirements. I feel pretty secure that it's not on a computer. Admittedly I also use Firefox's password manager to avoid typing them in all the time. I trust Mozilla for now, though I wouldn't be surprised if they are eventually compromised as their market share goes down.