Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Introducing Remembear, new password manager

remembear.com

Post reply on HN
Print view View original

91–98 of 98 posts

Re: Introducing Remembear, new password manager

#91

Post by adrusi »

acjohnson55 wrote: post #83
azinman2 wrote: post #55

Earlier quoted context omitted.

Ohh I like the idea of knowing the password requirements for the top 1000 websites!

What if there were a protocol for password management, such that you never had to use a signup form again? Kind of like OAuth, but for a password generator/manager. It would support password changing (with an e-mail confirmation), so that it would be extremely easy for people to convert from manually managed passwords to automatically managed.

Stupid awful password requirements are terrible (an upper case character, lowercase, number, symbol, also no spaces or colons or commas or semicolons or quotes) but the variance does serve to force people to not use the same password for every site.

Re: Introducing Remembear, new password manager

#92

Post by bhhaskin »

robotcookies wrote: post #29
tptacek wrote: post #11

From the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes. Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors…

What password manager do you recommend?

Pass. It uses plain old gpg. Has git syncing and browser extensions (if you are into that kinda thing).

https://www.passwordstore.org

Re: Introducing Remembear, new password manager

#93

Post by tptacek »

antitree wrote: post #81
dsacco wrote: post #62

Earlier quoted context omitted.

> This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before. Yes, and it's getting really old. I'm tired of seeing security consulting firms wax poetic about how good the client's security is in their reports, then bend over backwards to frame obviously serious findings in the best possible light. Th…

This person gets it. At least NCC doesn't pretend to say something is secure or not. People are getting used to Cure53 reports like they're normal.

NCC writes public-facing reports. They're antiseptic, and rarely make overt endorsements, but it's the whole practice of public-facing reports that needs to end, not just one particularly theatrical subset of them.

Re: Introducing Remembear, new password manager

#94

Post by dwg »

azinman2 wrote: post #20
dwg wrote: post #7

What differentiates RememBear from other password managers? After looking through the blog and website it's not immediately clear to me. What makes (or will make) RememBear better than, say, 1password, which appears to have the same features, is also easy to use, and has a long history with which to work out issues?

I disagree that 1Password is easy to use. It’s easy enough for me to use, but trying to get my parents through the setup and UI has not been an easy task. It could be far more simple and straightforward.

1password could be improved to be sure, but looking at RememBear didn't give me the impression they are competing on ease-of-use as compared to 1password. The UI is pretty similar.

Re: Introducing Remembear, new password manager

#95

Post by dwg »

hmahncke wrote: post #53
azinman2 wrote: post #20

Earlier quoted context omitted.

I disagree that 1Password is easy to use. It’s easy enough for me to use, but trying to get my parents through the setup and UI has not been an easy task. It could be far more simple and straightforward.

I would like to see a version of 1Password that 1) did only passwords - no fishing licenses and secure notes, which adds UX complexity 2) did not distinguish between passwords and logins, which causes endless confusion for my users 3) knew and managed the text requirements for the top 1000 websites so the app could generate legitimate passwords and not ask users to manage password complexity

This would be quite hard to maintain.

Instead they could create a "password complexity requirement specification" to allow sites to embed a universally machine readable description of their requirements, which all password managers and users could benefit from. I don't know if any such effort exists already.

Re: Introducing Remembear, new password manager

#96

Post by dwg »

chiefalchemist wrote: post #63
azinman2 wrote: post #55

Earlier quoted context omitted.

Ohh I like the idea of knowing the password requirements for the top 1000 websites!

Would it be wrong to wish this could (or should?) be standardized? That is, for example, one upper case letter, same special characters, etc. The lack of a standard seems to hurts users more than hackers. The hackers know it and adjust. User just get confused and default to overly simplistic and common PWs.

Many such efforts exist, but getting universal consensus let alone adoption isn't easy.

Re: Introducing Remembear, new password manager

#97

Post by acjohnson55 »

adrusi wrote: post #91
acjohnson55 wrote: post #83

Earlier quoted context omitted.

What if there were a protocol for password management, such that you never had to use a signup form again? Kind of like OAuth, but for a password generator/manager. It would support password changing (with an e-mail confirmation), so that it would be extremely easy for people to convert from manually managed passwords to automatically managed.

Stupid awful password requirements are terrible (an upper case character, lowercase, number, symbol, also no spaces or colons or commas or semicolons or quotes) but the variance does serve to force people to not use the same password for every site.

Such a protocol would be a great place to encode the user-facing aspects of NIST's recommendations.
Post reply on HN