That's why I don't use password managers. That's giving one entity too much power over everything I own.
Just salt the password with a memorized phrase.
Backdoored password manager stole data from as many as 29K enterprises
91–100 of 117 posts
Re: Backdoored password manager stole data from as many as 29K enterprises
#92Earlier quoted context omitted.
If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…
> A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
Different types of vulnerabilities, not that much comparable
Re: Backdoored password manager stole data from as many as 29K enterprises
#93Earlier quoted context omitted.
If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…
Not sure I can call clipboard a very secure communication protocol.
If your OS is owned (hostile apps have access to the clipboard), you're doomed anyway?
You can use different computers / VMs
Re: Backdoored password manager stole data from as many as 29K enterprises
#94Just to clarify the title. It was not a deliberate backdoor on the part of Passwordstate. It was a supply chain attack. There is some history to their security holes (most of the known ones being patched). https://twitter.com/juanandres_gs/status/1385689464329187329 https://github.com/NorthwaveSecurity/passwordstate-decryptor... A potential issue in the password management space is that Francisco Partners (owner of N…
According to Wikipedia Francisco group sold out of NSO in 2019, is that correct?
Re: Backdoored password manager stole data from as many as 29K enterprises
#95Nothing is ever perfect. Password managers are good thing and vastly more pragmatic than the folksy homemade "nuclear-launch-code" alternatives some HN'ers describe here.
Sticking with my password manager.
Re: Backdoored password manager stole data from as many as 29K enterprises
#96Earlier quoted context omitted.
Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?
Bitwarden seems to tick the boxes you need - FOSS license, syncs via an (open source) server which you can host yourself, or use their hosted version, and there's team versions available. It's pretty good. There's also bitwarden_rs (a rust-based server component) if you fancy a simpler self-hosting stack that doesn't require SQL server. The solution has been audited, I believe, but audits are only valid at individual…
Any idea why Bitwarden insist on their installation ID generation for self hosted deployments? it strikes me as unusual, as it's not documented WHY it's necessary, or what the ID is used for, only that you're required to give Bitwarden your email address to get the necessary ID.
If they would remove this step, or at the very least explain it, I'd be more likely to deploy and use it. Critical things like password managers should be self hosted where possible, IMO, and this is a blocker preventing trivial deployments.
Re: Backdoored password manager stole data from as many as 29K enterprises
#97Earlier quoted context omitted.
Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android…
If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…
I think about making something similar. Though the direction would be in reverse.
Say a Pinephone with no way to ssh into by default that is normally powered off. No services listening on the network running on it + strict firewall.
It can only initiate connections to other devices.
Unless I want to sign a ssh key from a CA stored on it or provide a password to some of my other devices it's just powered off. All of DRAM is cleared prior to shutdown. Pinephone can boot to UI in ~2-3s so it would not be bothersome to keep it normally off, and boot up only when needed. Battery would last months for a single charge for this use case.
It would run just a few processes. Init, maybe wpa_supplicant for wifi, and a UI process. Very simple SW, extremely limited attack surface.
Pinephone has a nice feature that it can emulate any USB device, so I could connect it over USB to any machine, and just make it look like a keyboard, and just type in the username and password into a focused field, for the password filling feature.
If I want to create a short term ssh certificate and sign a SSH key for access to a customer machine, the phone would connect to my workstation/notebook/whatever directly over ssh and sign/upload the certificate.
Re: Backdoored password manager stole data from as many as 29K enterprises
#98Earlier quoted context omitted.
That's fine until the first time you have to rotate a password, at which point it devolves to, at best, a mnemonic device.
At that point add a 2 to the end or change your username. Worst case you have to try a few times to get in, but eventually you'll remember it's one of those sites that uses the extra version information.
I don't think just appending a character to your password is such a good idea if it is compromised.
Re: Backdoored password manager stole data from as many as 29K enterprises
#99Earlier quoted context omitted.
Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault. In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will…
Generally the rule would be hash(master password ++ key).
Then you're just reimplementing a password manager... Badly.