Kaspersky Password Manager: All your passwords are belong to us • Hacker News Board

Re: Kaspersky Password Manager: All your passwords are belong to us

#61

Post by CyberRage » Tue, Jul 06, 2021, 2:40 PM UTC

simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

Bias simply weakens your password.

If you generate long elaborate passwords then they can resist some of these flaws but the point is you don't want to introduce a flaw when they are simpler and better solutions out there.

Mistakes are natural, you want to provide the utmost resistance to such exploits which can stack up to become viable.

Re: Kaspersky Password Manager: All your passwords are belong to us

#62

Post by artificialLimbs » Tue, Jul 06, 2021, 2:41 PM UTC

jpxw wrote: post #28

senectus1 wrote: post #17

Earlier quoted context omitted.

it can be a bit club-footed on the mobile platform. but yeah its my password manager of choice as well.

Are you on Android or iOS? The iOS app is really well done IMO.

The iOS version won't remember my banking app password for some reason. That works on Android though.

Other than that it's been hands down the best.

Re: Kaspersky Password Manager: All your passwords are belong to us

#63

Post by whatsapps2020 » Tue, Jul 06, 2021, 2:43 PM UTC

Ledger is the company that kept for no good reason, and did not secure database of names, phone numbers and home addresses of their customers putting them at risk of robbery.

I’m on that list and I’m scared.

Re: Kaspersky Password Manager: All your passwords are belong to us

#64

Post by CyberRage » Tue, Jul 06, 2021, 2:44 PM UTC

jmclnx wrote: post #42

To me, using a Password Manager puts you at risk, no matter which one you use. I cannot speak to windows, but on Linux, I use a encrypted text file via emacs. And to generate passwords: tr -cd "[:alnum:]" And a real TL;DR: Upgrade your Kaspersky Password Manager

Really? what about memory protection? temp file cleanup? keylogging?

Encryption? what kind of KDF are you using? probably something old and quite brittle when it comes to hardware cracking.

sit this one down boy

Re: Kaspersky Password Manager: All your passwords are belong to us

#65

Post by JackMcMack » Tue, Jul 06, 2021, 2:53 PM UTC

propwash wrote: post #5

I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since

Has anyone had any success in getting your TOTP shared secrets out of Lastpass Authenticator?

Re: Kaspersky Password Manager: All your passwords are belong to us

#66

Post by senectus1 » Tue, Jul 06, 2021, 2:53 PM UTC

jpxw wrote: post #28

senectus1 wrote: post #17

Earlier quoted context omitted.

it can be a bit club-footed on the mobile platform. but yeah its my password manager of choice as well.

Are you on Android or iOS? The iOS app is really well done IMO.

Android.

I often run into problems where the bloody stupid "use bitwarden to fill this field" hover button pops up over the field i need to paste something into. I need to do that because the app hasn't detected the app i'm using is actually a password i currently only have the web URI password saved for.

Re: Kaspersky Password Manager: All your passwords are belong to us

#67

Post by chewmieser » Tue, Jul 06, 2021, 2:57 PM UTC

Biganon wrote: post #32

llampx wrote: post #14

Earlier quoted context omitted.

I have to use 1password for work and hate the UI compared to bitwarden

Could you please elaborate? I've been using 1password for a while, and I can't imagine how it could be any better

Seriously I LOVE 1password. I moved away from LastPass to it after reviewing some of the OSS offerings. I have not found a more feature-complete (and pretty for that matter) alternative.

One of the my favorite features that I cannot find in other password managers it the built-in 2fa support. Click to login to a 2fa enabled site and it copies the code to your clipboard so you just paste and voila at the next screen. Perfect!

Re: Kaspersky Password Manager: All your passwords are belong to us

#68

Post by seanhunter » Tue, Jul 06, 2021, 2:59 PM UTC

jmclnx wrote: post #42

To me, using a Password Manager puts you at risk, no matter which one you use. I cannot speak to windows, but on Linux, I use a encrypted text file via emacs. And to generate passwords: tr -cd "[:alnum:]" And a real TL;DR: Upgrade your Kaspersky Password Manager

If you're happy with the command line, using something like pass (https://www.passwordstore.org/) is worth serious consideration rather than rolling your own. It is GPLv2 and has a number of benefits, including the fact that your passwords are stored encrypted in a git repo and if you do "pass edit" it will call out to $EDITOR to do your edits, putting encryption/decryption and git transparently on both sides.

Re: Kaspersky Password Manager: All your passwords are belong to us

#69

Post by jlund-molfese » Tue, Jul 06, 2021, 3:07 PM UTC

Biganon wrote: post #32

llampx wrote: post #14

Earlier quoted context omitted.

I have to use 1password for work and hate the UI compared to bitwarden

Could you please elaborate? I've been using 1password for a while, and I can't imagine how it could be any better

One example is how 1password hijacks the ctrl+F key combination.

So, if I have a long secret, perhaps a config section, I have to manually copy and paste it into a text editor in order to properly search through it.

Re: Kaspersky Password Manager: All your passwords are belong to us

#70

Post by yosito » Tue, Jul 06, 2021, 3:19 PM UTC

Hackbraten wrote: post #13

123pie123 wrote: post #6

>All the passwords it created could be bruteforced in seconds Can somebody please correct me if I'm wrong, but to bruteforce a password attackers need offline access to the stored passwords data and I'm assuming it mustn't be stored in a proper encrypted way why should the onus be on the end client/ user to use 'crazy' lenght and complex passwords(I'm excluding stupidily simple passwords such as 123456 etc..) surely…

Good points but I beg to differ. - For internet-facing systems, your threat model should acknowledge that the user database is going to leak. It happens all the time, even though many businesses don’t admit it. (You can tell how rampant the problem is: use unique email addresses per service, wait a year or two, and check how much spam you get on those addresses.) - Encryption is irrelevant when your threat model invo…

> wait a year or two, and check how much spam you get on those addresses

Anecdote: I've been using a catch all email address on my own domain for about six months, and signed up for hundreds of services. So far, excluding aggressive marketing emails from the services I signed up for, I've gotten about five spam emails, and all of them were to random aliases on my domain that I've never used or shared like sales@yositosdomain but I am very curious to see how many spam emails I get to different aliases over time.