Ask HN: How do password managers make things better?

#1

Post by deanebarker » Sat, Dec 25, 2021, 1:54 PM UTC

If I use a password manager (1Pass, LastPass, etc.), then all my passwords are in one place. There is literally One Password To Rule Them All™.

How is this less dangerous than the alternative?

Re: Ask HN: How do password managers make things better?

#2

Post by darthrupert » Sat, Dec 25, 2021, 2:05 PM UTC

Getting your passwords requires two things: the master password (which should be strong) and the password file. Some pw managers add further factors.

Most people use simple passwords like cat12345. Or they use more complex passwords but share them between sites. Pw manager fixes that.

It's not perfect, but for most of us it's much better than most obvious alternatives.

Re: Ask HN: How do password managers make things better?

#3

Post by deanebarker » Sat, Dec 25, 2021, 2:08 PM UTC

darthrupert wrote: post #2

Getting your passwords requires two things: the master password (which should be strong) and the password file. Some pw managers add further factors. Most people use simple passwords like cat12345. Or they use more complex passwords but share them between sites. Pw manager fixes that. It's not perfect, but for most of us it's much better than most obvious alternatives.

>the password file

I use the online version. There's a browser plugin.

Re: Ask HN: How do password managers make things better?

#4

Post by nomorecommas » Sat, Dec 25, 2021, 2:10 PM UTC

There are more than two alternatives. Each has their own strengths and weaknesses. None are ideal.

    encrypted password vault
    hash-based password generation
    paper-grid password generation
    paper password pocketbooks
    post-it notes on the monitor

Re: Ask HN: How do password managers make things better?

#5

Post by LinuxBender » Sat, Dec 25, 2021, 2:26 PM UTC

It can be a problem if something can access your password database while it is unlocked or if you have a weak db password. In addition to keeping your system and applications patched and using least privileges and all the other usual best practices you can also keep the database closed when not using it.

To venture a few theoretical mitigation turtles down, one could keep a string in their head that they type in before pasting the password from their database meaning that the database only has part of the password. Some might consider that too much friction and some might see that as a fun prank for the password database vendors that theoretically work for intelligence agencies.

Re: Ask HN: How do password managers make things better?

#6

Post by thwasd2 » Sat, Dec 25, 2021, 2:38 PM UTC

Well, LastPass is zero-knowledge, even if the databases are leaked, you are safe.

Companies are using these for their convenience (AD based access to passwords, without even knowing the actual pswds). Individuals can also have great benefits as they can shuffle their pswds, get notified about weak pswds, or breaches.

Re: Ask HN: How do password managers make things better?

#7

Post by deanebarker » Sat, Dec 25, 2021, 2:42 PM UTC

thwasd2 wrote: post #6

Well, LastPass is zero-knowledge, even if the databases are leaked, you are safe. Companies are using these for their convenience (AD based access to passwords, without even knowing the actual pswds). Individuals can also have great benefits as they can shuffle their pswds, get notified about weak pswds, or breaches.

>Well, LastPass is zero-knowledge

How about 1Password?

Re: Ask HN: How do password managers make things better?

#8

Post by alecbz » Sat, Dec 25, 2021, 3:03 PM UTC

For most accounts your email password is already a single point of failure (password reset flow).

Even where that's not true, the tradeoff with a password manager is in strengthening defenses broadly in exchange for a more central point of failure, compared to weak defenses all around but no single point that gives everything away. The idea being that you can remember one, really good high entropy password, vs. having a bunch of weak passwords.

Of course, the theoretical ideal would be having lots of different strong passwords, but that's not how human memory works.

Re: Ask HN: How do password managers make things better?

#9

Post by jokethrowaway » Sat, Dec 25, 2021, 3:12 PM UTC

thwasd2 wrote: post #6

Well, LastPass is zero-knowledge, even if the databases are leaked, you are safe. Companies are using these for their convenience (AD based access to passwords, without even knowing the actual pswds). Individuals can also have great benefits as they can shuffle their pswds, get notified about weak pswds, or breaches.

If that's true, once you lose your main password you lose everything.

It could be mitigated with recovery procedures using a backup code + waiting time, but at that point it wouldn't be zero knowledge.

Re: Ask HN: How do password managers make things better?

#10

Post by johnwheeler » Sat, Dec 25, 2021, 3:17 PM UTC

The main alternative is a shared password between sites so if one of those sites gets hacked, your passwords across many sites are compromised.

The security risk in general is not that your main password is guessed or cracked. It’s that a shared password is compromised.