Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do password managers make things better?

news.ycombinator.com

Post reply on HN
Print view View original

21–30 of 42 posts

Re: Ask HN: How do password managers make things better?

#21

Post by quixoticaxolotl »

It sounds like you're worried about theft of master password or theft of password database once gathered in one place.

For the former, use auth app-based 2FA against your master password to guard against unwarranted access, preferably using a physical key.

For the latter, review the security protocols your third-party provider specifies for how they protect your data. That should give you confidence about the likelihood of database leakage. If even that doesn't give you confidence, look at keepass where you can control where and how your passwords are stored.

Remember: you always had a password database in one place (your head), you just leaked information about it everywhere because you invested in a mnemonic for easy lookup. With a password manager, you've only increased the number of database accessors by one while guaranteeing significantly less leakage of your mnemonic, which was always the most likely danger.

Re: Ask HN: How do password managers make things better?

#22

Post by 2Gkashmiri »

asking people here, related to the topic at hand, why do we not have a passwordless system built fir the web? i mean i want to sign in to github or email or whatever, i use my local private key to do it like i do ssh. today we use mobile phones or desktops/laptops and all have browser addons and phone keyboards allow "features" so why isnt this more prevalent?

Re: Ask HN: How do password managers make things better?

#23

Post by alufers »

xqoiu wrote: post #20
alecbz wrote: post #8

For most accounts your email password is already a single point of failure (password reset flow). Even where that's not true, the tradeoff with a password manager is in strengthening defenses broadly in exchange for a more central point of failure, compared to weak defenses all around but no single point that gives everything away. The idea being that you can remember one, really good high entropy password, vs. havin…

"Don't reuse email addresses" should become as common advice as "don't reuse passwords." Buy a domain and set up a catch-all email address, use a unique one for each service. Alternative options exist as well (Apple's "Hide My Email" for ex.) Don't do the "add a plus sign at the end of your username to create unique addresses" thing. You still have a single point of failure and it causes weird bugs in poorly designed…

How is setting up a catch-all more secure in terms of account takeover? All the emails still go to one mailbox.

The only benefit is that when a website decides to sell your data or leak it, you know who is to blame and you can block that one e-mail they send the spam to.

Re: Ask HN: How do password managers make things better?

#24

Post by HiCaffine »

Going from my experience with 1Password here.

There are a few ideas, first is as you mentioned, it’s 1 password to remember, the rest can be randomly generated and you don’t need to know them.

In the case of 1Password, data is stored at rest, if the vaults locked it can’t be read, well, not easily.

Auto fill helps detect phishing attempts, if the domain is different 1Password won’t auto fill

It also can detect breaches and store TOTP if that tickles your fancy.

Auto fill is the key point of a good password manager, it makes entering logins trivial, I use biometrics to unlock on all my devices, then it fills in my details for me and away I go.

Re: Ask HN: How do password managers make things better?

#25

Post by awelxtr »

xqoiu wrote: post #20
alecbz wrote: post #8

For most accounts your email password is already a single point of failure (password reset flow). Even where that's not true, the tradeoff with a password manager is in strengthening defenses broadly in exchange for a more central point of failure, compared to weak defenses all around but no single point that gives everything away. The idea being that you can remember one, really good high entropy password, vs. havin…

"Don't reuse email addresses" should become as common advice as "don't reuse passwords." Buy a domain and set up a catch-all email address, use a unique one for each service. Alternative options exist as well (Apple's "Hide My Email" for ex.) Don't do the "add a plus sign at the end of your username to create unique addresses" thing. You still have a single point of failure and it causes weird bugs in poorly designed…

Security without convenience means users will forfeit security for convenience.

Password managers offer convenience for "don't reuse passwords". You want to "don't reuse emails" become the norm? Implement a tool that removes all the hassle.

Re: Ask HN: How do password managers make things better?

#26

Post by lostlogin »

jonplackett wrote: post #16

It'a aways a trade off between security and convenience. The best way I've managed to come up with is to use a password manager but then secure the hell out of it by using hardware keys as a second factor to access it, and only allowing getting around that with a printed out backup key. This way you have the convenience of all the passwords as you need them on verified devices, but strong security (+ inconvenience) i…

> secure the hell out of it by using hardware keys as a second factor to access it

I did this, then my phone broke and I was the only one with access to a particular system at work. It was miserable getting back in. I think harder about how I set myself up now.

Re: Ask HN: How do password managers make things better?

#27

Post by mackatsol »

My pitch to clients is that the Password Manager is a way to consolidate all their passwords into a safe place, which also locks them into their own devices, which also gives them the ability to use unguessable and unique passwords, 2FA in the app.. and makes it easy to use and fill in. For some folks I tell them it's kind of like a glorified bookmark app that also fills in passwords. Whatever it takes to switch you over. ;-)

In my case we use 1Password for families .. which means my SO and kids also use it. Good password management from the get go is well worth it. It works on all your devices and automatically syncs across all of them.

Re: Ask HN: How do password managers make things better?

#28

Post by alecbz »

xqoiu wrote: post #20
alecbz wrote: post #8

For most accounts your email password is already a single point of failure (password reset flow). Even where that's not true, the tradeoff with a password manager is in strengthening defenses broadly in exchange for a more central point of failure, compared to weak defenses all around but no single point that gives everything away. The idea being that you can remember one, really good high entropy password, vs. havin…

"Don't reuse email addresses" should become as common advice as "don't reuse passwords." Buy a domain and set up a catch-all email address, use a unique one for each service. Alternative options exist as well (Apple's "Hide My Email" for ex.) Don't do the "add a plus sign at the end of your username to create unique addresses" thing. You still have a single point of failure and it causes weird bugs in poorly designed…

That only helps if you actually use different passwords for all those different email addresses.

Re: Ask HN: How do password managers make things better?

#29

Post by semanticjudo »

Because all my passwords in the vault are strong and unique. Because my master password is a massive pass phrase not subject to the vagaries of limits on passwords many sites have and I literally keep it locked in a vault. So it is exponentially better than any alternative I have found [edit] for the cost and effort.

Re: Ask HN: How do password managers make things better?

#30

Post by hedora »

jokethrowaway wrote: post #9
thwasd2 wrote: post #6

Well, LastPass is zero-knowledge, even if the databases are leaked, you are safe. Companies are using these for their convenience (AD based access to passwords, without even knowing the actual pswds). Individuals can also have great benefits as they can shuffle their pswds, get notified about weak pswds, or breaches.

If that's true, once you lose your main password you lose everything. It could be mitigated with recovery procedures using a backup code + waiting time, but at that point it wouldn't be zero knowledge.

They have a recovery flow, but it requires access to a previously logged in client.
Post reply on HN