Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: How do password managers make things better?

news.ycombinator.com

Post reply on HN
Print view View original

31–40 of 42 posts

Re: Ask HN: How do password managers make things better?

#31

Post by munchbunny »

lostlogin wrote: post #26
jonplackett wrote: post #16

It'a aways a trade off between security and convenience. The best way I've managed to come up with is to use a password manager but then secure the hell out of it by using hardware keys as a second factor to access it, and only allowing getting around that with a printed out backup key. This way you have the convenience of all the passwords as you need them on verified devices, but strong security (+ inconvenience) i…

> secure the hell out of it by using hardware keys as a second factor to access it I did this, then my phone broke and I was the only one with access to a particular system at work. It was miserable getting back in. I think harder about how I set myself up now.

This is one of the big issues with MFA: you should ideally never create a single point of failure in the second factor, so you want two hardware tokens, a hardware token and a fallback TOTP, etc., but also ideally the ability to have fallbacks that do not rely on email or SMS.

Most websites including financial ones fail on the second point. And it worries me because SIM swapping is real and does happen to people you know.

Re: Ask HN: How do password managers make things better?

#32

Post by iso8859-1 »

convolvatron wrote: post #15
nomorecommas wrote: post #4

There are more than two alternatives. Each has their own strengths and weaknesses. None are ideal. encrypted password vault hash-based password generation paper-grid password generation paper password pocketbooks post-it notes on the monitor

when can I actually sign a challenge with my private key instead of trying to deal with this mess?

Now. https://developer.mozilla.org/en-US/docs/Web/API/PublicKeyCr...

Re: Ask HN: How do password managers make things better?

#33

Post by fy20 »

I use Bitwarden hosted on my own server at home. The only way to access it from outside is via a VPN. If someone gets access to that, figures out the URL of my Bitwarden instance, then manages to guess my master password, I feel it's fair game to have whatever passwords they want at that point :-)

Remember the alternative for most people is using the same password on every single site. When a password (along with your email) is leaked from one website, then people can gain access to whatever other sites you use the same email/password combination on.

Re: Ask HN: How do password managers make things better?

#34

Post by zaptheimpaler »

I use 1pass but don’t necessarily trust it to make things any more secure..

AFAIK there is no way to prove that the cloud storage only stores an encrypted version at all times. Even if i audited the source and checked the network activity a few times, all it would take is one auto update that skips encryption, uploads the unencrypted passwords to a server and then restores the original binary. The only proof would be a network request if i was even actively logging and monitoring every single outgoing packet.

Re: Ask HN: How do password managers make things better?

#35

Post by qudat »

Not sure how common or secure this is but even inside my password manager, only part of the password is stored there. I have a common password that I add to complete the password.

So even if someone had access to my password manager, the passwords in there are just partials.

Re: Ask HN: How do password managers make things better?

#36

Post by codeptualize »

Few advantages:

- One password per service, so if a service leaks it it affects nothing else.

- Super strong passwords, random long passwords way beyond what I can remember making them more secure from guessing/brute forcing.

Indeed, if someone gains access to your password manager you are not going to have a good time. So you have take all necessary precautions like 2FA, and even better hardware security keys, and you have to put trust in the service you use, they should be stored encrypted etc etc.

If it's less dangerous depends on your situation and what you are defending against. For me and I think for most "normal" folks, it's much safer as most risk comes from having bad passwords, reusing passwords, and services leaking your reused passwords.

That's the big question: what is the alternative? In most cases, it's way worse.

Another mitigating factor is that for important services you should enable 2fa anyway. If you keep your 2nd factor out of the pw manager (hardware security keys!) you add another layer.

Re: Ask HN: How do password managers make things better?

#37

Post by CurrentB »

awelxtr wrote: post #25
xqoiu wrote: post #20

Earlier quoted context omitted.

"Don't reuse email addresses" should become as common advice as "don't reuse passwords." Buy a domain and set up a catch-all email address, use a unique one for each service. Alternative options exist as well (Apple's "Hide My Email" for ex.) Don't do the "add a plus sign at the end of your username to create unique addresses" thing. You still have a single point of failure and it causes weird bugs in poorly designed…

Security without convenience means users will forfeit security for convenience. Password managers offer convenience for "don't reuse passwords". You want to "don't reuse emails" become the norm? Implement a tool that removes all the hassle.

1password now has exactly this implemented with fastmail integration. You can generate a new email just as easily as a password when you make an account

Re: Ask HN: How do password managers make things better?

#38

Post by alanlammiman »

qudat wrote: post #35

Not sure how common or secure this is but even inside my password manager, only part of the password is stored there. I have a common password that I add to complete the password. So even if someone had access to my password manager, the passwords in there are just partials.

This sounds interesting. Does anybody have comments on how helpful it is?

Re: Ask HN: How do password managers make things better?

#39

Post by EricE »

Biggest advantage is with modern managers like 1Password on Apple operating systems, at least, there is tight integration that makes their use very seamless.

I have just one ridiculous master password that I have memorized (1Password has a great blog post talking about how to use the diceware method to pick a truly random yet fairly easy to memorize master password). With just that one password there is now not a penalty to keep individual, random passwords on all my accounts.

Password managers like 1Password are also integrating google auth support for two factor authentication and again in iOS in particular it's a VERY seamless experience to authenticate with 2 factor. macOS Monterey brought some further integrations but it's still not as seamless as iOS.

And I think that's what's really key - it's not like we all don't know passwords are a pain in the ass. OS vendors need to keep stepping up and making integrations with things like password managers easier until we finally come up with something that can replace them.

Re: Ask HN: How do password managers make things better?

#40

Post by EricE »

jfax wrote: post #18

I wasn't sure about password managers for a long time, until I read this article by Troy Hunt "Humans are Bad at URLs and Fonts Don’t Matter": https://www.troyhunt.com/humans-are-bad-at-urls-and-fonts-do... - if you give this a skim read you may think this has nothing to do with password managers, but read it to the end. I won't spoil it, but I will say that everything suddenly clicked in. Password managers solve so…

Exactly - it's not just convenience. Without a password manager how the hell can you actually keep unique passwords that are completely unrelated on all your sites? You can't.

For me password manager is all about practicality.

Post reply on HN