Ask HN: What password managers can you recommend? • Hacker News Board

Re: Ask HN: What password managers can you recommend?

#131

Post by torstenvl » Thu, Jan 06, 2022, 2:00 PM UTC

Bowes-Lyon wrote: post #71

Enpass. https://www.enpass.io/

I don't know who downvoted you, but — terse as it is — I think this is the best recommendation in the thread.

From what I can tell, the primary players in the local-first vault space are legacy 1Password, the pass ecosystem, KeePass[.*], and Enpass.

1Password is aggressively abandoning this market to pursue rent-seeking, and using shady practices to nudge their former customers that way.

KeePass and pass are similar: more ecosystems than products, their password file implementations are documented and there's a broad ecosystem. I didn't find any of the options compelling though.

-- For pass in particular, I'm not an Alfred user, so the macOS integrations don't make a lot of sense to me, though I might play with it at some point later. The Firefox extension seems pretty minimal but maybe worthwhile. All in all the ecosystem seems promising but immature.

-- For KeePass, Strongbox had the smoothest consistency on macOS/iOS, but doesn't support KeePassHTTP, so can't be used with any of the desktop browser extensions, and on iOS KeePassium is a lot faster / doesn't fight me. I ended up trying MacPass (→ KeePassHTTP Connector) and KeePassium. This worked okay, but MacPass was finicky about running in the background, and always forgot where my keyfile was every time it started up. I would revisit KeePass if there were a good full-blown desktop client on every major OS (even if it were Electron) and browser integrations that weren't reliant on using http for IPC.

Enpass is a proprietary solution but built on open standards. They haven't published a full spec of their password database, but they published a lot of information about their use of SQLCipher and what encryption, how they do key derivation, and initialization vectors, so that the format was pretty quickly worked out from there. I would prefer if they made it an open standard like KeePass, but they are helpful rather than hostile to community reverse engineering, so that'll work. The app works great, better UI than 1Password (more organized if slightly less flashy), and the browser extension handles password changes better than anything I've ever seen (though it still confuses some things). I spent a couple hours yesterday reviewing all my weak/old/compromised passwords and changing them. Enpass made this drastically easier than any other tool I've used. The OTP support also seemed to work better than with 1Password, and I've been able to cut back on the number of annoying text message confirmations I get. I pretty quickly sprang for the paid version of Enpass and I think this is where I'm gonna stay for a while — and what I'm going to recommend to others.

Re: Ask HN: What password managers can you recommend?

#132

Post by wepple » Thu, Jan 06, 2022, 2:43 PM UTC

madmonk wrote: post #101

I've been working on a concept where, instead of storing passwords in a manager I use a generator that creates pseudorandom passwords based on a few, easy to remember things. It's essentially a hashing algo created in javascript. You provide a site name, a password length and a pin code and it will consistently generate the same pseudorandom string. Nothing is stored and the generator can be publicly hosted. https://…

This is great, I used to do a similar thing but all in my head (so obviously not as complex permutations)

In practical use, how do you typically remember whether or not a site allows special characters or has a length requirement? Also do you ever have trouble remembering what you named a particular thing? Might be easy for something with an FQDN, but for an encrypted vault or ssh key may be harder

Edit: on second thought, the use of only a numeric pin (with suggested length of 4) seems not good from a security perspective. For an offline attack against, say, a true crypt partition I could offline attack a fairly large pin space with a number of different names fairly trivially. Even in an online attack, if I assume you’re sticking with a 4-digit pin and using the site name “Facebook” then I have a 1/10000 chance, which drops to 1/2500 if Facebook lets me have 4 attempts. The PIN should be a pass phrase IMO

Edit2: please take these criticisms as genuine feedback, as I think this is an excellent idea and I’d like to use it myself. I’m curious why no true cryptographic hash algorithms were used? I only skimmed the code, but I’m concerned that under a model where 1 or especially 2+ passwords are leaked (inevitable in this day), there would be non-zero leakage of intermediate stages if not the original pin. The other challenge I see is the integrity of the JS - would folks self-host this? Otherwise you could possibly use Subresource integrity to load the JS from an untrusted source, and the user would manually verify the SRI key or something

Re: Ask HN: What password managers can you recommend?

#133

Post by BuckRogers » Fri, Jan 07, 2022, 12:06 AM UTC

f1refly wrote: post #118

BuckRogers wrote: post #100

Earlier quoted context omitted.

I agree, that's why I've never used anything except KeePass. Biometrics will take over, I definitely love FaceID on my iPhone. It just works and the fail rate is near zero on my 12 mini. FaceID that works similarly to Microsoft Authenticator for approvals should be all I need but we're not quite there yet. Effectively, given that I need FaceID to open MS Authenticator, we are already there.

Biometrics are not passwords though, biometrics are usernames. They can be forged from something as simple as a regular photograph and you cannot change them.

Biometrics are usenames and passwords in one. You may fool a poor biometric implementation, but I'd challenge anyone to try to break into my iPhone via FaceID.

Re: Ask HN: What password managers can you recommend?

#134

Post by madmonk » Tue, Jan 11, 2022, 9:17 PM UTC

wepple wrote: post #132

madmonk wrote: post #101

I've been working on a concept where, instead of storing passwords in a manager I use a generator that creates pseudorandom passwords based on a few, easy to remember things. It's essentially a hashing algo created in javascript. You provide a site name, a password length and a pin code and it will consistently generate the same pseudorandom string. Nothing is stored and the generator can be publicly hosted. https://…

This is great, I used to do a similar thing but all in my head (so obviously not as complex permutations) In practical use, how do you typically remember whether or not a site allows special characters or has a length requirement? Also do you ever have trouble remembering what you named a particular thing? Might be easy for something with an FQDN, but for an encrypted vault or ssh key may be harder Edit: on second th…

Sorry for the late response. I lost track of this thread.

> In practical use, how do you typically remember whether or not a site allows special characters or has a length requirement?

Good question, wish I had a good answer. That's one issue I've yet to solve for.

> Also do you ever have trouble remembering what you named a particular thing?

No, I base my names off the domain.

> Edit: on second thought, the use of only a numeric pin (with suggested length of 4) seems not good from a security perspective.

The pin length is unlimited. Also, the open nature of this approach allows you to pad site names however you like. For example, instead of using "amazon" choose to pad your names with 2 z's (not my method) as in "zzamazon".

> I’m curious why no true cryptographic hash algorithms were used?

There were certain requirements I had for the output that I couldn't guarantee from existing hashes, one was each for character only appearing once in the output.

> The other challenge I see is the integrity of the JS - would folks self-host this?

Yes. Users are also free to alter the algo to meet their own needs. A simple way to make it unique to you would be to reorder the characters in the 4 sets.

> please take these criticisms as genuine feedback

I am and I do appreciate it. Like I said, this is the first time I've publicly shared it and want any potential issues brought to my attention. I am not a security/crypto expert, barely a novice, and if I'm barking up the wrong tree with this approach I appreciate someone letting me know.

Re: Ask HN: What password managers can you recommend?

#135

Post by madmonk » Tue, Jan 11, 2022, 9:19 PM UTC

knowingpark wrote: post #115

madmonk wrote: post #101

I've been working on a concept where, instead of storing passwords in a manager I use a generator that creates pseudorandom passwords based on a few, easy to remember things. It's essentially a hashing algo created in javascript. You provide a site name, a password length and a pin code and it will consistently generate the same pseudorandom string. Nothing is stored and the generator can be publicly hosted. https://…

I've been using https://chriszarate.github.io/supergenpass/mobile/ a similar idea. I'm going to switch to yours though, its designed better. Thanks

Thank you for the feedback. If there's any issues you notice going forward, feel free to reach out.

Re: Ask HN: What password managers can you recommend?

#136

Post by firepacket » Mon, Jan 17, 2022, 3:53 PM UTC

f1refly wrote: post #119

firepacket wrote: post #70

I believe the most popular password managers have been cracked already, that is why I did a LOT of research and built my own. It was not easy, but it was fun, and if anyone wants to decrypt my files they have a lot of difficult hurdles to jump through. Of course, keylogging is easier, but then they still have to run my software or at least seriously read the source code.

I don't believe GPG has been cracked. Also, running your own crypto is in 99.9% of cases a terrible idea.

Why do you think they say that? Because they really want to help you? You believe that crap if you want, I'll do my own research. SOMEONE has to write it, otherwise where does it come from?