This is a piece of tech that has slipped under my radar for a long time. I've been having my own methods for safe handling of passwords on the web.
Why do people trust password managers?
Ask HN: Why should I trust password managers?
1–10 of 289 posts
Re: Ask HN: Why should I trust password managers?
#2It's a convenience vs. security tradeoff. The fact is, most people can afford to adopt a flawed security model to give themselves greater convenience, because most people aren't being specifically targeted and attacked. I doubt many people realize that they are making such a tradeoff, but that's more about dishonest advertising...
Re: Ask HN: Why should I trust password managers?
#3I don't trust them and use an offline virtual machine on Qubes OS to store my passwords instead.
Re: Ask HN: Why should I trust password managers?
#4I don't trust them. I store passwords locally on my machine (encrypted).
Re: Ask HN: Why should I trust password managers?
#5If you don't trust password managers you're trusting something else. You have to take that into consideration and weight in versus your threat model.
And you probably don't even need to trust a password manager with every password you have, you can keep just the random 200+ logins you probably have for weird websites. And keep banking, emailing and the other important stuff away from it. Also, you don't even need to have your password manager store the actual passwords there, you could "pepper" what is stored so you transform it after you paste it to the website.
Re: Ask HN: Why should I trust password managers?
#6It's a convenience vs. security tradeoff. The fact is, most people can afford to adopt a flawed security model to give themselves greater convenience, because most people aren't being specifically targeted and attacked. I doubt many people realize that they are making such a tradeoff, but that's more about dishonest advertising...
It's less flawed than relying on a low-strength memorable password that's reused across all services. Having a uniquely generated, random password for each service that gets autofilled by the password manager is much more secure.
Re: Ask HN: Why should I trust password managers?
#7Because if you don't use one, you'll almost certainly instead either reuse passwords across sites, store passwords insecurely, or choose weak passwords.
Re: Ask HN: Why should I trust password managers?
#8autofill is the most important bit.
Re: Ask HN: Why should I trust password managers?
#9If you don't trust password managers you're trusting something else. You have to take that into consideration and weight in versus your threat model. And you probably don't even need to trust a password manager with every password you have, you can keep just the random 200+ logins you probably have for weird websites. And keep banking, emailing and the other important stuff away from it. Also, you don't even need to…
One word about peppering, keep the inevitable future in mind and strongly consider ensuring your transform is available to whoever will be managing your affairs after you shuffle off. Keeping it with a lawyer or in a safe deposit box, perhaps.
Source: helped deal with an uncle's many, many digital resources after he passed unexpectedly.
Re: Ask HN: Why should I trust password managers?
#10It's a convenience vs. security tradeoff. The fact is, most people can afford to adopt a flawed security model to give themselves greater convenience, because most people aren't being specifically targeted and attacked. I doubt many people realize that they are making such a tradeoff, but that's more about dishonest advertising...
I guess password managers seem like one of those few decisions that made my life both more convenient and more secure (after the initial adoption).
Out of curiosity, what could one use instead of a password manager that would be closer to the “more secure” side of things in your opinion?