You can host Bitwarden yourself if you want to and trust no one.
Ask HN: Why should I trust password managers?
11–20 of 289 posts
Re: Ask HN: Why should I trust password managers?
#12I trust a local password manager, namely KeepassX running on my linux laptop. It's an open source dedicated piece of tech running on the local box, so I figure my trust model extends at least this far.
Otherwise, no, I wouldn't trust a commercial password manager with automatic sync on to someone else's servers. I also don't trust the browser enough to put an extension in it that has the keys to my password database.
It's a tradeoff. I get a nice level of security, but it's not 100% seamless. Without autofill, I often need to start up the password manager, search for a site, copy and paste password into the browser. (I just had to do this to log into HN.)
For some sites, I let the browser also save the password, which I treat as just a cache of low-value passwords. And the encrypted password manager database gets occasionally synched into gdrive, so I can also access it from my smartphone using the appropriate app.
Been doing this for 5+ years at this point, and it works for me... can't even remember what on earth I did before. Probably passwords in tiny plain text files.
Re: Ask HN: Why should I trust password managers?
#13Because if you don't use one, you'll almost certainly instead either reuse passwords across sites, store passwords insecurely, or choose weak passwords.
In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encryption algo or make other silly mistakes).
There is not a lot of value in trying to attack a single person's password file, but the value is multiplied by the number of users when using a centralized platform.
Re: Ask HN: Why should I trust password managers?
#14You don't "send" your password to the manager, you enter it locally. Ideally, it never leaves your computer, so it is far less likely to 'leak'
The database is encrypted, so if someone were to hack them, they would at least have some (hopefully major) issues decrypting it all.
Re: Ask HN: Why should I trust password managers?
#15It's a convenience vs. security tradeoff. The fact is, most people can afford to adopt a flawed security model to give themselves greater convenience, because most people aren't being specifically targeted and attacked. I doubt many people realize that they are making such a tradeoff, but that's more about dishonest advertising...
I guess password managers seem like one of those few decisions that made my life both more convenient and more secure (after the initial adoption). Out of curiosity, what could one use instead of a password manager that would be closer to the “more secure” side of things in your opinion?
> what could one use instead of a password manager
The comment you're replying to mentions "dishonest advertising", which suggests "password manager service".
I'd think using e.g. KeepassXC would be more secure (but less convenient) than this, since I manage where the password database is stored/accessed.
Re: Ask HN: Why should I trust password managers?
#16I use a password manager for the hundreds of accounts I have where security is not super important. Mostly as way to not have to reuse passwords (credential stuffing now makes up a significant amount of attack traffic), nor fight the varying password requirements ("shoot, did this website require a special character?"). Tbh, it's nice to have one less thing to worry about. For the increasing number of sites which require 2fa, it also let's me keep a totp token accessible from all my devices.
My most secure accounts use their own individual, memorable, secure password.
I do fear that even if my self-hosted password manager is secure today, there's nothing stopping a malicious update to that software which could exfiltrate all of my passwords.
Re: Ask HN: Why should I trust password managers?
#17I trust the one I wrote for myself. I would have a hard time trusting a 3rd party tool without a lot of insight and feedback as to its design and implementation, and credible assessments of its trustworthiness.
Re: Ask HN: Why should I trust password managers?
#18You can host Bitwarden yourself if you want to and trust no one.
If you're going to selfhost, use Vaultwarden https://github.com/dani-garcia/vaultwarden - way lighter version that implements most of the features
Re: Ask HN: Why should I trust password managers?
#19IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target.
I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.
Re: Ask HN: Why should I trust password managers?
#20I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password.
I imagine nation state-supported malicious hackers are targeting them. Everything else is getting breached and leaked these days, there’s a non-trivial possibility these will too.
I just use KeePassXC instead, and periodically ‘sync’ the database across my workstations and laptop. And by ‘sync’, I mean manually export the database and rsync it around to my workstations and laptop and re-import it on each. But given how infrequently I create new web accounts, this isn’t a major hassle. It works fine, I don’t need some centralized service for this.