91–100 of 289 posts
I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
> they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password Maybe I'm missing something but sure they can't store its hash but they can and do store the password strongly encrypted. Presumably without the master password, at least, it should be close to impossible to retrieve the passwords. Or is that assumption wrong?
That said, it's not bulletproof. The chink in the armor is the browser extensions they all use. All it would take is somebody to slip some trojan code into one of the browser extensions and all of the sudden you have a few hundred million decrypted password databases which could trivially be uploaded to wherever.
I'm surprised by so many of the comments here out-of-hand dismissing or denigrating any password manager that stores data in the cloud. There are ways to store data securely, one of the simplest methods is to do zero-knowledge encryption of that data by way of key-generation from a password only the user knows at the time of decryption. This is essentially how the vault functionality of most password managers work, w…
Earlier quoted context omitted.
I am the same, but with the enhancement of using Resilio Sync to automatically sync the file between devices.
I do the same, with Nextcloud though, but I doubt SkyMarshal would consider that as an enhancement. He, and others, sync it manually and "offline" for security reasons.
Setting up local automated sync is on my todo list, it’s just lower priority than too many other things. As I mentioned, I don’t create new accounts so often that I need automated sync.
Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
_Why_ do you trust Bitwarden?
I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.
Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. 1Password does this.
I trust my password manager (keepassxc) because (1) I believe in the fundamental goodness of humans. (2) I believe that keepassxc being a Free Software, was made with honest intentions by competent people. (3) That human society should be organized on the principle of mutual aid, and that involves trusting (initially at least) those who say they intend to aid you.
But it's true that on some level we need to trust others so it's hard to say where to draw the line.
One would trust a password manager as a result of their obvious social media login getting all their friends spammed.
One would trust a password manager as a result of someone finding the post it documenting their bank credentials.
One would trust a password manager as a result of missing out on an opportunity for forgetting a login and having to wait an ungodly number of hours due to an inconveniently timed DNS upgrade leading to a long delay in the password rest email's arrival.
Nobody trusts password managers because of something essential to the password manager or the concept thereof, we trust password managers because we have experience or can imagine experiencing the fallout of our own credential mismanagement in the face of increasingly complex security demands resulting not always directly from increasingly sophisticated attacks. It reduces our cognitive load slightly and focuses otherwise diffuse anxieties.
It sounds like to me that there are three types of people: * Layman who reuses passwords unless a techie friend convinces them to use a PW manager. * HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices. * Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they c…
I sort of fall into the second category, except I don't sync passwords across devices or even store them at all. I generate them on the fly with [1]. [1] https://chrome.google.com/webstore/detail/hashpass/gkmegkoip...