I self-host Vaultwarden[1] on a $6/mo DigitalOcean droplet. It took awhile to set up, but I know that I control the data, the backups, and the security. I made this decision after trying LastPass, which turned out to be a buggy piece of shit.
Ask HN: Why should I trust password managers?
101–110 of 289 posts
Re: Ask HN: Why should I trust password managers?
#102Earlier quoted context omitted.
> they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password Maybe I'm missing something but sure they can't store its hash but they can and do store the password strongly encrypted. Presumably without the master password, at least, it should be close to impossible to retrieve the passwords. Or is that assumption wrong?
That is correct and they apparently have the audits to prove it. That said, it's not bulletproof. The chink in the armor is the browser extensions they all use. All it would take is somebody to slip some trojan code into one of the browser extensions and all of the sudden you have a few hundred million decrypted password databases which could trivially be uploaded to wherever.
Could you not argue the same thing for almost any code used by almost any piece of software closer to the metal?
e.g. someone manages to slip malicious code into Chrome/Chromium which eventually makes its way out to every Electron app/most browsers, or something gets injected into Windows/macOS/Linux, etc.
Re: Ask HN: Why should I trust password managers?
#103A password manager creates a single point of failure of all your passwords.
Nope.
Re: Ask HN: Why should I trust password managers?
#104I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
Same here. KeePassXC, sync manually and backup it manually. I don't trust SaaS as well.
You could use Syncthing so you don't have to manually sync and backup nor trust any SaaS
Re: Ask HN: Why should I trust password managers?
#105Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
> Extra benefit: if I lose all my infrastructure, I haven't lost my passwords.
I just dump the SQL database of Vaultwarden and have that as a backup (it's encrypted). I've verified that a new Vaultwarden instance can be spun up on any Docker-capable machine quickly, the SQL file just needs to be mounted in and named properly. So it's a very localhost-friendly backup with no 'infrastructure' requirements. It can be up in minutes.
Re: Ask HN: Why should I trust password managers?
#106Re: Ask HN: Why should I trust password managers?
#107Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.
I would argue it is trust. I trust my password manager to validate the website I am entering my password into more than I trust my eyes. I know that I can't be perfectly vigilant every single time I enter my password. The risk of the password manager betraying me is roughly an order of magnitude below the risk of my falling for a phishing attack.
Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.
Re: Ask HN: Why should I trust password managers?
#108Bruce Schneier has written extensively on the subject (and has written a password manager so he knows what he's talking about):
https://www.schneier.com/blog/archives/2019/02/on_the_securi...
https://www.schneier.com/blog/archives/2019/06/risks_of_pass...
Re: Ask HN: Why should I trust password managers?
#109Earlier quoted context omitted.
In my opinion, storing passwords in encrypted files is probably safer than putting passwords in a centralized location (provided you don't code your own encryption algo or make other silly mistakes). There is not a lot of value in trying to attack a single person's password file, but the value is multiplied by the number of users when using a centralized platform.
> storing passwords in encrypted files Which you almost certainly access with some kind of software, yes? A password manager is just a piece of software that stores passwords in encrypted files, and makes it more convenient to edit them, associate them with a website, use them to log in, check them against known breaches, etc.
I think local open source password management software that you run on your machine are more trustable and less likely to be the subject of a big targeted attack than a cloud tool. So just to be clear, I am not advocating against Keepass or similar, only web tools with thousands of users.
Re: Ask HN: Why should I trust password managers?
#110Earlier quoted context omitted.
I sort of fall into the second category, except I don't sync passwords across devices or even store them at all. I generate them on the fly with [1]. [1] https://chrome.google.com/webstore/detail/hashpass/gkmegkoip...
Having an algorithm (especially one that is publicly available) to generate passwords is not as secure as unique passwords for each service. For example, we now know that you 1) use this extension, and 2) have a HN account. We can now start brute-forcing your password for HN.
It uses a master password to generate these passwords, so I actually think you wouldn't be brute-forcing their HN password that way but the master password itself. If you crack one entry, that means you've found the password they're using to generate all of the others.
Note that regular password managers also have a master password people can try to brute force, so I actually think this algorithmic method is technically more secure since there's no need to trust a third party to manage the password store, while still having the other flaws that traditional PW managers have.