Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

121–130 of 289 posts

Re: Ask HN: Why should I trust password managers?

#121

Post by npteljes »

burntsushi wrote: post #52
npteljes wrote: post #46

Earlier quoted context omitted.

Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.

I think it's just an example to give you a conceptual idea of what 'pass' is doing under the covers. Of course, using 'pass' does not require 'echo'ing your password anywhere. Tangentially, if you precede a command with a space, then it won't show up in your shell history. (Double check to be sure, as this is likely a configurable option of your shell. e.g., 'histignorespace' in zsh.)

I agree with your points, but why showcase a super secure system with a flawed example? Also, so many things can go wrong with this setup, I'm inclined to think that this is one of the upsides of a password manager like KeePass.

Re: Ask HN: Why should I trust password managers?

#122

Post by remram »

ramses0 wrote: post #34

https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…

Is that "sign" supposed to be "encrypt"?

Re: Ask HN: Why should I trust password managers?

#124

Post by foxfluff »

prophesi wrote: post #83

It sounds like to me that there are three types of people: * Layman who reuses passwords unless a techie friend convinces them to use a PW manager. * HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices. * Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they c…

* HN user who doesn't use a password manager and doesn't sync passwords across devices and doesn't reuse passwords (except on throwaway accounts)

Re: Ask HN: Why should I trust password managers?

#125

Post by antihero »

reedjosh wrote: post #96
andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.

Re: Ask HN: Why should I trust password managers?

#126

Post by PennRobotics »

npteljes wrote: post #46
ramses0 wrote: post #34

https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…

Doesn't that 'echo' command go straight to the command history? It would reside in ~/.bash_history unencrypted until I type 2000 other commands.

Adding a space before echo will keep the command out of .bash_history (if $HISTCONTROL == ignorespace or ignoreboth)

Re: Ask HN: Why should I trust password managers?

#127

Post by kerblang »

If you are concerned about using unfamiliar and complex cloud software:

A very reasonable option is ccrypt, which gives you dirt-simple command-line password-based encryption for text files (or any other files). It's available for most linux distros, cygwin, homebrew, etc.

Personally I use my own homemade text editor with built-in AES-256 password-based encryption. It's about as trustworthy as I am, and a tad more friendly than ccrypt.

In either case cloud storage is easy; for example a github repo is nice (preferably a private one) because you have backups automatically in case you mess up, which I have done. I don't use my phone for critical work in the first place (can't trust 'em) so I'm not worried about integrating that.

Re: Ask HN: Why should I trust password managers?

#128

Post by xblau »

oblio wrote: post #91
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

Mobile devices?

On Android you can use Keepass2Android[0] to open your KeePass files. You still have to copy your kdbx file to your phone somehow, of course.

[0] https://play.google.com/store/apps/details?id=keepass2androi...

Re: Ask HN: Why should I trust password managers?

#129

Post by gigglesupstairs »

leokennis wrote: post #111
SkyMarshal wrote: post #88

Earlier quoted context omitted.

> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.

Do you understand the concept of a password manager? You only have to remember one password, and for that reason people can choose a longer and more complex one. Then your passwords are encrypted using that master password. So people cannot “reverse” your password if you pick a reasonably long master password. For reference, my master password is a 27 character sentence which would take somewhere between a millennium…

This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.

Re: Ask HN: Why should I trust password managers?

#130

Post by jolux »

SkyMarshal wrote: post #86
TimTheTinker wrote: post #80

Earlier quoted context omitted.

For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits

I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.

1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates.

Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.

Post reply on HN