Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

151–160 of 289 posts

Re: Ask HN: Why should I trust password managers?

#151

Post by TimTheTinker »

jolux wrote: post #130
SkyMarshal wrote: post #86

Earlier quoted context omitted.

I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.

1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates. Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.

Parent comment is right about the value of a successful vault exploit. Given the number of people and companies using 1Password now, $100k would likely pale in comparison to an exploit's value on the black market.

Re: Ask HN: Why should I trust password managers?

#152

Post by dogman144 »

kevindong wrote: post #102
ryandvm wrote: post #92

Earlier quoted context omitted.

That is correct and they apparently have the audits to prove it. That said, it's not bulletproof. The chink in the armor is the browser extensions they all use. All it would take is somebody to slip some trojan code into one of the browser extensions and all of the sudden you have a few hundred million decrypted password databases which could trivially be uploaded to wherever.

Could you not argue the same thing for almost any code used by almost any piece of software closer to the metal? e.g. someone manages to slip malicious code into Chrome/Chromium which eventually makes its way out to every Electron app/most browsers, or something gets injected into Windows/macOS/Linux, etc.

On one hand, yes software supply chain vulns are getting difficult to maintain conceptually total coverage of while also maintaining a pleasant environment for developers to productive in.

On the other hand, yes there eventually is a trust point somewhere. A spiral of upstream what-ifs isn't productive IMO, I agree.

Re: Ask HN: Why should I trust password managers?

#153

Post by rewgs »

fsflover wrote: post #139
antihero wrote: post #125

Earlier quoted context omitted.

I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.

> because it’s a company that happily makes money from that trust You could also say this about Microsoft, except they've been breaking such trust for a long time.

That's a pretty obviously bad take. You're comparing a company whose single product is about keeping one kind of thing secure, and another company that makes dozens of products, most of which don't explicitly have to do with security.

Re: Ask HN: Why should I trust password managers?

#154

Post by dogman144 »

steelstraw wrote: post #147
TimTheTinker wrote: post #80

Earlier quoted context omitted.

For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits

That is terribly low for such a critical issue. There are Ethereum L2s that pay out $2M bounties. https://twitter.com/saurik/status/1491821215924690950

That's a bad analogy, although you point out a possibly good thing for L2/crypto - the bug bounties are massive because the projects have a silly amount of funds.

Password managers don't operate with those economic models though.

Re: Ask HN: Why should I trust password managers?

#155

Post by chromanoid »

I once got an account hacked because I reused a password. Since then I only generate passwords and use a SaaS password manager. I got informed about leaked passwords multiple times by the service which saved me time and maybe even money.

Managing them in the cloud is the easiest way to keep the passwords with me. I trust those services because I am lazy, my own solution would just be obscure and self-managed solutions would probably give me headaches in multi-device or multi-user scenarios (I share many passwords with my wife).

With a payed subscription SaaS solution I can expect that the provider has a huge interest in keeping my data safe from criminals. It's their biggest selling point.

Re: Ask HN: Why should I trust password managers?

#156

Post by dehrmann »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

Not sure if this helps or hurts, but the places they're most likely to see a problem are in the clients and automatic browser plugin updates. An attacker doesn't even need to target a password manager directly; they can collect passwords pretty well with any compromised plugin, just not all of the passwords at once.

Re: Ask HN: Why should I trust password managers?

#157

Post by dogman144 »

SkyMarshal wrote: post #88
slooonz wrote: post #81

Earlier quoted context omitted.

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (ak…

> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.

What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?

Re: Ask HN: Why should I trust password managers?

#158

Post by nor-and-or-not »

fugalfervor wrote: post #135
nor-and-or-not wrote: post #115

I use pass[1], which is a command line tool to store gpg encrypted passwords in a local git repo. I share the git repos between different machines using my own servers. All remote mirrors are synced over SSH using git-remote-crypt[2], which additionally encrypts all remotely stored files - including the metadata (e.g. paths and file names of the files) of the remote git repo itself. On mobile I like to torture myself…

Pass will generate QR codes for you, which is much easier than typing the passwords manually. But you have the trust the QR code software and the system clipboard, which is up to you to decide. I really like pass because the source code is short enough, and simple enough, to verify its security to one's own satisfaction.

Thanks for mentioning. I haven't tried that, yet.

Yes, that was my reason to settle on pass as well. Plus it has a healthy community discussing in the mailing list and also many eyes looking at the source.

Re: Ask HN: Why should I trust password managers?

#159

Post by PinguTS »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

For that reason I trust 1Password in the non-SAAS version. The password vault is stored locally and then snchronized between devices via iCloud. So there is no single point. First there needs to be an exploit for iCloud and second to the 1Password vault. The benefit of this is, the vault is a simple website by itself that can be loaded into any webbrowser without the app.

Re: Ask HN: Why should I trust password managers?

#160

Post by jviotti »

You don't need to trust them. I use "pass" (https://www.passwordstore.org), a simple CLI password manager that operates using a GPG key you control (which I have on a Yubikey). Then, you can upload the GPG-encrypted password store wherever your want in order to sync-up your passwords.
Post reply on HN