Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

161–170 of 289 posts

Re: Ask HN: Why should I trust password managers?

#161

Post by jmnicolas »

I'm very low tech : I use a small paper notebook (see link below, I don't know the proper term in English). It's absolutely unhackable unless someone breaks in my house which I'm not too much concerned for (my security profile is "random Joe").

I would not trust something in the cloud.

But at one point you have to trust something, learn to let go or do without.

I'm too lazy to work on the "memory palace" thing, but it might be the best solution: portable, secure, free.

https://media.cultura.com/media/catalog/product/cache/1/imag...

Re: Ask HN: Why should I trust password managers?

#162

Post by mcint »

theptip wrote: post #108

Bruce Schneier has written extensively on the subject (and has written a password manager so he knows what he's talking about): https://www.schneier.com/blog/archives/2019/02/on_the_securi... https://www.schneier.com/blog/archives/2019/06/risks_of_pass...

He's a great security expert.

nit - I wouldn't claim that someone who _has_ written security (password, or cryptography)-related software, is necessarily _qualified_ to, or a trustworthy _expert_ in the field. In security especially, self-proclaimed expertise (as the strongest sales pitch) does not distinguish between respected experts and snake oil salesman.

I would say that he's written several widely read and respected cryptography books, designed widely used algorithms (standards & well-tested candidates), and write about social & technical factors that surround & affect security.

Good links! Thank you!

Re: Ask HN: Why should I trust password managers?

#163

Post by tobylane »

reedjosh wrote: post #96
andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

Because it’s a crime for them to make use of the passwords, and I’d be able to claim back any financial loss.

I picked Bitwarden because it’s widely trusted, it’s trusted because it’s open source and widely assumed to be casually audited by many _other_ people. There’s a weak point here in how many of us are relying on others to do the audit, in a bystander effect sense. I don’t think either of these are BW specific, which just shows there’s a large family of wise options.

Re: Ask HN: Why should I trust password managers?

#164

Post by kabr »

oblio wrote: post #91
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

Mobile devices?

Resilio Sync + Keepass2Android or Keepass Touch (iOS)

Re: Ask HN: Why should I trust password managers?

#165

Post by zie »

milesvp wrote: post #41

I will tell you a good reason to trust password managers. I know a lawyer who does estate planning. When you start talking about "what happens when I die", passwords are a class of problem that has only gotten worse in the last 2 decades. There are legal ways for estate executors to request passwords, but it is a pain, and can be time consuming. She tends to recommend password managers because they tend to be more co…

I'm pretty sure even after death, it's still technically breaking the law to use someone else's password. So I'm surpised a lawyer would be so open about it, though I agree it definitely makes life 90% easier when it comes up :)

Re: Ask HN: Why should I trust password managers?

#166

Post by TameAntelope »

tasha0663 wrote: post #142
0x0000000 wrote: post #16

I use a password manager for the hundreds of accounts I have where security is not super important. Mostly as way to not have to reuse passwords (credential stuffing now makes up a significant amount of attack traffic), nor fight the varying password requirements ("shoot, did this website require a special character?"). Tbh, it's nice to have one less thing to worry about. For the increasing number of sites which req…

This is my approach as well. I see passwords as being in tiers: - Level 0: the serious stuff that would absolutely suck if it got compromised. Namely Google. Banks. - Level 1: things that would be an inconvenience if they were compromised. Okay it's annoying that someone got into my Amazon account or something, but this can be dealt with. - Level 2: passwords my in-laws are going to use to watch Netflix or the like.…

Password managers are by far the safest way to store the level 0 stuff too, fwiw.

Re: Ask HN: Why should I trust password managers?

#168

Post by cookiengineer »

The reason password managers help your opsec is not because they can store passwords..but because they can randomize passwords, too, and per website.

If one of those web services is compromised, the other accounts and credentials stay unaffected.

And humans on the other hand have maybe 2 or 3 passwords based on some imaginitive sense of "how secure and trustworthy" the website is...only to realize later that their paypal password ain't that secure, and that now all other "secured" accounts are compromised, too.

I mean, BreachCompilation and Collection No1-6 have shown us not only the passwords to accounts, but the patterns specific people use once their passwords have been compromised and what they add to their patterns when they are forced to change their passwords after a breach.

And let's just leave it with humans are not good at remembering special characters, and they do like counting a lot.

Re: Ask HN: Why should I trust password managers?

#169

Post by balaji1 »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

for the N number of websites that force me to create accounts, I use an auto-generated password from the password manager and save to the same SaaS password manager. These are for websites I don't care if the passwords get leaked, I can live with the damage. Some have access to credit cards, but meh.

For the old-school (am I young?) websites like mail, fb, bank accounts, etc I remember the passwords.

Seems like a workable compromise for now. Tho I am scared I will start getting lazy and start storing sensitive websites in pwd managers.

Re: Ask HN: Why should I trust password managers?

#170

Post by aborsy »

TillE wrote: post #61
hdjjhhvvhga wrote: post #57

Earlier quoted context omitted.

> they are only decrypted on my PC. The point is, why do you believe it's true?

Why do you trust any software running on your computer? Your password manager is no more likely to have a malicious backdoor than any other program.

It’s more likely indeed. Nobody cares about my editor.
Post reply on HN