A Password manager that only has a local "vault" and simply syncs an encrypted file a much safer security wise way to operate.
The BIG question is whether the remote server does any processing of the websites (for spam, malware etc) in which case it decrypts the website name.
That becomes a big temptation to log and on sell. Not the logon password just the address.
Having an emergency access code or method is just another security hole.
Ask HN: Why should I trust password managers?
221–230 of 289 posts
Re: Ask HN: Why should I trust password managers?
#222Earlier quoted context omitted.
I sort of fall into the second category, except I don't sync passwords across devices or even store them at all. I generate them on the fly with [1]. [1] https://chrome.google.com/webstore/detail/hashpass/gkmegkoip...
Does this have an option to use multiple master passwords? For example accounts 0-10 use password x and 10-20 use password y?
Nothing is preventing you from using a different master password for different accounts, but you'd have to keep track of that yourself, since Hashpass doesn't store any state whatsoever. I personally just use a single universal password, which is not as safe but much easier to manage.
Re: Ask HN: Why should I trust password managers?
#223Like most of the posters here, I trust my local password manager (keepass) for the most part (well, if my personal machine is compromised to the point where I don't trust programs running on it, I guess I'm truly boned). I have recently started putting some low-value (social media) passwords in the firefox password store, just for autofill convenience. Does anyone know if there are some massive landmines to this sort…
A long time ago it was the case that browsers would save passwords locally in plaintext. But these days Firefox will encrypt your passwords and host them for you so that they can sync across devices. If you don't trust them there is even an option to host this password server yourself and configure Firefox to point to that instead. The main downside is that the app (Firefox Lockwise) is no longer supported.
Re: Ask HN: Why should I trust password managers?
#224Earlier quoted context omitted.
1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates. Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.
> 1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. Doesn't matter for our case, since it already assumes the database potentially compromisable. The parent's comment concerned whether the "bounty for capturing a flag inside a publicly available encrypted vault" is enough. So the question is not whether the bounty is enough given it's imposs…
The value of such an exploit likely exceeds their valuation.
Re: Ask HN: Why should I trust password managers?
#225Earlier quoted context omitted.
You could use a different password for each service and just write them in a paper notebook. Paper is generally not susceptible to malware or other ways passwords can leak from a local or hosted password manager.
You can't possibly believe that this is a viable alternative.
For some people (when paired with storing the notebook in a physical safe), it is. My parents were using Lastpass but somehow managed to lock themselves out completely and none of the recovery options worked.
For their use case and technical skill, a safely-stored notepad is best.
Re: Ask HN: Why should I trust password managers?
#226I have the exact same question for these ad blocker browser plugins. You go to install one of these things and get a warning that the plugin will:
Access your data for all websites
Read and modify privacy settings
Access browser tabs
Access browser activity
I am less concerned with the password managers, as I actually pay for those.
Remember if it’s free, you are the product.
Re: Ask HN: Why should I trust password managers?
#227Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…
Apple keychain?
The only problem with that is you have to be all-in on Apple to make it work. I certainly use it on my MacBook, iPhone and iPad, but I also still use LastPass because my Windows machine doesn't know anything about the keychain.
Re: Ask HN: Why should I trust password managers?
#228I trust password managers more than my ability to remember a strong, unique password for each of the 200 sites in my password manager, and more than my ability to identify URL phishing attempts 100% of the time. I use Firefox' built-in password manager because it's hard to write a secure content script in an add-on password manager[1], and because Firefox Sync encrypts passwords before uploading them to the web[2]. I also know that, if my password manager is ever breached, my most important accounts are also protected by 2FA.
[1]: https://lock.cmpxchg8b.com/passmgrs.html [2]: https://hacks.mozilla.org/2018/11/firefox-sync-privacy/
Re: Ask HN: Why should I trust password managers?
#229Earlier quoted context omitted.
How does this work with sites that have absurdly strict password requirements? i.e. 8-16 characters, 3+ letters (1+ of which is upper case), 2+ numbers, 1+ special characters (from their curated list only!) I've seen a few financial related sites have requirements like these, and with a typical password generator I can just click 'generate' until one pops out that meets the reqs, and save it.
For those sites, I usually just add whatever characters are needed to satisfy the requirements to the generated password (e.g., 0). This is annoying, since I have to keep track of which sites required such amendments. Fortunately, the majority of websites I use don't have such annoying requirements. And if I ever forget which sites have "amended" passwords, it's easy to find out simply by attempting to log in and bei…
Were the problems with just unconditionally adding small string of all such characters to every password, whether the site needs it or not?
generated_password = base64.b64encode(bits).decode()[:16] + '0@#Zz'Re: Ask HN: Why should I trust password managers?
#230I use SaaS password managers and I don't trust them. That's why I have MFA enabled on all of my accounts and logins can only be authorized through the authenticator app installed on my phone