Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

231–240 of 289 posts

Re: Ask HN: Why should I trust password managers?

#231

Post by BeefWellington »

cheald wrote: post #188
andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

> which some folk were wishing might have existed for SSL certificates the other day Isn't this basically what HSTS + cert pinning does?

Cert Pinning is more akin to "trust on zeroth use, only this certificate", HSTS is kind of unrelated since all it does it tell the browser to access the site via HTTPS. If the site is on the preload list all that buys you is the first access must be over TLS.

Pinning is more for the app case, HSTS more for the browser case.

Re: Ask HN: Why should I trust password managers?

#232

Post by BeefWellington »

TillE wrote: post #140
Barrin92 wrote: post #134

Earlier quoted context omitted.

Because that's literally the entire point of cryptography, being able to move secret information across an insecure channel. 1Password (and any other mainstream password manager) has no access to your passwords because they're encrypted locally. People who go to extreme lengths to keep an encrypted file secret practice LARP security. To preempt the question of "how can you trust them to encrypt your stuff though?" Th…

Right, there are two reasons to not trust such a program which remotely stores an encrypted blob for you: 1) Not actually understanding the technology or threat model. 2) Having incredibly sensitive information which absolutely cannot leak even by accident, and needs to be handled manually with extreme care. This describes vanishingly few practical scenarios.

I read a story once, which may be apocryphal, about various intelligence services switching back to printed/typewritten records for incredibly sensitive stuff to avoid the possibility of it leaking without having planted a spy.

It seems unlikely to me, but I could imagine situations where that level of concern might make sense.

Re: Ask HN: Why should I trust password managers?

#233

Post by phantomathkg »

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

If your threat model truly think it worth the hassle for you to use KeePass offline and sync offline. Then so be it.

However, given KeePass is still a piece of software, nothing stop state-supported malicious hackers injecting vulnerability into it, and suck your password away into their database.

Have you consider making sure all your computers are offline when using KeePass?

Re: Ask HN: Why should I trust password managers?

#234

Post by nextaccountic »

ramses0 wrote: post #34

https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…

Also, there's a firefox extension https://addons.mozilla.org/en-US/firefox/addon/passff/ (on github: https://github.com/passff/passff)

It requires the user to run a daemon that reads ~/.passwordstore passwords and feed it to the extension https://github.com/passff/passff-host - but the design is pretty transparent to inspection if you're inclined to check

Re: Ask HN: Why should I trust password managers?

#235

Post by rosndo »

zie wrote: post #165
milesvp wrote: post #41

I will tell you a good reason to trust password managers. I know a lawyer who does estate planning. When you start talking about "what happens when I die", passwords are a class of problem that has only gotten worse in the last 2 decades. There are legal ways for estate executors to request passwords, but it is a pain, and can be time consuming. She tends to recommend password managers because they tend to be more co…

I'm pretty sure even after death, it's still technically breaking the law to use someone else's password. So I'm surpised a lawyer would be so open about it, though I agree it definitely makes life 90% easier when it comes up :)

It’s not illegal to use someone else’s password even if all of the parties are alive.

Unauthorized use of someone else’s password may be illegal.

Re: Ask HN: Why should I trust password managers?

#236

Post by stepchowfun »

kazinator wrote: post #229
stepchowfun wrote: post #220

Earlier quoted context omitted.

For those sites, I usually just add whatever characters are needed to satisfy the requirements to the generated password (e.g., 0). This is annoying, since I have to keep track of which sites required such amendments. Fortunately, the majority of websites I use don't have such annoying requirements. And if I ever forget which sites have "amended" passwords, it's easy to find out simply by attempting to log in and bei…

Were the problems with just unconditionally adding small string of all such characters to every password, whether the site needs it or not? generated_password = base64.b64encode(bits).decode()[:16] + '0@#Zz'

It's a good idea that I've considered. However, I didn't anticipate the need for this when I originally designed Hashpass in 2014, and adding it now would be a breaking change.

I'm still considering it, but there would need to be a very slow, very careful rollout plan. Probably some transition period where users can opt into the new scheme, then eventually make the new scheme the default but still support the old scheme, and finally remove the old scheme to make things simple again.

Since this is a Chrome extension which collects no information from users, I have no way of contacting users about this. So I would need to wait long enough that users discover it themselves in the UI. All told, I'd guess it would take about a year for the full migration.

Anyone is welcome to discuss things like this with me via GitHub issues: https://github.com/stepchowfun/hashpass

Re: Ask HN: Why should I trust password managers?

#237

Post by kazinator »

stepchowfun wrote: post #236
kazinator wrote: post #229

Earlier quoted context omitted.

Were the problems with just unconditionally adding small string of all such characters to every password, whether the site needs it or not? generated_password = base64.b64encode(bits).decode()[:16] + '0@#Zz'

It's a good idea that I've considered. However, I didn't anticipate the need for this when I originally designed Hashpass in 2014, and adding it now would be a breaking change. I'm still considering it, but there would need to be a very slow, very careful rollout plan. Probably some transition period where users can opt into the new scheme, then eventually make the new scheme the default but still support the old sch…

> opt into the new scheme

Checkbox:

  Append common required chars [ ]: @Zz1
The roll out is that this is unchecked by default initially with a warning that the default will be checked. Then eventually it defaults to checked.

Re: Ask HN: Why should I trust password managers?

#238

Post by commandersaki »

andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

Yep agreed. I just have a small anecdote. My credentials were stolen when altoira.com was domain hijacked and setup a phishing campaign -- even when using 1Password to manage my credentials.

Thankfully when they restored everything and require a reset of passwords, they offered TOTP 2FA which would provide an additional defence when phishing succeeds.

Re: Ask HN: Why should I trust password managers?

#239

Post by rainbowzootsuit »

tobylane wrote: post #163
reedjosh wrote: post #96

Earlier quoted context omitted.

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

Because it’s a crime for them to make use of the passwords, and I’d be able to claim back any financial loss. I picked Bitwarden because it’s widely trusted, it’s trusted because it’s open source and widely assumed to be casually audited by many _other_ people. There’s a weak point here in how many of us are relying on others to do the audit, in a bystander effect sense. I don’t think either of these are BW specific,…

They've published the results code audits and network audits here:

https://bitwarden.com/blog/bitwarden-network-security-assess...

Re: Ask HN: Why should I trust password managers?

#240

Post by SkyMarshal »

PinguTS wrote: post #159
SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

For that reason I trust 1Password in the non-SAAS version. The password vault is stored locally and then snchronized between devices via iCloud. So there is no single point. First there needs to be an exploit for iCloud and second to the 1Password vault. The benefit of this is, the vault is a simple website by itself that can be loaded into any webbrowser without the app.

Oh that’s cool, didn’t realize 1pw had a self-hosted version, will check it out.
Post reply on HN