Ask HN: Why should I trust password managers? • Hacker News Board

Re: Ask HN: Why should I trust password managers?

#241

Post by weq » Fri, Feb 18, 2022, 3:38 AM UTC

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

Password managers just move the the problem somewhere else IMO. Saving passwords with your browser is even worse.

Passwords should not be rotated unless they have been comphremised. Password rotation is the problem, not your password.

Use different teirs of passwords. Have a single password u use for anything that is non-senstive, and then go custom on anything that is. Only login to those sensitive services from 1 devices, forgo your convience. These custom passwords should be very rarely be used and u can come up with some custom way to store / remmeber them. Atleast then i have to spend hours and hours and hours on your box, looking, instead of minutes.

Re: Ask HN: Why should I trust password managers?

#242

Post by andreareina » Fri, Feb 18, 2022, 4:29 AM UTC

reedjosh wrote: post #96

andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

What's the alternative to trusting BW? If it's reusing credentials then you just have to trust them more than any other authenticated service. I'd say that's the model that applies to most people, they're not going to self-host or manually sync between devices.

Why trust BW over other providers? Because of third-party audits and signals of good-faith like open source.

Why trust BW over self-hosting? Well, I don't. Or rather I have more confidence in being able to recover from a failure on my part, nevermind that they're probably less likely to suffer from technical issues.

Re: Ask HN: Why should I trust password managers?

#243

Post by lotsofpulp » Fri, Feb 18, 2022, 4:43 AM UTC

antihero wrote: post #125

reedjosh wrote: post #96

Earlier quoted context omitted.

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.

Lastpass made money the same way, and look at what happened to Lastpass users.

Re: Ask HN: Why should I trust password managers?

#244

Post by BenjiWiebe » Fri, Feb 18, 2022, 4:49 AM UTC

phantomathkg wrote: post #233

SkyMarshal wrote: post #20

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…

If your threat model truly think it worth the hassle for you to use KeePass offline and sync offline. Then so be it. However, given KeePass is still a piece of software, nothing stop state-supported malicious hackers injecting vulnerability into it, and suck your password away into their database. Have you consider making sure all your computers are offline when using KeePass?

Just don't update your password manager. If it's fully offline (and it's a mature product), there's a pretty low chance there'll be an update that you'll actually need.

As time goes on without reported backdoors, the chance that your passwords are safe just gets better.

Re: Ask HN: Why should I trust password managers?

#245

Post by BenjiWiebe » Fri, Feb 18, 2022, 4:51 AM UTC

brokenmachine wrote: post #212

DougN7 wrote: post #68

Earlier quoted context omitted.

I do the same thing but worry about a nation state or rich enough hackers to just take over the project and add nefarious code. I’ll never audit the code and make sure it produces the binary I get from the Apple store. So I’ve started adding my own “salt” - I type an extra character or two (same for all passwords) to the end of every password I enter. It’s the easiest way to protect against not being able to trust my…

If the hacker can decrypt your whole password safe and view all your plaintext passwords, I think they'll work out your scheme.

Unless the hacker mass decrypts a couple million passwords, in which case one person's passwords that don't work for the login bot probably won't catch the hacker's attention.

Re: Ask HN: Why should I trust password managers?

#246

Post by dredmorbius » Fri, Feb 18, 2022, 4:55 AM UTC

steelstraw wrote: post #175

dogman144 wrote: post #154

Earlier quoted context omitted.

That's a bad analogy, although you point out a possibly good thing for L2/crypto - the bug bounties are massive because the projects have a silly amount of funds. Password managers don't operate with those economic models though.

1Password has raised almost $1B. Surely they could put at least $1M toward a critical bounty?

Yes.

Given that the payout is probabalistic and serves business goodwill, I'd argue for a more substantial reward. Possibly secured through a bond or insurance policy.

Re: Ask HN: Why should I trust password managers?

#247

Post by xfer » Fri, Feb 18, 2022, 4:55 AM UTC

Never do any kind of clever scheme with passwords, the other side might be storing in plaintext, have misconfigured logging etc.

My isp does store them in plaintext :), the support person read my password to me while fixing an issue with the account(you can guess which language their webpage is in).

Re: Ask HN: Why should I trust password managers?

#248

Post by dredmorbius » Fri, Feb 18, 2022, 4:56 AM UTC

gunapologist99 wrote: post #209

dogman144 wrote: post #154

Earlier quoted context omitted.

That's a bad analogy, although you point out a possibly good thing for L2/crypto - the bug bounties are massive because the projects have a silly amount of funds. Password managers don't operate with those economic models though.

Password managers unlock hot wallets, and much more besides.

The vault vendor likely isn't exposed to that full liability. But in a business-trust basis, the goodwill is all but certainly worth > $100k.

Re: Ask HN: Why should I trust password managers?

#249

Post by BenjiWiebe » Fri, Feb 18, 2022, 4:57 AM UTC

TameAntelope wrote: post #166

tasha0663 wrote: post #142

Earlier quoted context omitted.

This is my approach as well. I see passwords as being in tiers: - Level 0: the serious stuff that would absolutely suck if it got compromised. Namely Google. Banks. - Level 1: things that would be an inconvenience if they were compromised. Okay it's annoying that someone got into my Amazon account or something, but this can be dealt with. - Level 2: passwords my in-laws are going to use to watch Netflix or the like.…

Password managers are by far the safest way to store the level 0 stuff too, fwiw.

That's what I'm thinking. My level 0 passwords for sure will be in my password manager (except for one of them, for some reason).

Level 2 passwords I'll sometimes just reuse a memorable password.

My password manager is open source and offline, though, so that helps.

Re: Ask HN: Why should I trust password managers?

#250

Post by voltaireodactyl » Fri, Feb 18, 2022, 5:07 AM UTC

SkyMarshal wrote: post #240

PinguTS wrote: post #159

Earlier quoted context omitted.

For that reason I trust 1Password in the non-SAAS version. The password vault is stored locally and then snchronized between devices via iCloud. So there is no single point. First there needs to be an exploit for iCloud and second to the 1Password vault. The benefit of this is, the vault is a simple website by itself that can be loaded into any webbrowser without the app.

Oh that’s cool, didn’t realize 1pw had a self-hosted version, will check it out.

Unfortunately, the self-hosted option is only available in version 7. Version 8 is the current version and does not offer self hosting. 1Password has said they will not offer it in future versions either, so it’s not worth getting set up if self hosting is critical to you.