Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

251–260 of 289 posts

Re: Ask HN: Why should I trust password managers?

#251

Post by RealStickman_ »

ejb999 wrote: post #189
dogman144 wrote: post #157

Earlier quoted context omitted.

What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?

you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.

But that's exactly why you use a password manager; so it can generate passwords for you, while you only need to remember one password to unlock it.

Re: Ask HN: Why should I trust password managers?

#252

Post by leokennis »

CrendKing wrote: post #216
leokennis wrote: post #137

Earlier quoted context omitted.

I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for). Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location. So should I forget my master password: drive to box 1. Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone…

Could you help me understand, that if you are this considerate and comprehensive about your risk factors and prepared at all sorts of possibilities, why still use a password manager solution that can "go bankrupt overnight and take my vault with them"? Why not just use KeePass and manage the vault yourself? If your answer is "I only need to do these safe box things once", then writing your own scripts to sync KeePass…

Because I think my password manager is far more competent in keeping my safe available “in the cloud” than I am in keeping my safe available.

Re: Ask HN: Why should I trust password managers?

#253

Post by tga »

I don’t trust password managers — I use them to store only half of each password. I have a changing algorithm to derive the other half from the site’s name in my head.

This allows me to securely copy paste the first part, then securely type the second part. Also, even if someone has my password database and a full password or two, they still wouldn’t trivially have all the other ones.

Re: Ask HN: Why should I trust password managers?

#256

Post by hughrr »

themadturk wrote: post #227
hughrr wrote: post #193

Earlier quoted context omitted.

Apple keychain?

The only problem with that is you have to be all-in on Apple to make it work. I certainly use it on my MacBook, iPhone and iPad, but I also still use LastPass because my Windows machine doesn't know anything about the keychain.

I carefully eviscerated windows from my life. It’s better that way if you can do it.

Re: Ask HN: Why should I trust password managers?

#257

Post by HermanMartinus »

I don't trust password managers at all. I ended up creating a trust-less password manager for myself (which generates passwords based on a master password and a service name one-way hashed). You can check it out here (but probably don't use it, I don't want to be responsible for your password security): https://horuspass.com

Re: Ask HN: Why should I trust password managers?

#258

Post by timka »

Because others do. Or maybe they make themselves feel like they trust because of the convenience of password managers. After all, we have to draw a line somewhere or just quit using Internet.

IMO if we're talking about security you should ask other questions. How much can you trust a device after Jonathan Brossard's Rakshasa paper? What about evidence-based trust and bunnie's Precursor? Would having a password manager app on Precursor be actually more secure taking into account that your stuff is going to be decrypted on a less protected device?

Re: Ask HN: Why should I trust password managers?

#259

Post by andrewaylett »

cheald wrote: post #188
andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

> which some folk were wishing might have existed for SSL certificates the other day Isn't this basically what HSTS + cert pinning does?

HSTS and pinning (which isn't used on web any more, because it's too much of a foot-gun) help you be sure that you're really talking to who your computer thinks you're talking to. A password manager (or, better WebAuthn) helps you be sure you're talking to the same site that you were talking to when you set up your account.

If you're on the wrong site, all the validity indicators in the world won't help the misidentification. And it needn't even be a malicious site: I auto-fill my work credentials in part so that I don't have to remember which internal tools take which set of credentials. Which isn't nearly as much of an issue nowadays (with more SSO) as it was a few years ago, but that just makes the last few exceptions all the more difficult to remember.

Re: Ask HN: Why should I trust password managers?

#260

Post by throwawayffffas »

geocrasher wrote: post #55

Because my passwords are stored in the cloud but they are only decrypted on my PC. If a nation state or another attacker gets into the password manager I use, they have my encrypted passwords just the same as if they rooted some Linux box I have an account on. The stakes are roughly the same. A passsword manager (PM) makes random passwords easier. A PM keeps me from re-using passwords. A PM gives me a relatively secu…

I would say the stakes are lower if they hack the password manager. If they hack your device they can get them unencrypted when you decrypt them. If they hack the password manager database they will only get encrypted data.
Post reply on HN