Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

Post reply on HN
Print view View original

261–270 of 289 posts

Re: Ask HN: Why should I trust password managers?

#261

Post by slightwinder »

HermanMartinus wrote: post #257

I don't trust password managers at all. I ended up creating a trust-less password manager for myself (which generates passwords based on a master password and a service name one-way hashed). You can check it out here (but probably don't use it, I don't want to be responsible for your password security): https://horuspass.com

That's not a password-manager, but a generator with it's own flaws. You must remember what type of password a service is using. If a password is leaked, you must remember the new master password. And it seems to not support crappy services with lenght&char-limit on passwords? So your actual password-manager is the place where you store these informations, probably your brain?

Is there a browser-extension for your tool available? It seems more secure and convenient to integrate this generator directly into the browser. Just enter the masterpassword into the password-field, and let the password be generated in-place. Would remove some attack-vectors and speed up usage. Also, maybe then add some second master password as a general seed, to add personalization for every extension-user?

Re: Ask HN: Why should I trust password managers?

#264

Post by 33Backpack33 »

ciphol wrote: post #70

Why are people talking like the choice is between cloud password managers (potentially insecure) and no password manager (impractical unless you reuse passwords)? There's a third option - a local password manager like the one built into your browser. Its one disadvantage versus the cloud is that you have to reenter your password on each of your devices. For normal people who have maybe 2 or 3 devices and don't change…

For the average person it's best they use a cloud password manager as they're not responsible enough to do their own backups of a local password manager.

Re: Ask HN: Why should I trust password managers?

#265

Post by burntsushi »

npteljes wrote: post #121
burntsushi wrote: post #52

Earlier quoted context omitted.

I think it's just an example to give you a conceptual idea of what 'pass' is doing under the covers. Of course, using 'pass' does not require 'echo'ing your password anywhere. Tangentially, if you precede a command with a space, then it won't show up in your shell history. (Double check to be sure, as this is likely a configurable option of your shell. e.g., 'histignorespace' in zsh.)

I agree with your points, but why showcase a super secure system with a flawed example? Also, so many things can go wrong with this setup, I'm inclined to think that this is one of the upsides of a password manager like KeePass.

No, you appear confused. 'pass' is pretty hard to misuse. It, at no point, makes it easy to put a password into shell history. You're getting caught up in a transcript to showcase the concepts. The actual implementation of 'pass' is quite secure. It does those things for you in a way that is secure, precisely so you don't have to worry about 'echo'ing passwords in plain text.

Re: Ask HN: Why should I trust password managers?

#266

Post by midrus »

Honest question: Why browser's integrated password managers (such as chrome's) are not considered an option for most companies which ask you to use 1password, etc?

Taking out of the equation that maybe google can read your passwords... from the endpoint/laptop point of view itself, is it any less secure than those 3rd party password managers? My understanding is that, for example on OSX, they store them in the OS keychain anyway, right? What's so wrong with that?

Re: Ask HN: Why should I trust password managers?

#267

Post by stepchowfun »

kazinator wrote: post #237
stepchowfun wrote: post #236

Earlier quoted context omitted.

It's a good idea that I've considered. However, I didn't anticipate the need for this when I originally designed Hashpass in 2014, and adding it now would be a breaking change. I'm still considering it, but there would need to be a very slow, very careful rollout plan. Probably some transition period where users can opt into the new scheme, then eventually make the new scheme the default but still support the old sch…

> opt into the new scheme Checkbox: Append common required chars [ ]: @Zz1 The roll out is that this is unchecked by default initially with a warning that the default will be checked. Then eventually it defaults to checked.

Yes, a checkbox is one way to allow users engage with this feature. There are other changes I'm considering as well (e.g., increasing the length of the generated passwords, avoiding characters that look like other characters such as 0 and O, etc.). You have the right idea, but the new experience needs to be designed holistically.

Re: Ask HN: Why should I trust password managers?

#268

Post by mekster »

diarrhea wrote: post #105
andrewaylett wrote: post #73

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing. Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have…

> Extra benefit: if I lose all my infrastructure, I haven't lost my passwords. I just dump the SQL database of Vaultwarden and have that as a backup (it's encrypted). I've verified that a new Vaultwarden instance can be spun up on any Docker-capable machine quickly, the SQL file just needs to be mounted in and named properly. So it's a very localhost-friendly backup with no 'infrastructure' requirements. It can be up…

I suppose you're not saving attachments.

Re: Ask HN: Why should I trust password managers?

#269

Post by junon »

SkyMarshal wrote: post #86
TimTheTinker wrote: post #80

Earlier quoted context omitted.

For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits

I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.

I think you misunderstand how 1password vaults works.

Re: Ask HN: Why should I trust password managers?

#270

Post by GoblinSlayer »

leokennis wrote: post #137
gigglesupstairs wrote: post #129

Earlier quoted context omitted.

This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.

I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for). Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location. So should I forget my master password: drive to box 1. Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone…

But the password to your domain was in the password manager.
Post reply on HN