Live data from Hacker News

Ask HN: Why should I trust password managers?

news.ycombinator.com

281–289 of 289 posts

Re: Ask HN: Why should I trust password managers?

#281
post #280
post #235

Earlier quoted context omitted.

It’s not illegal to use someone else’s password even if all of the parties are alive. Unauthorized use of someone else’s password may be illegal.

how does one go about getting authorization from someone deceased? That's a neat trick! :)

We are discussing a lawyer who does estate planning, that’s something people do before they die.

Re: Ask HN: Why should I trust password managers?

#284

Earlier quoted context omitted.

I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.

Lastpass made money the same way, and look at what happened to Lastpass users.

Yeah but anyone could tell LastPass were extremely lax as a business, their software has always seemed poor quality and their communication is terrible as well. 1Password nails both of these things.

Re: Ask HN: Why should I trust password managers?

#286
post #68

Earlier quoted context omitted.

I do the same thing but worry about a nation state or rich enough hackers to just take over the project and add nefarious code. I’ll never audit the code and make sure it produces the binary I get from the Apple store. So I’ve started adding my own “salt” - I type an extra character or two (same for all passwords) to the end of every password I enter. It’s the easiest way to protect against not being able to trust my…

If the hacker can decrypt your whole password safe and view all your plaintext passwords, I think they'll work out your scheme.

I don’t understand how. If I record that my password for Google is xyzzy, but in reality it’s xyzzy123, and 123 is part of every password but not recorded anywhere (other than my mind), how would they work that out? They’d just see that none of my passwords worked. If there is a weakness to this system please let me know.

Re: Ask HN: Why should I trust password managers?

#287
post #281
post #280

Earlier quoted context omitted.

how does one go about getting authorization from someone deceased? That's a neat trick! :)

We are discussing a lawyer who does estate planning, that’s something people do before they die.

Because of the recent badness that has happened around people dying(identity theft, etc), the SSA and everyone else gets notified when deaths happen, and lock & flag accounts, etc.

Using a deceased person's password, even with this supposed "authorization" is a terrible idea.

There are laws and rules and standards of practice for dealing with this stuff and they should be followed. This lawyer is at best, giving bad advice and at worst, encouraging breaking rules and regulations.

What we all should do is build in plans for our deaths around the time we hit 18, and make sure our heir(s) know what's up. i.e. I have these insurance policies, these bank and credit and investment accounts, etc.

One solution, Fidelity has a free service available for people to help with this: https://www.fidsafe.com/

A piece of paper of course works just as well, assuming your heir(s) know where in the world these papers are.

Re: Ask HN: Why should I trust password managers?

#288
post #256

Earlier quoted context omitted.

The only problem with that is you have to be all-in on Apple to make it work. I certainly use it on my MacBook, iPhone and iPad, but I also still use LastPass because my Windows machine doesn't know anything about the keychain.

I carefully eviscerated windows from my life. It’s better that way if you can do it.

For some of us, it goes beyond personal choice. We have to consider our families and their circumstances as well. My wife and I could do it...if I worked for another employer (I'm fairly close to retirement and am not expecting to go job hunting between now and then) and if our adult children, who share my family password manager account, would only realize they shouldn't be using Windows and Android (and also had the money to throw out their hardware and buy all Apple stuff).

Re: Ask HN: Why should I trust password managers?

#289

Earlier quoted context omitted.

So…security by obscurity.

Nothing wrong with security through obscurity as an extra layer on top of encryption.

Fair point. In the end, all these security measures that we’re using are really just a form of “security through obscurity,” isn’t it. ;-)
Post reply on HN