I'm trying to switch to a better model for personal security. What is the reasonably secure stack for it? I currently use Vaultwarden and AndOTP but have been considering the Password Store and a Yubikey.
Securely Yours, Love Password Managers (2021)
21–30 of 41 posts
Re: Securely Yours, Love Password Managers (2021)
#22It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malware in plain text any time the password database is unlocked. Here are some trivial examples of how malware can steal credentials in bulk. Example: Exfiltrate all plaintext credentials from 1password ``` op list items | jq -r '.[].uuid' | xargs -n1 bash -c 'op g…
Password managers are like the next ransomware target. All your eggs in one basket, doesnt cost much to obtain a selection of the most popular, work out how they work and then just target them.
Re: Securely Yours, Love Password Managers (2021)
#23Given today's cloud hardware availability the leaking of the hash of an 8 character password is only good for a few days. The current reasonable minimum is 12 characters.
I really wish there was a good standard for password length requirements for websites. Far too many sites out there reject longer passwords, or have a strange dislike of a single special character (which of course differs between sites) Let me use 64 character passwords, dammit!
I keep wishing everywhere would allow a length of 256,and the extended ascii set. I know it's overkill, but it makes no practical sense to restrict passwords to a particularly low length, let alone the trend of excluding all but a few special characters.
You'd think this is truly the one thing the industry could agree on, but instead you have sites that restrict you to 12 characters, alphanumeric only.
Re: Securely Yours, Love Password Managers (2021)
#24Maybe I am failing to grok password managers, but I can't get my head around this:
I'm traveling. My phone and laptop are lost or stolen. I am now unable to log in to anything?
Re: Securely Yours, Love Password Managers (2021)
#25Maybe I am failing to grok password managers, but I can't get my head around this: I'm traveling. My phone and laptop are lost or stolen. I am now unable to log in to anything?
Password managers can store your passwords on the cloud as well.
Re: Securely Yours, Love Password Managers (2021)
#26Maybe I am failing to grok password managers, but I can't get my head around this: I'm traveling. My phone and laptop are lost or stolen. I am now unable to log in to anything?
You are fundamentally correct: to make your passwords safe from hackers you are making them harder for yourself to access (in this case by requiring MFA). Accessing your passwords now requires having access to a device (your second factor).
There are recovery mechanisms that you can set up ahead of time (a series of recovery codes for example), but for the most part I would agree with your premise: you will have a very hard time accessing your accounts if you ever lose your primary devices. For me the security benefit is worth the inconvenience.
Re: Securely Yours, Love Password Managers (2021)
#27Maybe I am failing to grok password managers, but I can't get my head around this: I'm traveling. My phone and laptop are lost or stolen. I am now unable to log in to anything?
Password managers can store your passwords on the cloud as well.
True but any password manager in the cloud should require MFA, which means if you lose your devices you’re still stuck.
Re: Securely Yours, Love Password Managers (2021)
#28Earlier quoted context omitted.
I really wish there was a good standard for password length requirements for websites. Far too many sites out there reject longer passwords, or have a strange dislike of a single special character (which of course differs between sites) Let me use 64 character passwords, dammit!
I keep wishing everywhere would allow a length of 256,and the extended ascii set. I know it's overkill, but it makes no practical sense to restrict passwords to a particularly low length, let alone the trend of excluding all but a few special characters. You'd think this is truly the one thing the industry could agree on, but instead you have sites that restrict you to 12 characters, alphanumeric only.
The reason given is usually Denial of Service. The longer passwords create more CPU work on the server multiplied by the number of users logging in or registering accounts. I do not care for that argument. I would much prefer working around potential ddos with proper code segmentation and capacity planning. If it's really an issue then a auth micro-service that predicatively spins up instances or something like that.
Re: Securely Yours, Love Password Managers (2021)
#29Maybe I am failing to grok password managers, but I can't get my head around this: I'm traveling. My phone and laptop are lost or stolen. I am now unable to log in to anything?
You can get around this by backing up your database of passwords onto a pendrive, for example, and then installing the password manager on to a fresh device. You will be able to gain access to your old password file from this if you remember your password.
Re: Securely Yours, Love Password Managers (2021)
#30Earlier quoted context omitted.
A passphrase isn't stronger than a password created using those rules - it's preferable if your strategy is to remember your passwords. The problem is that there are so many logins it's hard to keep track. So the temptation is to start reusing passphrases across sites which is the big no no because every site will be breached eventually, it's just a matter of time. And once your passphrase is compromised attackers wi…
I’m not a security expert, but I have to agree with rob74. I was taught by a mentor that from a computational standpoint, all those typical ‘uppercase/ lowercase/ special character’ rules are worthless. The only thing that makes a password stronger is the length. Now from a human or social engineering standpoint they might make sense. It might make it less likely someone chooses something that could be found using a…
You're right that length is an important factor. Each bit doubles the possible options because there are two symbols (0 & 1). Generally, the possibilities are S^P where S is symbols, P is positions, and ^ raises S to the power P. Except you're not using bits, you're using characters so if you lop of symbols, uppercase, and numbers using only lower case you lose possibilities (reducing S). The number of symbols in printable ASCII is 95 but there are only 26 lowercase letters. See how that changes the number of possibilities:
26^1 = 26 : 26^2 = __676 : 26^3 = _17,576
95^1 = 95 : 95^2 = 9,025 : 95^3 = 857,375
You can see that allowing more characters greatly increases the impact of length.
Your mentor is partly right but your take away papers over the impact of the base.
The passphrase approach [0] is optimized for human memory and I would suggest that for your master password in a password manager but for generated passwords drawing from the greatest set of characters increases security.