Password Managers • Hacker News Board

Re: Password Managers

#11

Post by RcouF1uZ4gsC » Sat, Jun 05, 2021, 9:00 PM UTC

> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions.

What would be really great if the major browser vendors would get together and come up with a way to reliable, secure, cross-browser syncing of passwords.

The main reason I use a password manager instead of the browser’s password storage is because I use different browsers both on the same device and an different devices. I might use Firefox in my Linux desktop and Safari on my Mac. Using a third-party password manager allows me to have the same set of shared passwords on both.

Re: Password Managers

#12

Post by arkadiyt » Sat, Jun 05, 2021, 9:07 PM UTC

prophesi wrote: post #10

tl;dr: browser extensions are bad therefore all password managers are bad Also find it odd the author uses Chrome, which doesn't even let you set a master password to E2E encrypt its password store.

That's not true, you can set a sync passphrase which e2e encrypts your synced content (all of it, not just passwords).

Re: Password Managers

#13

Post by cosmotic » Sat, Jun 05, 2021, 9:07 PM UTC

The blog suggest using Chrome's password manager. I used MacOS KeyChain as my primary store and Chrome's password manager for my secondary store for years and finally gave up because KeyChain didn't work with Chrome or sync with anything (unless maybe I used iCloud) and Chrome only synced with and worked with Chrome and too often it didn't save passwords properly. For all other browsers, apps, or uses, Chrome password manager is useless.

Fortunately I could export Chrome to CSV and use some third party applescript to export KeyChain and import into KeePassXC. It's not perfect but it's better than the built in stuff.

Maybe W3C could standardize a protocol for password managers so we don't have this insane vendor lock in.

Re: Password Managers

#14

Post by tomger » Sat, Jun 05, 2021, 9:12 PM UTC

Given this advice I would - turn off any webpage integration LastPass does - still use LastPass to store my passwords in the cloud so I can share passwords between iOS apps and web.

Re: Password Managers

#15

Post by A4ET8a8uTh0 » Sat, Jun 05, 2021, 9:12 PM UTC

After building my new rig, I also made a successful jump from Windows 7 to PopOS. It was mostly a very smooth transition, but I am having real problems with replacing Password Safe I used on Win.

I eventually defaulted to using FF for passwords, but it still feels wrong. Password Safe had password generators, space for notes.. lil things that I keep missing.

Re: Password Managers

#16

Post by stunt » Sat, Jun 05, 2021, 9:13 PM UTC

If you are paranoid enough, you would think of Password Managers as an obvious must-have business to tap into for the NSA.

Re: Password Managers

#17

Post by chrisan » Sat, Jun 05, 2021, 9:13 PM UTC

> This problem is pervasive among online password managers, you can never be sure if you’re interacting with a website or your password manager.

Isn't this true for any scenario, password manager or not? If a site has been compromised without you knowing and you enter your password from memory, paste, or a password manager, that password is at risk.

Is the author saying that he is able to access ALL passwords in the password manager via a single malicious site?

Re: Password Managers

#18

Post by randomlurking » Sat, Jun 05, 2021, 9:14 PM UTC

dtx1 wrote: post #6

This does not reallz discuss offline password managers like keepassx except for this one sentence > Conceptually, what could be simpler than a password manager? It’s just a trivial key-value store. In fact, the simplest implementations are usually great. Good examples of simple and safe password managers are keepass and keepassx, or even pass if you’re a nerd. I think keepass synched via nextcloud is a great solution…

What’s is the difference between keepass synced by X and another service which is completely online? Simplified with keepass I have a) the database and b) an online accessible Location for storage. If I use Bitwarden, I still have a) and b), right? So for keepass to be better it would need to be better (as in safer) for one of those. I’m not sure if that’s the case (you can even selfhost both Bitwarden and nextcloud to have „trusted“ storage, although it shouldn’t matter). But: if you don’t need multiple devices, Keepass is the surest choice.

With that in mind, I’m rolling with Bitwarden (maximal security afaik and great usability - it’s even linked with my iPhone) for personal stuff and keepass for work as I only have one machine I need passwords on. I don’t like Setting up something to sync a file if I don’t need to, so I’d never use keepass for multiple devices

Re: Password Managers

#19

Post by 1cvmask » Sat, Jun 05, 2021, 9:16 PM UTC

I worked on the design of adding passwordless 2fa to the Saas Pass password manager. In addition the saas pass password manager identifies websites that you can add 2FA to as well.

Re: Password Managers

#20

Post by makach » Sat, Jun 05, 2021, 9:17 PM UTC

First of all, a very interesting topic! Author is obviously someone with a lot of knowledge. Nevertheless he is employed at Google(https://en.wikipedia.org/wiki/Tavis_Ormandy) and recommends Chrome? ..combined with lack of references and research material this all seems a little bit sus to me.