Ask HN: How do password managers make things better? • Hacker News Board

Re: Ask HN: How do password managers make things better?

#11

Post by drakonka » Sat, Dec 25, 2021, 3:24 PM UTC

To get into a password manager account, you require a secret and your master password. It is a potential point of failure, but less of one than what I tended to do without a password manager: reuse the same passwords across different sites. It would be impossible for me to remember a unique password for every site I'm registered on, so 1Password is just my place to record it.

Having said that as someone else mentioned in this post, your email password reset flows become a point of failure: if someone can get into your email address, they can essentially reset your password to whatever they want. This is why I also enable 2FA on every site I can, and have recently started using unique email aliases per website.

I'm considering getting a couple of YubiKeys instead of using something like Google Authenticator, but not really sure if that would result in a more secure setup overall yet.

Re: Ask HN: How do password managers make things better?

#12

Post by thwasd2 » Sat, Dec 25, 2021, 3:48 PM UTC

jokethrowaway wrote: post #9

thwasd2 wrote: post #6

Well, LastPass is zero-knowledge, even if the databases are leaked, you are safe. Companies are using these for their convenience (AD based access to passwords, without even knowing the actual pswds). Individuals can also have great benefits as they can shuffle their pswds, get notified about weak pswds, or breaches.

If that's true, once you lose your main password you lose everything. It could be mitigated with recovery procedures using a backup code + waiting time, but at that point it wouldn't be zero knowledge.

It’s true: https://support.logmeininc.com/lastpass/help/recover-your-lo...

Re: Ask HN: How do password managers make things better?

#13

Post by darthrupert » Sat, Dec 25, 2021, 3:50 PM UTC

deanebarker wrote: post #3

darthrupert wrote: post #2

Getting your passwords requires two things: the master password (which should be strong) and the password file. Some pw managers add further factors. Most people use simple passwords like cat12345. Or they use more complex passwords but share them between sites. Pw manager fixes that. It's not perfect, but for most of us it's much better than most obvious alternatives.

>the password file I use the online version. There's a browser plugin.

So the encrypted file is perhaps located in two places: in your browser cache and server-side.

Re: Ask HN: How do password managers make things better?

#14

Post by zamalek » Sat, Dec 25, 2021, 4:35 PM UTC

If you are using truly unique passwords everywhere, then your brain is just fine. Good old paper and pen is a seriously secure password manager, and is the modern recommendation.

The only security feature that password managers bring to the table is eliminating password reuse. Some will monitor for breaches, but you can also do that yourself.

There are also conveniences, which is why I use one.

Re: Ask HN: How do password managers make things better?

#15

Post by convolvatron » Sat, Dec 25, 2021, 4:36 PM UTC

nomorecommas wrote: post #4

There are more than two alternatives. Each has their own strengths and weaknesses. None are ideal. encrypted password vault hash-based password generation paper-grid password generation paper password pocketbooks post-it notes on the monitor

when can I actually sign a challenge with my private key instead of trying to deal with this mess?

Re: Ask HN: How do password managers make things better?

#16

Post by jonplackett » Sat, Dec 25, 2021, 4:46 PM UTC

It'a aways a trade off between security and convenience.

The best way I've managed to come up with is to use a password manager but then secure the hell out of it by using hardware keys as a second factor to access it, and only allowing getting around that with a printed out backup key.

This way you have the convenience of all the passwords as you need them on verified devices, but strong security (+ inconvenience) if you want to access them on a new device.

Re: Ask HN: How do password managers make things better?

#17

Post by cypherg » Sat, Dec 25, 2021, 5:05 PM UTC

zamalek wrote: post #14

If you are using truly unique passwords everywhere, then your brain is just fine. Good old paper and pen is a seriously secure password manager, and is the modern recommendation. The only security feature that password managers bring to the table is eliminating password reuse. Some will monitor for breaches, but you can also do that yourself. There are also conveniences, which is why I use one.

Great idea until you lose the paper or something happens to it (natural disaster/burglary/accident). It's also incredibly inconvenient to record 20 character passwords by hand. This is specifically what cloud storage (LastPass/1Password) solve.

Re: Ask HN: How do password managers make things better?

#18

Post by jfax » Sat, Dec 25, 2021, 5:09 PM UTC

I wasn't sure about password managers for a long time, until I read this article by Troy Hunt "Humans are Bad at URLs and Fonts Don’t Matter": https://www.troyhunt.com/humans-are-bad-at-urls-and-fonts-do... - if you give this a skim read you may think this has nothing to do with password managers, but read it to the end.

I won't spoil it, but I will say that everything suddenly clicked in. Password managers solve so many problems at once, including problems we don't intuitively understand. Contrary to other comments here, password managers aren't " a trade off between security and convenience", security is a process and not a tool, and password managers regiment a very important process of password security for regular people.

Re: Ask HN: How do password managers make things better?

#19

Post by throwaway984393 » Sat, Dec 25, 2021, 5:22 PM UTC

Encourages stronger unique passwords, and it's safer than saving passwords unencrypted on disk. That's it.

Re: Ask HN: How do password managers make things better?

#20

Post by xqoiu » Sat, Dec 25, 2021, 5:29 PM UTC

alecbz wrote: post #8

For most accounts your email password is already a single point of failure (password reset flow). Even where that's not true, the tradeoff with a password manager is in strengthening defenses broadly in exchange for a more central point of failure, compared to weak defenses all around but no single point that gives everything away. The idea being that you can remember one, really good high entropy password, vs. havin…

"Don't reuse email addresses" should become as common advice as "don't reuse passwords."

Buy a domain and set up a catch-all email address, use a unique one for each service. Alternative options exist as well (Apple's "Hide My Email" for ex.)

Don't do the "add a plus sign at the end of your username to create unique addresses" thing. You still have a single point of failure and it causes weird bugs in poorly designed email addresses validation.