Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

111–120 of 342 posts

Re: Password Managers

#111

Post by ramraj07 »

pleb_nz wrote: post #50

Personally using a browser based password manager is too restrictive in that you need a browser to access passwords. I use passwords in a lot of places outside of browsers and often the interface I'm using has no browser capabilities. Understand using browser based password management if you only ever use passwords on the web. But I'm sure a lot of others, like me, need them outside of that context.

"a lot of others" seems unsubstantiated. I'll argue the majority of folks (even technical) rarely need access to passwords outside of the browser. The only times I need a password outside of chrome is my Macs password, and dockerhub but I've memorized just those two.

Occasionally I need the password for Microsoft or intelliJ accounts, but even then I just use my phone to lookup the password in my manager visually and then type it, I'm never letting any password I care about go into my Macs clipboard!

Re: Password Managers

#112

Post by yunohn »

kiwijamo wrote: post #93
pta2002 wrote: post #64

Earlier quoted context omitted.

This used to be the case, but somewhere around Android 7 (might've been 8 or 9) added proper support for autofill services.

Bitwarden doesn't seem to do this even in Android 10. The Bitwarden UX on iOS is fantastic though, it behaves excatly as you'd expect from a native solution. Any examples of good password managers on Android that uses the proper support for autofill?

Bitwarden definitely supports this interface, I use it. You can check which provider is enabled in your system settings.

Re: Password Managers

#113

Post by Syzygies »

The "attack surface" I worry about is forgetting to lock my screen before going down the hall to get some water, and someone slipping in to obtain a sensitive financial password.

I've never succeeded in explaining this to any password manager's tech support. They stay in business because their tools are convenient to use.

I've migrated from 1Password to a Dashlane family plan. I use two separate accounts for myself. I log in to one account to access sensitive financial sites, and log out explicitly before leaving my chair. I log into another account for everything else; do I care if my subscription to the Washington Post gets compromised? That account stays open for convenience.

Each password manager has a theory on how best to offer similar security/convenience with one account. None work as smoothly as having two accounts.

Re: Password Managers

#114

Post by newdude116 »

dogma1138 wrote: post #62

This somewhat overlooks the main threat model that password managers solve - leaked credentials. People can’t remember 80 passwords so they reuse the same one, that password eventually gets leaked and 9/10 times it doesn’t get leaked due to a targeted attack or a compromised machine but rather due to a breach of a service you signed up too. Sure password managers have issues, they don’t solve user related errors and…

Yeah, idiot web programmers that don't encrypt PWs and use salting.

Use a PW manager. If you really don't want to use one, don't use the same PW. At least at your own salt.

eg. HN@thepwialwaysuse4

HN would be the "salt" for Hackernews.

Re: Password Managers

#115

Post by NewEntryHN »

> Second, everyone needs to be using unique passwords. You don’t have to use a password manager to do that, whatever system works for you is fine. If you want to use a notebook in a desk drawer, that’s totally acceptable.

You don't need a notebook for unique passwords. Just use the service's name. Unless you also meant unguessable, in which case a notebook is probably going to be insufficient because your brain-powered password generator will soon run out of entropy.

> The tech press can review usability and onboarding experience, but can’t realistically evaluate any security claims, so how do you propose users tell the difference?

"Security at the expense of usability, comes at the expense of security." Users don't need to know the difference because the only danger they need to protect themselves from is "my gmail was hacked" and the only requirement for that is that they use an un-guessable password saved somewhere unsophisticated attackers can't access. Any password manager accomplishes this.

> An attacker (or malicious insider) in control of the vendor's network can change the code that is served to your browser

Password managers have servers sending code over to the browser? After the installation process?

Re: Password Managers

#116

Post by lamontcg »

jdeibele wrote: post #48

The major problem with the built-in password managers is that they don't store more than the password. If there's a site that has security questions, I use LastPass to keep track of the security questions and my answers. I have to do this because I don't give real answers to security questions. A minor annoyance is that Safari will not let me treat sites which use multiple domains as equivalent. So Discount Tire uses…

> I think it's inevitable that LastPass will continue making life more difficult for free users and I may end up with a flat file or Apple Notes file to store the security questions and answers.

Why not just pay for it? If it prevents a hack which impacts your finances, then its more than worth it and not worth the waste of your time trying to avoid paying them.

Re: Password Managers

#117

Post by shawnz »

Wowfunhappy wrote: post #53

> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. Unfortunately, it also means I can basically never switch web browsers again, so it's an absolute non-option for me. I don't want to be locked into Chrome forever.

I think the only reasonable way to achieve Tavis' conclusion would be for browsers to start providing actual password management APIs for extensions. I agree that locking in all my passwords with my browser vendor would be unacceptable.

Re: Password Managers

#118

Post by chrisweekly »

bstar77 wrote: post #75
kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

I'm also a 1password customer and curious how the attack vector of spoofing the 1password input icon can harm the user. They might be able to get your master password, but that doesn't mean they gain access to anything. Also, I never use that icon and exclusively use the shortcut. I'm curious if that can be spoofed somehow. But again, they can only get your master password. In the case of 1password, I'm pretty sure t…

"they might be able to get your master password, but that doesn't mean they gain access to anything"

I can't be the only one who finds that to be small comfort; isn't it sensible to respond, "if my 1Pwd master pwd is stolen, I must treat the vault as if it had been exposed"?

Re: Password Managers

#119

Post by aflag »

ramraj07 wrote: post #111
pleb_nz wrote: post #50

Personally using a browser based password manager is too restrictive in that you need a browser to access passwords. I use passwords in a lot of places outside of browsers and often the interface I'm using has no browser capabilities. Understand using browser based password management if you only ever use passwords on the web. But I'm sure a lot of others, like me, need them outside of that context.

"a lot of others" seems unsubstantiated. I'll argue the majority of folks (even technical) rarely need access to passwords outside of the browser. The only times I need a password outside of chrome is my Macs password, and dockerhub but I've memorized just those two. Occasionally I need the password for Microsoft or intelliJ accounts, but even then I just use my phone to lookup the password in my manager visually and…

What about mobile phone apps, your bank's pin, steam?

Re: Password Managers

#120

Post by mimimi31 »

ramraj07 wrote: post #108
FooHentai wrote: post #105

Earlier quoted context omitted.

My setup is almost identical, though I skip the browser plugins and let the password manager auto-paste into the browser. Keepass inside GDrive, job done. Very occasionally I'll make a copy out to a portable drive. I've been running this setup for about a decade,since some big breach (I forget which one) made it clear to me that using the same or similar passwords across multiple sites was not gonna fly any longer. T…

After realizing how every program running on your machine can Snoop on your clipboard I'm never allowing any program to send my password to the clipboard again.

Haven't you pretty much already lost when you can't trust the programs running on your machine? If they can snoop on your clipboard, they're probably also able to access your sensitive files, log key presses, take screenshots, install browser extensions etc.
Post reply on HN