Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

131–140 of 342 posts

Re: Password Managers

#131

Post by geofft »

kennywinker wrote: post #59
kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

His conclusion seems off to me too. I got "Password managers that use content scripts are bad" not "password managers are bad". Edit: I just cracked open the 1password extension, and it does indeed use a content script. Glancing over the code I only see stuff related to locating which fields are the username and password field - but I was mistaken in thinking that they didn't use a content script.

Yeah, the analysis here lends itself to a pretty simple heuristic: if the input for the password manager ends up on the page itself, the password manager is poorly designed. If the input ends up in a popup from the icon in your tool bar (which you can tell because it will draw a little arrow thingy that crosses past the edge of the web page), it is likely to be well-designed (in this respect).

All the icon on the webpage ought to do is indicate to the password manager that you'd like to use it, nothing else. You shouldn't be typing your master password there, you shouldn't see a list of sites there (perhaps you just see an option for the current web page, that's fine), etc.

1Password follows this rule and has a pretty good track record overall and I too use it. There are certainly password managers that don't follow this rule; don't use them.

Re: Password Managers

#132

Post by jefftk »

Syzygies wrote: post #113

The "attack surface" I worry about is forgetting to lock my screen before going down the hall to get some water, and someone slipping in to obtain a sensitive financial password. I've never succeeded in explaining this to any password manager's tech support. They stay in business because their tools are convenient to use. I've migrated from 1Password to a Dashlane family plan. I use two separate accounts for myself.…

If you're worried about that kind of attack, once someone has access to your computer they can install a key logger. Better to get in the habit of locking your computer every time you stand up.

Re: Password Managers

#133

Post by jefftk »

samsquire wrote: post #87

I don't think you need your password manager to inject the password into a web site for you. I think you can just copy and paste from Keepass. I want account management protocols so I can rotate all my passwords automatically via my password manager. That would be awesome.

A huge advantage of using the one built into the browser is that it will protect you from phishing attacks. It is only going to fill the password if the domain matches. Doing this yourself it's possible to make mistakes, especially with lookalike characters.

Re: Password Managers

#134

Post by jefftk »

ajsnigrutin wrote: post #46

For my parents, i tell them to just write the password down on a piece of paper. If someone breaks in their house,they have a bigger problem than someone reading their emails, and since they live off givernment pensions, there is not a lot of money that can be stolen via the internet.

Sure, but it does not protect against phishing. If they visit something that looks like their bank site, but isn't, they will type in the password from the paper. If they were using a password manager with proper integration it would notice the domain mismatch and refuse to fill.

Re: Password Managers

#135

Post by tunesmith »

thekyle wrote: post #95

> I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. I haven't used the browsers built-in password manager for years, so I don't know what features they have, but I find it hard to believe that they can provide the same functionality as a dedicated password manager. Some of the top features of dedicated pas…

Plus, at least for Safari, it's only protected by the computer password, which is much less secure than the kind of pass phrase that password managers ask for. My mother-in-law has her computer password on a post-it that is stuck to the monitor. Using that, I can go into her browser preferences and see the plaintext value of all her browser-stored passwords. I never use it, myself.

Re: Password Managers

#136

Post by lazide »

chrisweekly wrote: post #118
bstar77 wrote: post #75

Earlier quoted context omitted.

I'm also a 1password customer and curious how the attack vector of spoofing the 1password input icon can harm the user. They might be able to get your master password, but that doesn't mean they gain access to anything. Also, I never use that icon and exclusively use the shortcut. I'm curious if that can be spoofed somehow. But again, they can only get your master password. In the case of 1password, I'm pretty sure t…

"they might be able to get your master password, but that doesn't mean they gain access to anything" I can't be the only one who finds that to be small comfort; isn't it sensible to respond, "if my 1Pwd master pwd is stolen, I must treat the vault as if it had been exposed"?

With the current well designed systems, it isn’t the case however. That password is important (one of several factors), but you can’t get access with only that information. It is also something that is easy to change with no retroactive access abilities.

Re: Password Managers

#137

Post by lazide »

H8crilA wrote: post #80
kennywinker wrote: post #74

Earlier quoted context omitted.

3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into…

2, 3, 4 are handled by Chrome, for example. These really are trivial features that any decent corpo can get right. 1 obviously isn't.

Last I checked I couldn’t export Chrome passwords (aka offline backup), couldn’t add non site passwords, and couldn’t manage non site based passwords/secrets with chrome password manager. And that was a month ago?

Re: Password Managers

#138

Post by Dedime »

paulryanrogers wrote: post #122
Dedime wrote: post #97

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…

> 4. Browser support: KeePassXC-Browser. Allows you to autofill your username / password / TOTP from your KeePassXC application to Chrome / Firefox. I believe the point the article is making is that any browser extension to auto fill is inherently insecure for architectural reasons. I find it odd someone so serious about password managers would recommend KeePassX which hasn't seen a release since 2016. Perhaps they m…

I should probably just switch to using the autotype functionality built in, though much of my security concerns are allayed by the fact that KeePassXC prompts me in the application each time a website requests to use a password.

Re: Password Managers

#139

Post by 33Backpack33 »

kiwijamo wrote: post #102
howolduis wrote: post #84

what about Bitwarden?

My thoughts too. Bitwarden seem to do things differently to the password manager described in the article which perhaps reduces the attack surface.

As far as I can tell Bitwarden doesn't inject any scripts. I know people complain it doesn't have that overlay like LastPass has but Bitwarden not having might be a plus now.

Re: Password Managers

#140

Post by coldtea »

>There are two primary components that make up your browser interface, the chrome (confusingly, the term has nothing to do with Google Chrome) and the content area

Actually it has, since the Google Chrome started as a different "chrome" on top of webkit (hence the name).

Post reply on HN