i am the author of a password manager which you don't have to trust: https://www.ctrlc.hu/~stef/blog/posts/sphinx.html
Ask HN: Why should I trust password managers?
131–140 of 289 posts
Re: Ask HN: Why should I trust password managers?
#132A password manager creates a single point of failure of all your passwords. Nope.
Do you have an unique password for every website? Are they strong passwords? How do you remember them?
Re: Ask HN: Why should I trust password managers?
#133I use a password manager for the hundreds of accounts I have where security is not super important. Mostly as way to not have to reuse passwords (credential stuffing now makes up a significant amount of attack traffic), nor fight the varying password requirements ("shoot, did this website require a special character?"). Tbh, it's nice to have one less thing to worry about. For the increasing number of sites which req…
I leave the really unimportant crap in the Firefox "generate and remember this login", the regular passwords in Bitwarden, and financial passwords in my head.
Answering the original question: I trust that Bitwarden's Github source is what drives their service and that their popularity ensures the source is audited on a regular basis by reasonably skilled software folks. It's the same degree of trust I give to the people that build every reasonably vulnerable product I use: elevators, phones, cars, door/window locks, etc.
-----
For me (and perhaps only me) a more pressing concern is that fingerprint scanning is common in apps that are meant to protect data: banking apps, stock market apps, Bitwarden.
NOBODY makes a significant effort to hide fingertips. Cameras are cheaper, more accurate, and more numerous than ever. People don't clean every surface they touch. It can't be so difficult to 3d print a mold and find the right material to make a false finger.
Android's security model has a nice built-in feature: If you have someone's phone for a few seconds and know their unlock code (not too tough to espy... right, Ye?) you can keep retrying the false finger for that person until it works. Only then do you switch to the important app.
Oh, and... Fingerprints, unlike master passwords, are nearly impossible to change.
Re: Ask HN: Why should I trust password managers?
#134IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target. I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.
Because that's literally the entire point of cryptography, being able to move secret information across an insecure channel.
1Password (and any other mainstream password manager) has no access to your passwords because they're encrypted locally. People who go to extreme lengths to keep an encrypted file secret practice LARP security.
To preempt the question of "how can you trust them to encrypt your stuff though?" The same way you trust Enpass to encrypt your stuff, I'd make a guess 99.9% of users have not personally audited their code.
Re: Ask HN: Why should I trust password managers?
#135I use pass[1], which is a command line tool to store gpg encrypted passwords in a local git repo. I share the git repos between different machines using my own servers. All remote mirrors are synced over SSH using git-remote-crypt[2], which additionally encrypts all remotely stored files - including the metadata (e.g. paths and file names of the files) of the remote git repo itself. On mobile I like to torture myself…
Pass will generate QR codes for you, which is much easier than typing the passwords manually. But you have the trust the QR code software and the system clipboard, which is up to you to decide.
I really like pass because the source code is short enough, and simple enough, to verify its security to one's own satisfaction.
Re: Ask HN: Why should I trust password managers?
#136Earlier quoted context omitted.
> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (ak…
> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.
You can check this fairly easily with https://haveibeenpwned.com/Passwords. It's not exhaustive obviously but it's something.
1Password vaults are also encrypted with a separate secret key that is generated locally and never stored. So you'd need the password and the secret key to decrypt.
Re: Ask HN: Why should I trust password managers?
#137Earlier quoted context omitted.
Do you understand the concept of a password manager? You only have to remember one password, and for that reason people can choose a longer and more complex one. Then your passwords are encrypted using that master password. So people cannot “reverse” your password if you pick a reasonably long master password. For reference, my master password is a 27 character sentence which would take somewhere between a millennium…
This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.
I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for).
Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location.
So should I forget my master password: drive to box 1.
Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone somewhere, and I have access to all my accounts.
Should my password manager go bankrupt overnight and take my vault with them: drive to boxes 1 and 2, then click “forgot my password” on all services and use my e-mail to recover access.
Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them: at least I have my own e-mail domain, so I can set up a new mailbox elsewhere
Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them, and my domain registrar go bankrupt overnight and take my domain with them: yeah…then I’m screwed. I’ll migrate to a wooded country and become a hermit.
Re: Ask HN: Why should I trust password managers?
#138It sounds like to me that there are three types of people: * Layman who reuses passwords unless a techie friend convinces them to use a PW manager. * HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices. * Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they c…
* HN user who doesn't use a password manager and doesn't sync passwords across devices and doesn't reuse passwords (except on throwaway accounts)
Though I would argue that's still setting up your own system to solve the issue of syncing passwords. Whether that be creating your own algorithm to "generate" passwords you can remember or reproduce, keeping them in a notebook, etc.
Re: Ask HN: Why should I trust password managers?
#139Earlier quoted context omitted.
I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust. _Why_ do you trust Bitwarden? I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.
I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.
> because it’s a company that happily makes money from that trust
You could also say this about Microsoft, except they've been breaking such trust for a long time.
Re: Ask HN: Why should I trust password managers?
#140IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target. I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.
Because that's literally the entire point of cryptography, being able to move secret information across an insecure channel. 1Password (and any other mainstream password manager) has no access to your passwords because they're encrypted locally. People who go to extreme lengths to keep an encrypted file secret practice LARP security. To preempt the question of "how can you trust them to encrypt your stuff though?" Th…
Right, there are two reasons to not trust such a program which remotely stores an encrypted blob for you:
1) Not actually understanding the technology or threat model.
2) Having incredibly sensitive information which absolutely cannot leak even by accident, and needs to be handled manually with extreme care. This describes vanishingly few practical scenarios.