Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

141–150 of 342 posts

Re: Password Managers

#141

Post by throwaway192874 »

NewEntryHN wrote: post #115

> Second, everyone needs to be using unique passwords. You don’t have to use a password manager to do that, whatever system works for you is fine. If you want to use a notebook in a desk drawer, that’s totally acceptable. You don't need a notebook for unique passwords. Just use the service's name. Unless you also meant unguessable, in which case a notebook is probably going to be insufficient because your brain-power…

> Password managers have servers sending code over to the browser? After the installation process?

Yes, LastPass is all web based IIRC, even 1Password switched to a web based offering when they switched to a subscription model. I'm still a happy customer of their previous product which was a one time purchase and uses software installs instead, database synced with w/e you want (Dropbox, GDrive, etc)

Re: Password Managers

#142

Post by accrual »

ramraj07 wrote: post #108
FooHentai wrote: post #105

Earlier quoted context omitted.

My setup is almost identical, though I skip the browser plugins and let the password manager auto-paste into the browser. Keepass inside GDrive, job done. Very occasionally I'll make a copy out to a portable drive. I've been running this setup for about a decade,since some big breach (I forget which one) made it clear to me that using the same or similar passwords across multiple sites was not gonna fly any longer. T…

After realizing how every program running on your machine can Snoop on your clipboard I'm never allowing any program to send my password to the clipboard again.

I think it would be great if major OSs offered an "$app copied/pasted from clipboard" notification like iOS.

Re: Password Managers

#143

Post by throwaway192874 »

raldi wrote: post #83
gruez wrote: post #81

Earlier quoted context omitted.

The ui of the password manager, as demonstrated in the demo.

What parts of the UI of the password manager? What do the clicks actually do? The demo doesn't show that; it just shows the mouse being followed by a "(i)". So what? What does clicking "(i)" do?

it would have the password manager insert the password into some element on the page, and then probably send that password off to some site for exfill, but it wouldn't show you it's doing any of this

the image attached to this issues actually shows an example, using an alert to show you the JS had access to your PW https://bugs.chromium.org/p/project-zero/issues/detail?id=14...

Re: Password Managers

#144

Post by miedpo »

I think this guy is missing one reason you definitely want to run browser based password managers, especially at a business. And that is... phishing. Not every one is tech savy enough to notice a phishing site and some phishing sites are hard to notice even for those who are aware. Browser based password managers fix this problem. Yes, the browser vendor and the password manager vendor are weak points, but it's oftentimes safer than dealing with phishing especially for those not as aware of it as you are.

Also the other guy who mentioned re-used passwords has another good point.

Re: Password Managers

#145

Post by throwaway192874 »

freitasm wrote: post #7
freitasm wrote: post #2

Malicious site

Sorry, to clarify Norton raised an alert on this domain. So proceed with caution.

fyi Tavis is a very well known and respected security researcher from Project Zero, and this is his site so it's nothing to worry about :) I mean he _could_ hack everyone if he wanted but he'd pretty quickly be in a whole lot of trouble

You can see that he links to this as his site on Twitter here: https://twitter.com/taviso

Interestingly, I wonder if Norton doesn't like it since the name is related to an old vulnerability. From his site:

> Q. What is the origin of your domain name?

> There was a bug in early Pentiums called the f00f bug, it would cause a deadlock if you used in invalid operand with cmpxchg8b with the lock prefix. It was an important vulnerability at the time, and I thought it would be fun to own lock.cmpxchg8b.com.

Re: Password Managers

#146

Post by throwaway192874 »

As it looks like Tavis isn't hanging out and responding to comments here, I thought it'd be worth linking to a question and response he gave on Twitter as most comments revolve around this point.

> @diractelda: Based on your thoughts, it seems a more accurate statement is "Don't use a password manager that interacts with your browser automatically unless it's the built in password system. Non-integrated password stores are fine."

> @tavis: Yep, that's a fair summary, I was just trying to be punchy

https://twitter.com/taviso/status/1401253440622235649?s=20

Re: Password Managers

#147

Post by yowlingcat »

I get that poorly designed non-native password managers introduce extra attack surface, but to conclude that no non-native ones should be used is absolutist, lazy thinking that doesn't seem rooted in reality at all. As other commenters have stated, password managers solve the password reuse problem. More crucially IMO, they solve the password reuse problem /for organizations/ -- the importance of this cant be understated.

The content script attack surface issues simply matter less than the giant gaping hole from password reuse combined with spear-phishing and breaches. Anything that makes it easier for the wetware at scale to do the more secure thing is going to increase overall org security by a step function and is a valuable layer. That it's not infallible shouldn't mean it should be discarded.

Frankly, I find this article irresponsible. Imagine some organization follows the advice here and actually weakens their overall security posture by following its advice. That would be unfortunate.

Re: Password Managers

#148

Post by askvictor »

pleb_nz wrote: post #50

Personally using a browser based password manager is too restrictive in that you need a browser to access passwords. I use passwords in a lot of places outside of browsers and often the interface I'm using has no browser capabilities. Understand using browser based password management if you only ever use passwords on the web. But I'm sure a lot of others, like me, need them outside of that context.

Chrome's password manager syncs to your Google account, which will allow you to use it apps on your (android) phone. I would suspect that Apple's ecosystem has similar functionality.

Re: Password Managers

#150

Post by a10c »

chrisweekly wrote: post #118
bstar77 wrote: post #75

Earlier quoted context omitted.

I'm also a 1password customer and curious how the attack vector of spoofing the 1password input icon can harm the user. They might be able to get your master password, but that doesn't mean they gain access to anything. Also, I never use that icon and exclusively use the shortcut. I'm curious if that can be spoofed somehow. But again, they can only get your master password. In the case of 1password, I'm pretty sure t…

"they might be able to get your master password, but that doesn't mean they gain access to anything" I can't be the only one who finds that to be small comfort; isn't it sensible to respond, "if my 1Pwd master pwd is stolen, I must treat the vault as if it had been exposed"?

Not really. At least not in the 1Password case.

Having access to the 1Passswrd Master Password and your entire encrypted vault still doesn't get the attacker what they need. To decrypt your vault, you also need to know the 128 bit secret key which is also used in the encryption strategy that is stored offline (e.g. on a piece of paper in your safe or via another already authenticated device)

https://support.1password.com/secret-key-security/

Post reply on HN