Why do people use paid password managers when you can just use firefox's?
Ask HN: Why should I trust password managers?
141–150 of 289 posts
Re: Ask HN: Why should I trust password managers?
#142I use a password manager for the hundreds of accounts I have where security is not super important. Mostly as way to not have to reuse passwords (credential stuffing now makes up a significant amount of attack traffic), nor fight the varying password requirements ("shoot, did this website require a special character?"). Tbh, it's nice to have one less thing to worry about. For the increasing number of sites which req…
This is my approach as well. I see passwords as being in tiers:
- Level 0: the serious stuff that would absolutely suck if it got compromised. Namely Google. Banks.
- Level 1: things that would be an inconvenience if they were compromised. Okay it's annoying that someone got into my Amazon account or something, but this can be dealt with.
- Level 2: passwords my in-laws are going to use to watch Netflix or the like. If this gets compromised... ok, that's a pain for Netflix but this is essentially a victimless situation.
Password managers are really good for the Level 2 stuff. Really, there are too many passwords we need to know. They are okay for the Level 1 stuff, just have an idea who you're going to call. I wouldn't use them for the Level 0 stuff.
Like anything else, you balance your risk against convenience. Approached this way, even if the password manager gets hacked, you're only minorly inconvenienced. Always have 2FA on where allowed and what's the worst that will happen?
Re: Ask HN: Why should I trust password managers?
#143Earlier quoted context omitted.
I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.
1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates. Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.
[deleted]
Re: Ask HN: Why should I trust password managers?
#144Personally, I use pwd managers as a convenience thing. My main accounts (bank, email, git, domain, or any other admin lvl thing) I either memorize or write down irl and use 2fa. Other than that yea I use password managers with the acknowledgement that it may get hacked but so would I at any point too.
Re: Ask HN: Why should I trust password managers?
#145Why do people use paid password managers when you can just use firefox's?
Because my paid Bitwarden account works for every single device I own, for every app I use, for every website I visit, and for every browser that supports plugins. I can host it myself if I need to. I can have a family account to let my wife login and have her own separate passwords on the same sites as me. I can tag and sort and regenerate my passwords seamlessly. I don't have to come up with my own passwords constantly -- just click a few buttons to generate one within the current site's requirements, and hit "save".
Re: Ask HN: Why should I trust password managers?
#146It sounds like to me that there are three types of people: * Layman who reuses passwords unless a techie friend convinces them to use a PW manager. * HN user who either uses a SAAS password manager or sets up their own system to solve the issue of syncing a password store across devices. * Those who actually have state level secrets or living under an oppressive regime and thereby don't trust even the networks they c…
I sort of fall into the second category, except I don't sync passwords across devices or even store them at all. I generate them on the fly with [1]. [1] https://chrome.google.com/webstore/detail/hashpass/gkmegkoip...
Does this have an option to use multiple master passwords? For example accounts 0-10 use password x and 10-20 use password y?
Re: Ask HN: Why should I trust password managers?
#147I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits
That is terribly low for such a critical issue. There are Ethereum L2s that pay out $2M bounties.
Re: Ask HN: Why should I trust password managers?
#148A password manager creates a single point of failure of all your passwords. Nope.
Do you have an unique password for every website? Are they strong passwords? How do you remember them?
Yes. Yes. My secret. (There are many ways to do it, I'm just not going to broadcast what I do.)
Re: Ask HN: Why should I trust password managers?
#149I don't. You can easily set up your own.
Re: Ask HN: Why should I trust password managers?
#150https://www.passwordstore.org/ gpg "make-key" mkdir -p ~/.passwordstore/foo/bar echo "hunter2\nusername: hunter@hunter.com\n" \ | gpg "sign" > ~/.passwordstore/foo/bar/entry.gpg gpg "decrypt" ~/.passwordstore/foo/bar/entry.gpg tree ~/.passwordstore/ -- Basically, "passwordstore" is pretty trustworthy, open source, reasonably inspectable, and kindof automates the above steps in a decent CLI (and has a nice git integra…
Is that "sign" supposed to be "encrypt"?
(yep, sorry)