Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Double Blind Passwords a.k.a. Horcruxing

kaizoku.dev

Post reply on HN
Print view View original

181–185 of 185 posts

Re: Double Blind Passwords a.k.a. Horcruxing

#181

Post by Ntrails »

peeters wrote: post #132
Ntrails wrote: post #130

> use a horcrux only for the most important logins - your social media, bank accounts etc. Am I the only person who does a huge double take on this? If someone hacks a facebook or a twitter - what precisely am I scared of? My bank accounts are literally my net worth. If they get hacked I'm broke. Why would I want a particularly strong password on Twitter or Facebook or Linkedin for that matter

I wonder if it's implicitly acknowledging that social media (at least Google and Facebook) are authentication providers for thousands/millions of other services. So it's more of a "protect the keys to the kingdom" suggestion for those that use Facebook/Google to sign in to everything (not that I recommend doing that often).

I would 100% consider email under the highly important banner, but I'd not considered at all the "Log In With Facebook" angle.

Re: Double Blind Passwords a.k.a. Horcruxing

#182

Post by Thorrez »

upbeat_general wrote: post #168
Thorrez wrote: post #28

If there's generic malware that's targeting your password manager, then yes this provides protection against that. But it doesn't provide protection against a targeted attack, because the malware can just keylog your horcrux. Another weakness that doesn't require a keylogger, is the attacker might be able to find some stolen database of a website that stored passwords in plaintext, then deduce your horcrux from the d…

True but all of the methods you mention to determine the horcrux are also ways to get someone's typical password, so password manager + horcrux is still much stronger as you need both (besides obviously the keylogger/malware). You could also just have a horcrux for a couple sites and make them all distinct obviously.

Well my thought is that it doesn't take much effort to get a typical password, but does to get a password manager user's password. So an attacker who gets the password from a password manager can probably easily get the horcrux as well.

Re: Double Blind Passwords a.k.a. Horcruxing

#184

Post by posix_me_less »

methodsignature wrote: post #110
posix_me_less wrote: post #98

Earlier quoted context omitted.

> you're just adding friction to a process that should be as frictionless as possible, because friction causes people to make bad decisions Integrating a password manager with a browser is too fragile and risky way of using both. It is best to have them fully separated so they can't communicate. They should communicate exclusively via the user. The login process should have some friction and should not be fully autom…

> Integrating a password manager with a browser is too fragile and risky way of using both. It is best to have them fully separated so they can't communicate. They should communicate exclusively via the user. Which gets targeted more and why, the user or the password manager? If you are suggesting that we should be manually entering passwords into sites as copied/observed from our password managers, that removes the…

You have a point, but I think technical people here are more concerned about buggy or malicious or badly interacting local software than about them falling for such phishing attempts on websites. I may be wrong, and I agree verifying validity of URL is a nice feature. A feature that should be implemented by the browser as well.

Re: Double Blind Passwords a.k.a. Horcruxing

#185

Post by posix_me_less »

SpaethCo wrote: post #153
posix_me_less wrote: post #98

Earlier quoted context omitted.

> you're just adding friction to a process that should be as frictionless as possible, because friction causes people to make bad decisions Integrating a password manager with a browser is too fragile and risky way of using both. It is best to have them fully separated so they can't communicate. They should communicate exclusively via the user. The login process should have some friction and should not be fully autom…

> Integrating a password manager with a browser is too fragile and risky way of using both. It is best to have them fully separated so they can't communicate. They should communicate exclusively via the user. Passwords are about proving identity. Using high entropy passwords for greater confidence of user identity is only part of the equation, the user needs to be able to identify the validity of the service as well.…

Yes it has benefits but also drawbacks; I don't like the tradeoff. You have to give the password manager too great capabilities to achieve the autovalidation+autofill. Maybe if you check and compile the password manager yourself.

Also automating the process entirely means the login process can happen and succeed (or fail and disclose the password to attacker) without the knowledge of the human.

I don't have time for that, so I just run both browser and password manager isolated and copy and paste the password.

Post reply on HN