Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

181–190 of 342 posts

Re: Password Managers

#181

Post by miked85 »

a10c wrote: post #173
movedx wrote: post #160

Earlier quoted context omitted.

It’s 100% true of the standalone version of 1Password because there is only one version of 1Password - the standalone version. Everything else interacts with it. Your secret key is still required to decrypt passwords via the desktop application (which is the only version - everything else interacts with this.)

I believe he was referring to the old 1Password that let you handle the storage of your encrypted vault (which doesn't incorporate the secret key encryption approach)

Yes, I was - and it still exists and gets updates. 1Password goes out of their way to not promote it though.

Re: Password Managers

#182

Post by Ajedi32 »

mdaniel wrote: post #163
marcan_42 wrote: post #151

Earlier quoted context omitted.

Please don't put TOTP codes or back up codes in password managers. The whole point of 2FA is to have two factors protecting you. If you do that, you're back to 1 factor (your password manager master password).

I have that debate inside my head often, but ultimately it boils down that "security" is a spectrum and convenience is on one end of the spectrum. Having all passwords be "asdfasdf" is massively convenient, massively insecure. Having to carry my titan key with me all the time (assuming my suck ass financial institutions even allow WebAuthn) is massively inconvenient, and pretty secure. I'm 100% on board with not usin…

But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?

Re: Password Managers

#183

Post by ajross »

I just keep a (symmetrically) encrypted secrets file on my main work machine with a strong pass phrase stored in a gpg-agent. It's simple (emacs will happily transcrypt it simply by opening it) and amenable to straightforward backup/duplication wherever I need it, though obviously it does assume a command line and that I'm not exclusively on a phone or whatever (not that that's impossible, but...).

It also has the advantage of scaling in a straightforward way to other secrets that aren't "passwords", like credit card and other account numbers, SSNs for my kids, addresses for relatives who keep moving, etc...

Re: Password Managers

#184

Post by strenholme »

mgerdts wrote: post #180
strenholme wrote: post #176

I do not use a browser-based password generator, because of the Javascript insecurity issues (edit: And because I’ve been using a system like this far longer than online password managers have existed). I use a shell script, with a small C program to handle the core cryptography, to generate secure passwords. I run the password generator in a terminal window, then copy and paste the password in to the site I am tryin…

Or openssl rand -base64 12 If a couple attempts at that doesn't generate a password that satisfies complexity requirements, add, remove, or change a character or two before pasting. Change 12 to a larger or smaller number to change the length of the generated pw.

That works, but doesn’t account for the long-term storage of already used passwords, or for the synchronization of passwords generated on different computers.

The system I use handles long term storage, generates the same password for a given website multiple times (with support for changing the index used to generate a given website’s password for things like password rotation—each index is a completely different password), allows passwords to be regenerated from memory if one memorizes the master key, and allows one to have a secure generated password without there being a record that one has generated a password for a given site.

It has protections against trying to guess the master key based on a generated password and the generated password are themselves difficult to crack (a given password has, by default, 60 bits of entropy, but this can be increased if desired).

The weak links are the master key, and the fact the passwords are placed in the clipboard. I use filesystem encryption to protect the master key and only have the master key in two locations (two: Just in case one SSD or computer dies, I have a backup). Browsers do not allow easy access to the contents of one’s clipboard (this is why one has to use Ctrl+V instead of Edit → Paste when using Google Docs in Firefox), so that attack surface, while there, is limited.

Re: Password Managers

#185

Post by Ajedi32 »

teeray wrote: post #35

It’s irritating to me that there’s no standard integration between password managers and authentication elements on a page. We can do this correctly if we want. Furthermore, I’d love some standard programmatic way to change passwords and communicate complexity and rotation timelines. If I use a password manager anyway, it should just deal with changing my password if some organization decides to use a backwards rotat…

Sounds like you're describing the Credential Management API: https://developer.mozilla.org/en-US/docs/Web/API/Credential_...

Re: Password Managers

#186

Post by miked85 »

movedx wrote: post #160
miked85 wrote: post #157

Earlier quoted context omitted.

This is not true for the standalone version of 1Password.

It’s 100% true of the standalone version of 1Password because there is only one version of 1Password - the standalone version. Everything else interacts with it. Your secret key is still required to decrypt passwords via the desktop application (which is the only version - everything else interacts with this.)

That would be news to me. I have never used a secret key with 1Password and a local vault.

Re: Password Managers

#187

Post by drivebycomment »

thekyle wrote: post #95

> I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. I haven't used the browsers built-in password manager for years, so I don't know what features they have, but I find it hard to believe that they can provide the same functionality as a dedicated password manager. Some of the top features of dedicated pas…

Except for the sharing, Chrome password manager has all others you listed.

Re: Password Managers

#188

Post by mtone »

Ajedi32 wrote: post #182
mdaniel wrote: post #163

Earlier quoted context omitted.

I have that debate inside my head often, but ultimately it boils down that "security" is a spectrum and convenience is on one end of the spectrum. Having all passwords be "asdfasdf" is massively convenient, massively insecure. Having to carry my titan key with me all the time (assuming my suck ass financial institutions even allow WebAuthn) is massively inconvenient, and pretty secure. I'm 100% on board with not usin…

But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?

I would think 2FA-in-masterdb still protects you against some website hacks, most browser exploits and phishing sites, using your password on other potentially compromised devices (public wi-fi, work, etc.) and probably some keylogger scenarios that would miss the database content.

Re: Password Managers

#189

Post by kstrauser »

Ajedi32 wrote: post #182
mdaniel wrote: post #163

Earlier quoted context omitted.

I have that debate inside my head often, but ultimately it boils down that "security" is a spectrum and convenience is on one end of the spectrum. Having all passwords be "asdfasdf" is massively convenient, massively insecure. Having to carry my titan key with me all the time (assuming my suck ass financial institutions even allow WebAuthn) is massively inconvenient, and pretty secure. I'm 100% on board with not usin…

But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?

If a crappy website’s user database gets attacked, the hacker may have my plaintext password stored in it. They may not have my 2FA seed, so there’s at least a chance that the attacker still may not be able to access my account.

I think this is much more likely than an attacker cracking my 1Password vault.

Re: Password Managers

#190

Post by movedx »

miked85 wrote: post #186
movedx wrote: post #160

Earlier quoted context omitted.

It’s 100% true of the standalone version of 1Password because there is only one version of 1Password - the standalone version. Everything else interacts with it. Your secret key is still required to decrypt passwords via the desktop application (which is the only version - everything else interacts with this.)

That would be news to me. I have never used a secret key with 1Password and a local vault.

Then sounds like you're working with a diminished product that's less secure.
Post reply on HN