Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

211–220 of 342 posts

Re: Password Managers

#211

Post by simondotau »

miked85 wrote: post #193
movedx wrote: post #190

Earlier quoted context omitted.

Then sounds like you're working with a diminished product that's less secure.

I am curious how managing secrets locally is less secure than a cloud based solution?

In principle there’s no difference, but 1Password did happen to improve the security in parallel with their transition to a cloud-centric product.

That being said it’s worth noting that behaviour can be as important as technology. For example if a cloud-centric solution is more convenient, its users are less likely to engage in security compromising behaviours such as copying and pasting passwords, or declining to use a password manager at all outside of their local device context.

Re: Password Managers

#212

Post by movedx »

miked85 wrote: post #193
movedx wrote: post #190

Earlier quoted context omitted.

Then sounds like you're working with a diminished product that's less secure.

I am curious how managing secrets locally is less secure than a cloud based solution?

I was referring to additional piece of secret material required to decrypt the vault. It increases the key length by 128 bits. This is important in the general, overall scheme of things based on how your mother will use the product.

You’re not as good as they are at storing the vault, monitoring it, backing it up, and observing any and all access to that vault and reacting to access that’s not authorised. That’s literally their job and you have to trust someone to do that job well at some point (trust is the backbone of a healthy society)

Of course you can get as good, and better, but the time and energy required would burn hundreds of hours you might consider spending doing something that generates more money, therefore negating any (reasonable) price they put on their product.

Re: Password Managers

#213

Post by fukmbas »

paulryanrogers wrote: post #122
Dedime wrote: post #97

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…

> 4. Browser support: KeePassXC-Browser. Allows you to autofill your username / password / TOTP from your KeePassXC application to Chrome / Firefox. I believe the point the article is making is that any browser extension to auto fill is inherently insecure for architectural reasons. I find it odd someone so serious about password managers would recommend KeePassX which hasn't seen a release since 2016. Perhaps they m…

I know this may be baffling to you but software doesn't need to be updated every week.

Re: Password Managers

#214

Post by cobertos »

dijksterhuis wrote: post #34
hobos_delight wrote: post #23

Earlier quoted context omitted.

I recently moved my passwords from an expired 1Password account to Bitwarden (right at the time they announced linux support actually, which was always the biggest thing I missed). Bitwarden has a FF extension and allows me to use it across mac/windows/linux.

I was looking at Bitwarden yesterday as I've been putting off moving over from LastPass and 1Password seemed weird with importing from it. Is Bitwarden decent enough? The fact that it has a cli, FF extension etc. on a free plan is pretty tempting.

I've been really happy with a friend's self-hosted version of it. Easy to spin up on a local server if I would ever need to as well. Really nice separation of concerns as it relates to the article too. All around happier than LastPass.

Re: Password Managers

#215

Post by oefrha »

cordite wrote: post #169
kennywinker wrote: post #59

Earlier quoted context omitted.

His conclusion seems off to me too. I got "Password managers that use content scripts are bad" not "password managers are bad". Edit: I just cracked open the 1password extension, and it does indeed use a content script. Glancing over the code I only see stuff related to locating which fields are the username and password field - but I was mistaken in thinking that they didn't use a content script.

What if browsers exposed the capabilities to locate the inputs, act upon user input, supply generated passwords, etc. in a sandboxed manner?

That’s how iOS Safari’s Password AutoFill works for both iCloud Keychain and third party password managers. Password managers can also supply a prebuilt list so that Safari handles everything, although custom widget handling user input is also allowed.

https://developer.apple.com/documentation/security/password_...

Edit: Of course it’s not limited to Safari, it works for in-app authentication flows too provided apps integrate it.

Re: Password Managers

#216

Post by charles_f »

Conclusion is that there's a risk with browser extensions, which is pretty much common knowledge at this stage. Don't use them. Bit disappointed in that conclusion, the intro was pitching for more.

Been using keepassxc with auto type, owncloud based replica, a certificate and yubikey for a while now. It's a slight more hurdle than the lastpass and such but also not as blackbox,and the fact that it ain't as much mainstream might make it less susceptible to the mass attacks that we've seen leaking personal data by the gb these past few years

Re: Password Managers

#217

Post by mdaniel »

Ajedi32 wrote: post #182
mdaniel wrote: post #163

Earlier quoted context omitted.

I have that debate inside my head often, but ultimately it boils down that "security" is a spectrum and convenience is on one end of the spectrum. Having all passwords be "asdfasdf" is massively convenient, massively insecure. Having to carry my titan key with me all the time (assuming my suck ass financial institutions even allow WebAuthn) is massively inconvenient, and pretty secure. I'm 100% on board with not usin…

But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?

It seems your threat model just doesn't match mine, and I'm glad you have the emotional energy to pull out your phone to auth to every website. Yes, sure, if some rando joker exfiltrates my 1P vault and keyloggers my machine, fine, they get all the things for all the things, but that's Security Darwinism at work if I allow that to happen

Re: Password Managers

#218

Post by cosmotic »

foobarbazetc wrote: post #40
cosmotic wrote: post #13

The blog suggest using Chrome's password manager. I used MacOS KeyChain as my primary store and Chrome's password manager for my secondary store for years and finally gave up because KeyChain didn't work with Chrome or sync with anything (unless maybe I used iCloud) and Chrome only synced with and worked with Chrome and too often it didn't save passwords properly. For all other browsers, apps, or uses, Chrome passwor…

For what it’s worth, the keychain now syncs with iCloud and across all your Apple devices and it’s end to end encrypted by your system or phone passwords. The password interface in iOS has improved a whole bunch (tells you about weak passwords, reused passwords, etc) but doesn’t support attaching a TOTP to an entry. Which may or may not be a big deal now what everyone is moving to U2F etc.

Until Keychain works with Chrome, Windows and Android, I don't consider it a viable alternative.

Re: Password Managers

#219

Post by cosmotic »

rendall wrote: post #92
cosmotic wrote: post #13

The blog suggest using Chrome's password manager. I used MacOS KeyChain as my primary store and Chrome's password manager for my secondary store for years and finally gave up because KeyChain didn't work with Chrome or sync with anything (unless maybe I used iCloud) and Chrome only synced with and worked with Chrome and too often it didn't save passwords properly. For all other browsers, apps, or uses, Chrome passwor…

> The blog suggest using Chrome's password manager That's not what the article said

The conclusion says to use the browser and that the author uses chrome.

Re: Password Managers

#220

Post by stjohnswarts »

gregwebs wrote: post #195

I think iOS does this right. It helps you get a password from the Bitwarden app when using the browser. No browser extension with injection is required.

I'm going to stick with bitwarden. I'm not really doing anything that makes me a target. I guess someday I may regret it but it's a tradeoff of not being able to use a different password for everything and have a centralized attack point and I choose the latter. I guess it is what it is. I'm not doing anything top secret so I'm guess I'll depend on the security through obscurity that everyone rails against. Also I use 2fa wherever available.
Post reply on HN