Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

241–250 of 342 posts

Re: Password Managers

#241

Post by dandarie »

Thorrez wrote: post #236
tialaramex wrote: post #172

Earlier quoted context omitted.

> I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? No. I find it easiest to keep this straight in my head with a line from the U2 song "The Fly", "a secret is something you tell one other person". You're thinking of Ed25519 private keys, you mustn't tell those to anybody and they're minted as a pair with a public key you can tell to ever…

Overall I agree, but couldn't Edward steal the users' Facebook cookies regardless of WebAuthn? I think those last until the user clicks logout, so many of them will last forever. Additionally, Edward can steal the cookies of every user using Facebook for that hour. But he can only steal the passwords of a small fraction of those users, because only a small fraction will start a new session; most users will use existi…

Yes, he can steal the cookies and new passwords, but still won't have access to user accounts and/or passwords for more than an hour.

So, after Edward is discovered, all sessions are remotely logged off and all accounts created during that hour are blocked, asked to confirm their email, phone or even identity, or deleted.

So, after one hour, Edward is left with nothing more than braggable rights. And personal data of billions, but not their passwords.

Re: Password Managers

#242

Post by wyclif »

Wowfunhappy wrote: post #53

> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. Unfortunately, it also means I can basically never switch web browsers again, so it's an absolute non-option for me. I don't want to be locked into Chrome forever.

Why wouldn't you just use `pass`?

Re: Password Managers

#243

Post by Kiro »

thekyle wrote: post #95

> I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. I haven't used the browsers built-in password manager for years, so I don't know what features they have, but I find it hard to believe that they can provide the same functionality as a dedicated password manager. Some of the top features of dedicated pas…

The built-in password manager in Chrome does all of those things, except maybe sharing but it's possible that it supports that as well.

Re: Password Managers

#244

Post by Thorrez »

dandarie wrote: post #241
Thorrez wrote: post #236

Earlier quoted context omitted.

Overall I agree, but couldn't Edward steal the users' Facebook cookies regardless of WebAuthn? I think those last until the user clicks logout, so many of them will last forever. Additionally, Edward can steal the cookies of every user using Facebook for that hour. But he can only steal the passwords of a small fraction of those users, because only a small fraction will start a new session; most users will use existi…

Yes, he can steal the cookies and new passwords, but still won't have access to user accounts and/or passwords for more than an hour. So, after Edward is discovered, all sessions are remotely logged off and all accounts created during that hour are blocked, asked to confirm their email, phone or even identity, or deleted. So, after one hour, Edward is left with nothing more than braggable rights. And personal data of…

Interesting. But this point seems a bit different than the one tialaramex was making.

tialaramex's criticism of passwords was that Edward can use the stolen ones eternally. But if your actions are followed, with Facebook resetting all those users' passwords and forcing them to reconfirm via email or phone, then tialaramex's criticism doesn't really apply anymore. The criticism only applies to users who reused their passwords on other sites, because Edward can still attack those other sites.

Re: Password Managers

#245

Post by mackrevinack »

Dedime wrote: post #97

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…

auto-type is much more secure than using the companion keepassxc browser extension to fill your passwords since it didn't need a connection between your browser and your password manager. it also removes the chance of some dodgy website having a username and password box off screen and using it to trick the atuofill feature.

one minor inconvenience with auto-type is that your passwords don't auto fill by themselves, but I have it set to the hotkey alt+x which makes it quick to trigger with my thumb and after doing it this way for nearly 2 years now i barely notice

another downside with auto-type is that not all websites put their full names in the browser title bar so auto-type won't show you your related passwords in some cases. to fix that you can install a browser extension that puts the full web url in titlebar https://github.com/erichgoldman/add-url-to-window-title

Re: Password Managers

#246

Post by Kiro »

irrational wrote: post #224

Was this written in 2021 or 2001? How could someone in 2021 not even mention mobile at all? I need a password manager that will work across all of my devices and browsers, not just a single browser on a single desktop machine.

Chrome's password manager works seamlessly across devices and all mobile apps.

Re: Password Managers

#247

Post by jasdine817 »

marcan_42 wrote: post #151
thekyle wrote: post #95

> I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. I haven't used the browsers built-in password manager for years, so I don't know what features they have, but I find it hard to believe that they can provide the same functionality as a dedicated password manager. Some of the top features of dedicated pas…

Please don't put TOTP codes or back up codes in password managers. The whole point of 2FA is to have two factors protecting you. If you do that, you're back to 1 factor (your password manager master password).

I manage a password manager for an MSP that supports hundreds of Azure tenancies with dozens of engineers. 2FA codes in the password manager in a shared space is far safer than a non synchronised account with no 2FA. Since the TOTP code is not accessible too, it also means that password manager breaches are time limited.

Just depends on your use case.

Re: Password Managers

#248

Post by peteretep »

cordite wrote: post #169
kennywinker wrote: post #59

Earlier quoted context omitted.

His conclusion seems off to me too. I got "Password managers that use content scripts are bad" not "password managers are bad". Edit: I just cracked open the 1password extension, and it does indeed use a content script. Glancing over the code I only see stuff related to locating which fields are the username and password field - but I was mistaken in thinking that they didn't use a content script.

What if browsers exposed the capabilities to locate the inputs, act upon user input, supply generated passwords, etc. in a sandboxed manner?

Or, even better, no passwords and just sensible pki

Re: Password Managers

#249

Post by Ayesh »

Wowfunhappy wrote: post #53

> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. Unfortunately, it also means I can basically never switch web browsers again, so it's an absolute non-option for me. I don't want to be locked into Chrome forever.

I use Firefox on PC and Chrome on Android. Firefox Lockwise.in Android implements an Android auto complete API to add autocompletion for passwords everywhere in Android.

Re: Password Managers

#250

Post by oefrha »

CyberRage wrote: post #227
kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

You're wrong. you can exploit browser extensions without escaping sandbox. In fact, LastPass and others had some pretty embarrassing vulnerabilities that can be exploited due to being an extension. There's no question that a local PM has a significantly lower attack surface. Here are some stories: https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso... https://www.csis.dk/newsroom-blog-overview/2021/moserpass…

> https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso...

That’s a clickjacking vulnerability. Gp post discussed why UI should be out-of-DOM.

> https://www.csis.dk/newsroom-blog-overview/2021/moserpass-su...

I’m not familiar with the password manager here, but that's a CDN compromise causing auto-update to download a malicious dll. Of course voluntarily installing malicious code is a game-over scenario unrelated to the discussion, and I’m not even sure there’s a browser extension involved here. What’s the point you’re trying to make?

Post reply on HN