Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

271–280 of 342 posts

Re: Password Managers

#271

Post by anka-213 »

closeneough wrote: post #232

I would NOT recommend the chrome password manager. If you sync your passwords, they will not be stored encrypted at the google side. You need to specifically set password encryption in the settings. I've also spend a lot of time with understanding password managers in my master thesis. What I can recommend is: https://pfp.works/ The creator was auditing password managers like LastPass, found a lot of issues, and used…

They did the thing that Tavis complained about: "No need to trust us, your data stays on your device (safely encrypted)"

You still need to trust that the software is secure.

Re: Password Managers

#272

Post by KronisLV »

xaduha wrote: post #55
KronisLV wrote: post #41

Earlier quoted context omitted.

> Passwords are a lost cause. I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? What's to prevent me from using a similarly long, randomly generated secret as my password, using a different one for every site? Because that's what I'm doing with KeePass. Backing up the auth database/file and having enough redundancy in place, as well as ha…

Don't cherry pick, read the rest of my comment. It wasn't at all about any individual password complexity, it was about password managers that work with browsers in context of the blog post. Out of curiosity, what does haveibeenpwned.com say about your most used email?

> Don't cherry pick, read the rest of my comment. It wasn't at all about any individual password complexity, it was about password managers that work with browsers in context of the blog post.

That's fair, but the aim of my response was to have a short discussion about the idea behind passwords and the fact that they're sent over the network, maybe someone has any input on that and why that's still such a popular approach.

As for the exact topic of the post, password managers within browsers feel too limiting as opposed to standalone software like KeePass, which can be used for desktop applications, servers (including certificate storage) and anything else, really. But talking about that wasn't my goal.

> Out of curiosity, what does haveibeenpwned.com say about your most used email?

"Good news — no pwnage found!"

Mostly due to using about 10 different e-mails for different purposes and throwaways for questionable sites.

Re: Password Managers

#273

Post by chalst »

fredsted wrote: post #269

I've always found password manager browser extensions to be finicky and brittle. They never really seem to work all that good, and as the author writes, the security is bad. I much prefer just copying the credentials from another application.

The clipboard itself is part of the attack surface.

Re: Password Managers

#274

Post by RealStickman_ »

troyvit wrote: post #258
PufPufPuf wrote: post #251

I use Bitwarden, and to my knowledge the issue raised in this article does not apply to it -- all interaction is through the extension's icon, with no UI elements injected into the page itself. Combined with being completely open-source (including backend), full-featured even in the free version, and $10/year pro version (with features like sharing, encrypted storage, etc.), I can recommend it to practically anyone.

I use Bitwarden too, and I self-host it so that vector of attack becomes much smaller. But while Bitwarden doesn't add elements to the page it does alter existing page elements by auto-filling your credentials. If I get it properly the gist of the article is the ability to spoof the fields that receive those credentials. Copying out of Bitwarden and pasting into the visible fields would get around that instead of usi…

Auto-fill is disable by default and you should not turn it on.

Re: Password Managers

#275

Post by movedx »

rdpintqogeogsaa wrote: post #260
movedx wrote: post #162

Earlier quoted context omitted.

I don’t blame him for trying to be punchy — you don’t get noticed otherwise, to be honest.

It's taviso. He makes a new blog post and it's on the front page of HN regardless of its content.

My comment was of a general nature, obviously.

Re: Password Managers

#276

Post by ramraj07 »

aflag wrote: post #119
ramraj07 wrote: post #111

Earlier quoted context omitted.

"a lot of others" seems unsubstantiated. I'll argue the majority of folks (even technical) rarely need access to passwords outside of the browser. The only times I need a password outside of chrome is my Macs password, and dockerhub but I've memorized just those two. Occasionally I need the password for Microsoft or intelliJ accounts, but even then I just use my phone to lookup the password in my manager visually and…

What about mobile phone apps, your bank's pin, steam?

Typically the non browser based passwords are one-time entries anyway - how many times have you had to enter a steam password? And most browser based managers provide an app as well.

Re: Password Managers

#277

Post by baobabKoodaa »

closeneough wrote: post #232

I would NOT recommend the chrome password manager. If you sync your passwords, they will not be stored encrypted at the google side. You need to specifically set password encryption in the settings. I've also spend a lot of time with understanding password managers in my master thesis. What I can recommend is: https://pfp.works/ The creator was auditing password managers like LastPass, found a lot of issues, and used…

The instructions on PFP website for how to do various things, they often begin with the following steps:

> Click PfP icon on any website

> Enter your master password

Can't a website just fake a PFP icon to induce you to reveal your master password, and now the website owner has access to all of your generated passwords? Isn't this exactly the type of attack that caused taviso to write OP?

Re: Password Managers

#278

Post by shandor »

KronisLV wrote: post #270
tialaramex wrote: post #172

Earlier quoted context omitted.

> I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? No. I find it easiest to keep this straight in my head with a line from the U2 song "The Fly", "a secret is something you tell one other person". You're thinking of Ed25519 private keys, you mustn't tell those to anybody and they're minted as a pair with a public key you can tell to ever…

This makes me wonder about something else: why not just hash the passwords client side and send the hashed value to the server? Better yet, why not make the hashes salted with something like a timestamp (similarly to how TOTP works), so that those hashes couldn't be reused later? What's inside of the private key is a long secret (albeit not a shared one), a password also feels like it should be a secret that's not sh…

Everything you described is still a shared secret. Hashing your password client side is just a way to create a random, shared password. Yes, an attacker has a much harder time getting to your password, but they don't need to if it's the hash that's the one the server knows and checks against.

Asymmetric cryptography with its Math Magic IS the solution industry came up with.

Re: Password Managers

#279

Post by dogma1138 »

gruez wrote: post #72
542458 wrote: post #67

Earlier quoted context omitted.

The point is that while yes, many 3rd party password managers have issues, the overwhelming majority of attacks are not against password managers but against reused passwords - so honestly either the 1st or 3rd party choice is a win over using neither.

That's only because there are more people who reuse passwords than people who use online password managers. As they're becoming popular, more cybercriminals are going to exploit it.

Attacking password managers is still a scalability problem, there would be always better targets out there to gain access to credentials.

Sure if you are in a position that your threat model includes actual targeted attacks then you need to reconsider things. But then software password managers might not be the way to go regardless.

A lot of security advice needs to be taken in the context it was given - that context is always a specific threat model(s).

Writing down passwords in an office is a terrible idea, keeping a small book with passwords in a drawer in your study is quite fine for most people.

Security is always a trade off between different threat models, anything you do reduces the likelihood of ones and increase the likelihood of others.

Encrypting the laptop reduces the chance of some random person extracting data if the device is lost or stolen, also to some extent reduces the chances of it being successfully searched by law enforcement. It does however increases the chances of a threat agent torturing you or your loved ones for access.

Now this isn’t an argument to not use device encryption, unless ofc the threat of violence is actually real at that point neither option might actually be viable and you would look for other means to store and transport data other than an encrypted device.

Re: Password Managers

#280

Post by aflag »

ramraj07 wrote: post #276
aflag wrote: post #119

Earlier quoted context omitted.

What about mobile phone apps, your bank's pin, steam?

Typically the non browser based passwords are one-time entries anyway - how many times have you had to enter a steam password? And most browser based managers provide an app as well.

The bank pin is more common, steam and other apps not very frequent. The less frequently you type in a password, the more you need a password manager, though. I also tend to store numbers like national insurance (it's a number not dissimilar to social security number), credit cards and such in my password manager (keepass).

I do agree you can open your browser up and check, if you have that handy. But I'm happy with not having to open a full blown browser to get to my secrets and not sharing even my non-browser related secrets with mozilla, google or apple. Anyway, my point was just that there are lots of places that are not web pages that you need to provide passwords to. And I'd actually say that people who aren't techy are more likely to have more than those, than, say, web developers, who tend to do everything on the browser.

Post reply on HN