Why do you trust that your car wont explode when you turn it on in the morning? Or, that you food is not actually poisoned? Same reasons apply.
Ask HN: Why should I trust password managers?
271–280 of 289 posts
Re: Ask HN: Why should I trust password managers?
#272Earlier quoted context omitted.
What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?
you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.
You should probably think a little more critically about password managers.
You don't reuse passwords at all. That is expressly the point of password managers. You generate a new password that is completely random and quite long for each independent website.
If one of the sites is breached, no matter. Damage is contained to that site. The only password of yours that is leaked for that site. The only place that password can be used is - you guessed it - that site.
Re: Ask HN: Why should I trust password managers?
#273Earlier quoted context omitted.
Your argument has nothing to do with cloud storage or password managers generally and seems to be an argument against automatic updates. So, fine, disable automatic updates (although I'd argue you're safer with them). I also baked in the presumption that the software isn't malicious in my comment and called it out. So, sure, yes malware that leaks your password can exist. That doesn't really have any effect on whethe…
I use 1password7 in a mode where I have to manually sync my vault. I've used other tools to prevent 1password from initiating any network connectivity at all.
And what threat model does this satisfy?
Re: Ask HN: Why should I trust password managers?
#274I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everyt…
I’m in the boat as well, I don’t quite trust SaaS managers and ultimately settled on KeePassXC. I also host my own mailinabox though, so my database is synced on my personal Nextcloud across my devices.
In addition to a master passphrase, I also use a keyfile for keypass, so even if the database is compromised I would hope that it’s still not useful without the keyfile.
Re: Ask HN: Why should I trust password managers?
#275I'm actually scared about trying password managers, they might actually be infiltrated and release your sensitive information?
Re: Ask HN: Why should I trust password managers?
#276Earlier quoted context omitted.
I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.
> because it’s a company that happily makes money from that trust You could also say this about Microsoft, except they've been breaking such trust for a long time.
Microsoft exists in an effective duopoly for desktop computing - the vast majority of desktop computers run Windows, and only a small fraction run MacOS, and an even tinier fraction run anything else.
That, combined with a host of other lock-in factors (the strong emotional attachments that people have to being a "PC person" and not a "Mac person", the relative expensiveness of devices that run MacOS, the software that only runs on Windows, the UX difference between platforms) put Windows in an entirely different class than password managers.
Password managers are a commodity. Operating systems are not. Microsoft knows this, and they abuse it accordingly.
Re: Ask HN: Why should I trust password managers?
#277Earlier quoted context omitted.
> Extra benefit: if I lose all my infrastructure, I haven't lost my passwords. I just dump the SQL database of Vaultwarden and have that as a backup (it's encrypted). I've verified that a new Vaultwarden instance can be spun up on any Docker-capable machine quickly, the SQL file just needs to be mounted in and named properly. So it's a very localhost-friendly backup with no 'infrastructure' requirements. It can be up…
I suppose you're not saving attachments.
I am, these are in a separate directory that needs to be treated analogously. It's also pretty painless. Still, if you just want to save your ass, the DB is probably what one is after.
Re: Ask HN: Why should I trust password managers?
#278Earlier quoted context omitted.
What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?
you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.
A master password is the only pw in a PWM at real risk of reuse.
However, without placing too much unwarranted trust in the user, consider the following:
- extensive warnings during user onboarding about how to approach setting and safe keeping of the master password, especially around reuse.... ok, but some users are still hopeless with this, what then
- taking Lastpass for instance, lock-out features for logging into the extension if you're coming out of a new geo-ip (proactive risk control)
- taking LP again, alerting to the user for successful logins to the platform from new geo-ips (reactive risk control).
- all the on-device security controls required to get into a PWM: touch/face-id logins for the apps, an official browser extension, on and on. I'd also imagine LP security is watching HIBP very closely.
Put all that together, odds are you or the PWM security teams are able to filter pretty well for password reuse for master passwords. So yes I'd expect sources/stats to be out there, or at least counterpoints to the above which when put together map a decent defense-in-depth for PWMs which isn't present in most or almost any browser extensions, to include Tier 1 cryptocurrency browser extensions which are responsible for significant more funds and still maintain good security (think: Metamask).
Re: Ask HN: Why should I trust password managers?
#279Earlier quoted context omitted.
Depends on the cost/benefit. 3x security engineers to detect/respond vulns and attacks is less expensive but gets similar coverage plus a lot of other work capacity, for instance.
What cost? There is literally zero cost. Unless a successful attack actually occurs, in which case it's literally almost priceless in terms of their reputational damage, unless they can get their hands on it before someone else.
Although PWMs would get a reputation hit from a breach, there isn't any precedent yet for a high-trust software being breached publicly and what happens to their reputation.
But, if you ask around enough with security teams at the large cloud providers, there are definitely rumors of APT-level activity being detected/blocked at the infra level. Yet, cloud is still the most secure option out there vs. on-prem in 90% of the use cases for it so to speak. Similarly, there is just too much precedent of high trust firms being breached, and nothing really happening to them as a result (fines, loss of users, etc).
So, you allocate $1mil, possibly spend it, and either way can't use it for anything else, or you allocate a fixed cost of $600k/yr and get a lot more out of it on the security front, to include solid defense-in-depth, detections, and IR capabilities for if/when the successful PWM attack finally occurs. Personally, yes probably worth putting out a hefty bounty, but pragmatically you'd get more out of hiring the engineers.
Re: Ask HN: Why should I trust password managers?
#280Earlier quoted context omitted.
I'm pretty sure even after death, it's still technically breaking the law to use someone else's password. So I'm surpised a lawyer would be so open about it, though I agree it definitely makes life 90% easier when it comes up :)
It’s not illegal to use someone else’s password even if all of the parties are alive. Unauthorized use of someone else’s password may be illegal.
how does one go about getting authorization from someone deceased?
That's a neat trick! :)