Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

281–290 of 342 posts

Re: Password Managers

#281

Post by 3v1n0 »

RealStickman_ wrote: post #274
troyvit wrote: post #258

Earlier quoted context omitted.

I use Bitwarden too, and I self-host it so that vector of attack becomes much smaller. But while Bitwarden doesn't add elements to the page it does alter existing page elements by auto-filling your credentials. If I get it properly the gist of the article is the ability to spoof the fields that receive those credentials. Copying out of Bitwarden and pasting into the visible fields would get around that instead of usi…

Auto-fill is disable by default and you should not turn it on.

The problem is currently that from an UI POV using the icon to complete is a bit annoying, would probably better if a floating complete icon would be added to the fields when a site is recognized. And that should solve the problem, no?

Re: Password Managers

#282

Post by IshKebab »

whereistimbo wrote: post #263
closeneough wrote: post #232

I would NOT recommend the chrome password manager. If you sync your passwords, they will not be stored encrypted at the google side. You need to specifically set password encryption in the settings. I've also spend a lot of time with understanding password managers in my master thesis. What I can recommend is: https://pfp.works/ The creator was auditing password managers like LastPass, found a lot of issues, and used…

Isn't it encrypted using the Google Account credential, if you don't specifically set a password?

It is locally, but server side it is less obvious. They don't really say explicitly but this page strongly suggests that they are encrypted server-side too: https://support.google.com/chrome/answer/10311524

Re: Password Managers

#283

Post by jerjerjer »

Is autosync really that important for people?

I use keepass (so no custom browser extensions at all) and I always register for new accounts on my main device. Then, once enough entries amass I manually copy my database into all the other devices I own - usually once a quarter or even less often. That's it.

Trusting that some third party service would keep your passwords private is a stretch.

Re: Password Managers

#284

Post by tialaramex »

Thorrez wrote: post #236
tialaramex wrote: post #172

Earlier quoted context omitted.

> I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? No. I find it easiest to keep this straight in my head with a line from the U2 song "The Fly", "a secret is something you tell one other person". You're thinking of Ed25519 private keys, you mustn't tell those to anybody and they're minted as a pair with a public key you can tell to ever…

Overall I agree, but couldn't Edward steal the users' Facebook cookies regardless of WebAuthn? I think those last until the user clicks logout, so many of them will last forever. Additionally, Edward can steal the cookies of every user using Facebook for that hour. But he can only steal the passwords of a small fraction of those users, because only a small fraction will start a new session; most users will use existi…

Facebook can invalidate all existing cookies, and with them Edward's access based on cookies. This is slightly inconvenient for users (they are logged out and need to log back in) but it locks Edward out except for where users are relying on passwords alone and Edward knows their password.

You as an individual Facebook user can also invalidate sessions you subsequently realise shouldn't exist and thus the associated cookie. Just realised you're still logged into Facebook on your mother-in-law's laptop that you used for a few minutes this afternoon? Go into Facebook privacy & security settings to see that session shown on a list, then click to log it out. If you are just worried that somebody has cloned your current session by learning the cookie value (I don't know what countermeasures, if any, Facebook use) you can log yourself out and get a new one, which of course invalidates any cloned session.

Re: Password Managers

#285

Post by jeroenhd »

PufPufPuf wrote: post #251

I use Bitwarden, and to my knowledge the issue raised in this article does not apply to it -- all interaction is through the extension's icon, with no UI elements injected into the page itself. Combined with being completely open-source (including backend), full-featured even in the free version, and $10/year pro version (with features like sharing, encrypted storage, etc.), I can recommend it to practically anyone.

BW has had other issues before. For example, it tends to send your credentials with basic auth requests without your knowledge and without a setting to turn it off. The code executed in your browser can also be manipulated to exfiltrate your entire password store once you unlock it if someone gains access to whatever account Bitwarden uses to publish their addon.

Bitwarden is certainly one of the better password managers in my book (seriously, some of its competitors don't even let you add arbitrary fields to credentials!) and has proven to be reasonably secure. However, you cannot ignore the vulnerability the browser extension model or any auto-update model might bring to something as sensitive as a password manager.

I'm using it myself in combination with a self-hosted bitwarden-rs instance (used to run the native version but its performance was just terrible) and I can't say I regret the decision.

I do wish that browser would expose an autofill API to password managers, though, so addons wouldn't need to inject Javascript or do other funky stuff to get passwords filled in.

Re: Password Managers

#286

Post by kiririn »

Dedime wrote: post #97

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…

>Not sure what the options are for Apple, but I'm sure they exist

Strongbox is fantastic on iOS

Re: Password Managers

#287

Post by tialaramex »

KronisLV wrote: post #270
tialaramex wrote: post #172

Earlier quoted context omitted.

> I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? No. I find it easiest to keep this straight in my head with a line from the U2 song "The Fly", "a secret is something you tell one other person". You're thinking of Ed25519 private keys, you mustn't tell those to anybody and they're minted as a pair with a public key you can tell to ever…

This makes me wonder about something else: why not just hash the passwords client side and send the hashed value to the server? Better yet, why not make the hashes salted with something like a timestamp (similarly to how TOTP works), so that those hashes couldn't be reused later? What's inside of the private key is a long secret (albeit not a shared one), a password also feels like it should be a secret that's not sh…

shandor explained why the trivial approach you thought of doesn't work.

But you can actually have what you're asking for. It's called an Asymmetric Password Authenticated Key Exchange or aPAKE. The IRTF is in the process of recommending OPAQUE for this purpose: https://datatracker.ietf.org/doc/html/draft-irtf-cfrg-opaque...

However, given that we're still putting the finishing touches on the OPAQUE recommendation in 2021 and older attempts at this have needed numerous patches to fix unforeseen problems, it is understandable that Tim's toy hypermedia system (which became the Web) did not implement this feature thirty years ago.

Re: Password Managers

#288

Post by kringdom89 »

kiririn wrote: post #286
Dedime wrote: post #97

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…

>Not sure what the options are for Apple, but I'm sure they exist Strongbox is fantastic on iOS

> Strongbox is fantastic on iOS

Yeap, but now you have to trust (there's really no open source on iOS, as there's no reproducible builds or way to verify the code) on some guy and hope for the best.

Re: Password Managers

#289

Post by shawnz »

3v1n0 wrote: post #281
RealStickman_ wrote: post #274

Earlier quoted context omitted.

Auto-fill is disable by default and you should not turn it on.

The problem is currently that from an UI POV using the icon to complete is a bit annoying, would probably better if a floating complete icon would be added to the fields when a site is recognized. And that should solve the problem, no?

No, because adding the floating icon requires injecting code on the page to create the icon. So then the page has a way to interfere with your password manager's UI. That is the problem with the content script approach.

Although if the browser provided a specific mechanism for extensions to create floating icons that couldn't be altered by the page (and you make sure to account for hidden fields and other clickjacking techniques), then that might work.

Re: Password Managers

#290

Post by shawnz »

peteretep wrote: post #248
cordite wrote: post #169

Earlier quoted context omitted.

What if browsers exposed the capabilities to locate the inputs, act upon user input, supply generated passwords, etc. in a sandboxed manner?

Or, even better, no passwords and just sensible pki

A browser-integrated password management API could make for a smoother transition to a future automated auth technology based on public keys, like WebAuthn
Post reply on HN