Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

331–340 of 342 posts

Re: Password Managers

#331

Post by KronisLV »

xaduha wrote: post #319
KronisLV wrote: post #272

Earlier quoted context omitted.

> Don't cherry pick, read the rest of my comment. It wasn't at all about any individual password complexity, it was about password managers that work with browsers in context of the blog post. That's fair, but the aim of my response was to have a short discussion about the idea behind passwords and the fact that they're sent over the network, maybe someone has any input on that and why that's still such a popular app…

If you're copy-pasting passwords as you mentioned you've already lost 'theoretical hole' game. Everything that has any sort of basic privileges on your machine can read a clipboard as soon as you put something there. > But talking about that wasn't my goal. Too bad, because passwords managers in browsers are the end of the line as passwords go. Vast majority of people wouldn't be copy pasting passwords, not because i…

That is a fair point! Yet it's sad that we live in a world where our apps aren't sandboxed properly and where we have to worry about our own devices being compromised.

However, 2FA really is one of the few solutions that could work here, unless the method used can also be compromised.

Re: Password Managers

#332

Post by KronisLV »

tialaramex wrote: post #307
KronisLV wrote: post #299

Earlier quoted context omitted.

But if the valid hash changes as a function of time (e.g. a time based salt value), does it still matter as much, then? If a stale hash is stolen, then it doesn't allow to log in since it's no longer valid, nor does it allow figuring out the original password. I find it interesting to reason about all of the interesting ways this could still break, as long as the words of Eoin Woods [1] are followed: "Never invent se…

> why aren't certificates the default way to sign up for sites for end users? Some reasons: Initially this doesn't make any sense. Tim's toy hypermedia system (the Web) does not have any of the properties you expect today, it doesn't achieve Confidentiality, nor Integrity, nor Authentication. So it's like you live in a village where they don't have doors yet and you're wondering why there's no locksmith. Once it did…

> ...it's like you live in a village where they don't have doors yet and you're wondering why there's no locksmith.

And yet, technologies like HTTPS have now become mainstream, in part due to pressure from big corporations (like Google search rankings), in part due to technologies to make safe defaults easier (Certbot, web servers like Traefik and Caddy). Surely with time authentication and authorization methods will get a similar treatment?

It's unfortunate that following X.509 best practices would involve sharing personal information, instead of putting a UUID in some field that only has a meaning server side, since most private information is already stored on sites in some capacity, for example, to enable payments.

It's good to know that people have made progress with WebAuthn, though, even if roaming authenticators will probably slow down the adoption a bit.

Re: Password Managers

#333

Post by ubercow13 »

brabel wrote: post #330
ubercow13 wrote: post #268

Earlier quoted context omitted.

Why does that matter if the content script doesn’t have privileged access to anything itself?

Because one can monkey-patch any JS function used by the injected script, as the OP showed, to make the injected script do whatever it wants it to.

By one, you mean the website that the script is running on right? What's a possible attack vector there? I didn't understand how an attack might work from the example in the article.

If the domain of the site is checked by the browser extension outside the content process, injection of the password is initiated by the extension button not a button on the page itself so there is no API the content process has access to, and only the correct password for that domain is provided to the content script, what could the page do exactly that would be a security issue? The content process would just be responsible for receiving any password injected into the page and putting it in the righ place.

Re: Password Managers

#334

Post by dandarie »

Thorrez wrote: post #244
dandarie wrote: post #241

Earlier quoted context omitted.

Yes, he can steal the cookies and new passwords, but still won't have access to user accounts and/or passwords for more than an hour. So, after Edward is discovered, all sessions are remotely logged off and all accounts created during that hour are blocked, asked to confirm their email, phone or even identity, or deleted. So, after one hour, Edward is left with nothing more than braggable rights. And personal data of…

Interesting. But this point seems a bit different than the one tialaramex was making. tialaramex's criticism of passwords was that Edward can use the stolen ones eternally. But if your actions are followed, with Facebook resetting all those users' passwords and forcing them to reconfirm via email or phone, then tialaramex's criticism doesn't really apply anymore. The criticism only applies to users who reused their p…

> The criticism only applies to users who reused their passwords on other sites, because Edward can still attack those other sites.

Of course, but that's a weakness that concerns the user, not the platform.

It is not a flaw of Facebook's security model.

Re: Password Managers

#335

Post by CrendKing »

lnl wrote: post #259
marcan_42 wrote: post #151

Earlier quoted context omitted.

Please don't put TOTP codes or back up codes in password managers. The whole point of 2FA is to have two factors protecting you. If you do that, you're back to 1 factor (your password manager master password).

> you're back to 1 factor (your password manager master password) That's only true if you are using an online service as a password manager, so the master password is the only thing protecting you. Not necessarily for offline password managers. E.g. in my case, I use Keepass that I never sync/store online, so even without enabling a website's 2FA, for many attack models I am effectively using 2FA: logging into the we…

In which case would attacker be able to compromise your password but not the 2FA code? Eavesdropping on an unencrypted channel would be one, but given how ubiquitous https is, it's hardly a concern.

Most likely there would be a breach on the site's database, where all password hashes, and the TOTP seeds are stored. In that case, having 2FA or not doesn't make any difference.

2FA is usually useful if the user is not confidence of the integrity of his login device, e.g. public library computer. If you are perfectly confident of your own device, there isn't really any point of having 2FA.

Re: Password Managers

#336

Post by flemhans »

dogma1138 wrote: post #62

This somewhat overlooks the main threat model that password managers solve - leaked credentials. People can’t remember 80 passwords so they reuse the same one, that password eventually gets leaked and 9/10 times it doesn’t get leaked due to a targeted attack or a compromised machine but rather due to a breach of a service you signed up too. Sure password managers have issues, they don’t solve user related errors and…

This is addressed in the article:

>Second, everyone needs to be using unique passwords. You don’t have to use a password manager to do that, whatever system works for you is fine. If you want to use a notebook in a desk drawer, that’s totally acceptable.

Re: Password Managers

#337

Post by lnl »

CrendKing wrote: post #335
lnl wrote: post #259

Earlier quoted context omitted.

> you're back to 1 factor (your password manager master password) That's only true if you are using an online service as a password manager, so the master password is the only thing protecting you. Not necessarily for offline password managers. E.g. in my case, I use Keepass that I never sync/store online, so even without enabling a website's 2FA, for many attack models I am effectively using 2FA: logging into the we…

In which case would attacker be able to compromise your password but not the 2FA code? Eavesdropping on an unencrypted channel would be one, but given how ubiquitous https is, it's hardly a concern. Most likely there would be a breach on the site's database, where all password hashes, and the TOTP seeds are stored. In that case, having 2FA or not doesn't make any difference. 2FA is usually useful if the user is not c…

The only cases that I can think of are me doing something stupid, like posting my password somewhere public by mistake (e.g. using KeePass password auto-typing on comment field instead of password field, or pasting it in a wrong place if I am copy-pasting), or a phishing attack where I foolishly insist on copy-pasting my password when it doesn't auto-type. But even in those cases, 2FA would indeed be of very limited help since:

1) In the first case, chances are that I would realize this immediately and change my password, which I would have time to do as there is no actual attacker yet; only future opportunistic attackers. 2FA would be useful only if I not only pasted my password and 2FA code, but then not even realized it. Then 2FA might help since by the time anybody notices this, the 2FA code would be invalid.

2) In the second case, if the phishing attack is not real-time (i.e. attackers are just recording my credentials instead of immediately logging in in my place), 2FA would help since the 2FA they stored would be invalid when they tried using it. 2FA is less helpful in a real-time phishing attack; though having 2FA might still help since changing my login credentials would presumably require another 2FA code so at least they can't lock me out (unless they can convince me that I need to enter another 2FA code, which I guess is possible if I was absent-minded enough to fall for it in the first place).

In any case, I don't worry much about these scenarios and I agree with you about 2FA, that's why I don't usually bother with it except in cases where websites freak out because I keep logging in from foreign IPs with no cookies. Then 2FA is useful because it makes the website trust my login, at no additional inconvenience to me as KeePass auto-types 2FA code just like my password, so I don't mind enabling it when I can.

Re: Password Managers

#338

Post by fsflover »

ramraj07 wrote: post #108
FooHentai wrote: post #105

Earlier quoted context omitted.

My setup is almost identical, though I skip the browser plugins and let the password manager auto-paste into the browser. Keepass inside GDrive, job done. Very occasionally I'll make a copy out to a portable drive. I've been running this setup for about a decade,since some big breach (I forget which one) made it clear to me that using the same or similar passwords across multiple sites was not gonna fly any longer. T…

After realizing how every program running on your machine can Snoop on your clipboard I'm never allowing any program to send my password to the clipboard again.

If you care about such things, you should probably use Qubes OS with a dedicated VM storing passwords.

Re: Password Managers

#339

Post by vort3 »

kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

» Good examples of simple and safe password managers are keepass and keepassx, or even pass if you’re a nerd.

» I’m generally skeptical of these online subscription password managers, and that’s going to be the focus of the rest of this article.

I may be wrong but he talks about online password managers only, that's why his conclusion is «if you want a password manager in your browser, sue the one that's built-in». Otherwise, separate password managers are good, but author isn't talking about them.

Re: Password Managers

#340

Post by vort3 »

shp0ngle wrote: post #170
Wowfunhappy wrote: post #53

> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. Unfortunately, it also means I can basically never switch web browsers again, so it's an absolute non-option for me. I don't want to be locked into Chrome forever.

You can export passwords from Chrome / Google passwords.

Firefox can export passwords into CSV as well.
Post reply on HN