Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Bitwarden Acquires Passwordless.dev

bitwarden.com

Post reply on HN
Print view View original

371–380 of 399 posts

Re: Bitwarden Acquires Passwordless.dev

#371

Post by manmal »

fluidcruft wrote: post #293
manmal wrote: post #165

Earlier quoted context omitted.

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

How is 1Password's secret key more secure than using keepass's key file feature?

That depends where you store that file. Is there a way to store this securely in a mobile device for use on the go?

Re: Bitwarden Acquires Passwordless.dev

#372

Post by manmal »

DavideNL wrote: post #332
fluidcruft wrote: post #293

Earlier quoted context omitted.

How is 1Password's secret key more secure than using keepass's key file feature?

Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key. Anyways, it depends on the app you use. Some Keepass apps haven't even been audited for example, so security of those apps may be questionable.

> Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key.

How would you remember a password of 128bit of entropy?

Re: Bitwarden Acquires Passwordless.dev

#373

Post by manmal »

notesinthefield wrote: post #173
manmal wrote: post #165

Earlier quoted context omitted.

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Keepass has Key Files as a part of the spec https://keepass.info/help/base/keys.html On my devices, keyfiles and a KP client are stored locally. The DB rests in the cloud.

Is that kind of file storage secure? I thought files stored on disk can be extracted quite easily?

Re: Bitwarden Acquires Passwordless.dev

#374

Post by manmal »

phonebucket wrote: post #233
manmal wrote: post #165

Earlier quoted context omitted.

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

But in the context of a strong master password, the additional benefit of the secret key is of neglible benefit, while the hassle and dangers of having to synchronise the secret key remain. I'd rather use an extremely high entropy master password by itself.

How do you remember a 128 bit entropy password?

Re: Bitwarden Acquires Passwordless.dev

#375

Post by dagw »

manmal wrote: post #372
DavideNL wrote: post #332

Earlier quoted context omitted.

Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key. Anyways, it depends on the app you use. Some Keepass apps haven't even been audited for example, so security of those apps may be questionable.

> Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key. How would you remember a password of 128bit of entropy?

9-10 words chosen at random from a list of 10k common words in you native language will get you to 128 bits. Sure not trivial to memorise, but far from impossible.

Re: Bitwarden Acquires Passwordless.dev

#376

Post by manmal »

DavideNL wrote: post #225
manmal wrote: post #165

Earlier quoted context omitted.

Services like 1Password are often more secure than your solution because they need to harden vaults against full leaks. In the case of 1Password, a secret key in addition to the password ensures that brute forcing is (at the moment) not feasible, even if your password is really crappy.

Note that 1Password copies the "Secret Key" to iCloud... without asking.

Do you mean iCloud keychain? That's arguably one of the most secure cloud storage in existence.

Re: Bitwarden Acquires Passwordless.dev

#377

Post by DavideNL »

manmal wrote: post #376
DavideNL wrote: post #225

Earlier quoted context omitted.

Note that 1Password copies the "Secret Key" to iCloud... without asking.

Do you mean iCloud keychain? That's arguably one of the most secure cloud storage in existence.

Yes. And no, because it depends on how users setup and use their AppleID and its passwords/security/devices.

My only point is, if 1Passwords decides to share the private key with [whichever cloud service] the user should at least be notified, or get a choice.

Re: Bitwarden Acquires Passwordless.dev

#378

Post by manmal »

dagw wrote: post #375
manmal wrote: post #372

Earlier quoted context omitted.

> Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key. How would you remember a password of 128bit of entropy?

9-10 words chosen at random from a list of 10k common words in you native language will get you to 128 bits. Sure not trivial to memorise, but far from impossible.

You're not wrong of course - this would come with heavy UX issues though. E.g. it's hard to type 10 words into a password field without messing up. And _really_ hard on a mobile device.

1P would allow you to have a password like "1234" and still have the same key entropy as that 10 word password alone.

Re: Bitwarden Acquires Passwordless.dev

#379

Post by DavideNL »

manmal wrote: post #372
DavideNL wrote: post #332

Earlier quoted context omitted.

Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key. Anyways, it depends on the app you use. Some Keepass apps haven't even been audited for example, so security of those apps may be questionable.

> Or, simply a password for your Keepass database with the same entropy as 1Passwords secret key. How would you remember a password of 128bit of entropy?

Here's a 142bits entropy password: CorrectHorseBatteryStaple

Also see: https://xkcd.com/936/

Re: Bitwarden Acquires Passwordless.dev

#380

Post by manmal »

DavideNL wrote: post #377
manmal wrote: post #376

Earlier quoted context omitted.

Do you mean iCloud keychain? That's arguably one of the most secure cloud storage in existence.

Yes. And no, because it depends on how users setup and use their AppleID and its passwords/security/devices. My only point is, if 1Passwords decides to share the private key with [whichever cloud service] the user should at least be notified, or get a choice.

> And no, because it depends on how users setup and use their AppleID and its passwords/security/devices.

Can you elaborate what the issue would be? I see that the AppleID password could be a weak link, but that's mostly mitigated by 2FA.

> if 1Passwords decides to share the private key

I'm not aware that they could do that. Their servers have no knowledge of either the password or secret key. Authentication happens via a zero-knowledge proof.

Post reply on HN