Password Managers • Hacker News Board

Re: Password Managers

#41

Post by KronisLV » Sat, Jun 05, 2021, 9:48 PM UTC

xaduha wrote: post #22

Passwords are a lost cause. This doesn't mean that you need to give up on using good practices, just don't go overboard trying to plug all the theoretical holes. It's not all or nothing, sometimes it's OK to be good enough. For everything important you oughta use 2FA anyway.

> Passwords are a lost cause.

I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they?

What's to prevent me from using a similarly long, randomly generated secret as my password, using a different one for every site? Because that's what I'm doing with KeePass.

Backing up the auth database/file and having enough redundancy in place, as well as having a sufficiently secure master password take some effort, but the rest is just copying and pasting those long secrets when you want to log in.

Of course, 2FA is a necessity for everything important as well, but it feels to me like the kinds of passwords that many people use are the problem, not the concept of passwords.

Re: Password Managers

#42

Post by quesera » Sat, Jun 05, 2021, 9:48 PM UTC

makach wrote: post #20

First of all, a very interesting topic! Author is obviously someone with a lot of knowledge. Nevertheless he is employed at Google( https://en.wikipedia.org/wiki/Tavis_Ormandy ) and recommends Chrome? ..combined with lack of references and research material this all seems a little bit sus to me.

> I use Chrome, but the other major browsers like Edge or Firefox are fine too. They can isolate their trusted UI from websites, they don’t break the sandbox security model, they have world-class security teams, and they couldn’t be easier to use.

This is about as low-key of a recommendation as you can construct.

Curious that he omits Safari though.

Re: Password Managers

#43

Post by foobarbazetc » Sat, Jun 05, 2021, 9:49 PM UTC

devoutsalsa wrote: post #36

One attack vector is consolidating all your passwords into a password manager, and then being able to unlock the password manager on your phone w/ biometrics (e.g. face, fingerprint).

You still have to unlock your phone and any competent password manager makes you type the password at least once and has options for how often you have to.

If someone has your phone and your phone passcode you’re kind of hosed anyway.

Re: Password Managers

#44

Post by ajsnigrutin » Sat, Jun 05, 2021, 9:50 PM UTC

xaduha wrote: post #22

Passwords are a lost cause. This doesn't mean that you need to give up on using good practices, just don't go overboard trying to plug all the theoretical holes. It's not all or nothing, sometimes it's OK to be good enough. For everything important you oughta use 2FA anyway.

One half of 2FA is a password.... saying 1/2 of that is a lost cause is stupid.

Passwords are great, because they're in your head and can be changed at will (unlike biometrics), and phishing 2fa from (eg old people) is not any harder than phishing for a password.

Re: Password Managers

#45

Post by nicoburns » Sat, Jun 05, 2021, 9:52 PM UTC

KronisLV wrote: post #41

xaduha wrote: post #22

Passwords are a lost cause. This doesn't mean that you need to give up on using good practices, just don't go overboard trying to plug all the theoretical holes. It's not all or nothing, sometimes it's OK to be good enough. For everything important you oughta use 2FA anyway.

> Passwords are a lost cause. I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? What's to prevent me from using a similarly long, randomly generated secret as my password, using a different one for every site? Because that's what I'm doing with KeePass. Backing up the auth database/file and having enough redundancy in place, as well as ha…

There is a difference between passwords and certificates: you have to send the password over the network every time you login, whereas the private key is never shared.

But in general I agree with the rest of your comment.

Re: Password Managers

#46

Post by ajsnigrutin » Sat, Jun 05, 2021, 9:53 PM UTC

For my parents, i tell them to just write the password down on a piece of paper.

If someone breaks in their house,they have a bigger problem than someone reading their emails, and since they live off givernment pensions, there is not a lot of money that can be stolen via the internet.

Re: Password Managers

#47

Post by scrollaway » Sat, Jun 05, 2021, 9:57 PM UTC

ferdowsi wrote: post #4

It's curious that we haven't seen dedicated effort towards a consistent password autofill API in browsers, like what is present in Android. Even the Credential Management API seems to have not picked up traction for passwords, though it was extended for use with FIDO2 security keys.

Is there one present in Android? My understanding is password managers on Android and iOS abuse a11y interfaces. (I'm not a mobile dev)

Re: Password Managers

#48

Post by jdeibele » Sat, Jun 05, 2021, 9:57 PM UTC

The major problem with the built-in password managers is that they don't store more than the password. If there's a site that has security questions, I use LastPass to keep track of the security questions and my answers. I have to do this because I don't give real answers to security questions.

A minor annoyance is that Safari will not let me treat sites which use multiple domains as equivalent. So Discount Tire uses dt.com and discounttire.com but Safari flags this as a security problem because I'm using the same password with both. LastPass lets me set them as equivalent domains, though the process is probably too difficult for most people.

LastPass made free users decide whether to use it either on computers or phones & tablets but not both. Because I use FireFox on my Mac, I used LastPass on computers. I rely on Safari to sync for my phone and tablet. I think it's inevitable that LastPass will continue making life more difficult for free users and I may end up with a flat file or Apple Notes file to store the security questions and answers.

Re: Password Managers

#49

Post by devoutsalsa » Sat, Jun 05, 2021, 9:58 PM UTC

foobarbazetc wrote: post #43

devoutsalsa wrote: post #36

One attack vector is consolidating all your passwords into a password manager, and then being able to unlock the password manager on your phone w/ biometrics (e.g. face, fingerprint).

You still have to unlock your phone and any competent password manager makes you type the password at least once and has options for how often you have to. If someone has your phone and your phone passcode you’re kind of hosed anyway.

Well someone can drug you and use your face while you’re passed out, but they can’t make your unconscious self share your pin code. This all assumes your attacker doesn’t think to just scare you into sharing by threatening you with a hammer.

I was actually thinking more about law enforcement being the most likely to try gaining access to your phone. They can make you use your face or fingerprint, but they can’t force you to reveal your pin code.

Re: Password Managers

#50

Post by pleb_nz » Sat, Jun 05, 2021, 9:59 PM UTC

Personally using a browser based password manager is too restrictive in that you need a browser to access passwords.

I use passwords in a lot of places outside of browsers and often the interface I'm using has no browser capabilities.

Understand using browser based password management if you only ever use passwords on the web. But I'm sure a lot of others, like me, need them outside of that context.