Why traditional password managers are flawed • Hacker News Board

Re: Why traditional password managers are flawed

#61

Post by tzs » Thu, Jul 06, 2017, 4:50 PM UTC

Speaking of password management, it would make it a lot more convenient if website login pages supported single field login. What I mean by single field login is allowing both the username and the password in the same field, so that a single copy/paste from the password manager to the browser could fill in both.

Suggested implementation: provide separate username and password fields that work normally when both are filled, but if the username field is empty then check the password field for something of the form username/password (or something like that, details depending on the username and password rules for the site).

Re: Why traditional password managers are flawed

#62

Post by jhasse » Fri, Jul 07, 2017, 1:06 PM UTC

w8rbt wrote: post #59

jhasse wrote: post #12

GUI implementation with this approach: https://bixense.com/pwcalculator/

The java version of dpg is a GUI.

My bad, sorry. I only took a look at the C++ version.

Re: Why traditional password managers are flawed

#63

Post by w8rbt » Fri, Jul 07, 2017, 1:40 PM UTC

epistasis wrote: post #30

$ dpg "The sentence" word Doesn't this store all your secret info in your .bash_history file, an unencrypted plain text file, with a convenient marker for finding it in the history file? This is no better than just storing the password that DGP generates directly; it's deterministic and trivial to derive the password. For somebody concerned about a "master password" being insecure, this is a far far worse solution.

The purpose of the C++ implementation is to test and validate the other implementations. Use the Python or Java versions.

Re: Why traditional password managers are flawed

#64

Post by tptacek » Fri, Jul 07, 2017, 4:59 PM UTC

tzs wrote: post #61

Speaking of password management, it would make it a lot more convenient if website login pages supported single field login. What I mean by single field login is allowing both the username and the password in the same field, so that a single copy/paste from the password manager to the browser could fill in both. Suggested implementation: provide separate username and password fields that work normally when both are f…

This is unlikely to happen. Big sites spend effort to avoid confusion or surprise on login pages. They could add a new password-manager login page, but all the major password managers already have logic to do the two pastes into the two fields, so what would be the point?