Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password managers less secure than promised

ethz.ch

Post reply on HN
Print view View original

71–80 of 87 posts

Re: Password managers less secure than promised

#71

Post by Aardwolf »

hleszek wrote: post #51
63 wrote: post #27

The article is nearly useless for users of the software who want to know how their data may have been affected. The researchers' website is more descriptive, especilly wrt specific findings. https://zkae.io/

That's much better, thanks. According to the Bitwarden blog post: https://bitwarden.com/blog/security-through-transparency-eth... which contains its full cryptography report at the end, all the issues have been fixed except a few which are considered part of the design (see below), so if I understand correctly you have nothing to worry about if you don't use organizations and use a strong password. Issue 5: Organisat…

> KDF settings are stored on the server without authentication, allowing a malicious server to reduce the iteration count

How though, that would also require the client to re-generate the key based on the server setting without te user choosing to do so, does it do that?

Re: Password managers less secure than promised

#72

Post by lofaszvanitt »

wps wrote: post #31
lofaszvanitt wrote: post #22

What a sane idea to store all your secrets in one place.... for attackers to get ahold of them in one move.

Why does the federal reserve keep all that gold in one place? It’s far better to have a ridiculously secure store than it is to have to reuse passwords across a hundred sites (nobody here can remember a hundred unique high entropy passwords). I trust the cryptography far more than my brain to handle these things.

Your argument is flawed. And you know it. For a starter, one gold bar there is around 12.5 kgs.

Re: Password managers less secure than promised

#74

Post by wps »

lofaszvanitt wrote: post #72
wps wrote: post #31

Earlier quoted context omitted.

Why does the federal reserve keep all that gold in one place? It’s far better to have a ridiculously secure store than it is to have to reuse passwords across a hundred sites (nobody here can remember a hundred unique high entropy passwords). I trust the cryptography far more than my brain to handle these things.

Your argument is flawed. And you know it. For a starter, one gold bar there is around 12.5 kgs.

It doesn’t perfectly map, but it gets a visual point across. I cannot be convinced that it’s better for the average person to maintain a couple permutations of a primary password for a hundred different sites than it is for them to store it in a vetted and audited password manager. Even with the vulnerabilities mentioned in the paper you are far better off with a password manager and thus 100 fully unique passwords then without.

Re: Password managers less secure than promised

#75

Post by Biganon »

jmclnx wrote: post #4

>cloud-based password managers The main issue with these managers. I use an encrypted text file and Emacs, nothing on the cloud for me.

"Why do people need this tool? I use a much more rudimentary solution that doesn't do half the things a password manager does"

Re: Password managers less secure than promised

#76

Post by xigoi »

drnick1 wrote: post #16

> cloud-based password managers. Enough said. This kind of stuff should be offline only. If you need to access your password database on multiple devices, set up a LAN and/or a Wireguard tunnel for remote access.

It’s more likely that I’ll drop my phone into a river than that Bitwarden will get compromised.

Re: Password managers less secure than promised

#78

Post by array_key_first »

drnick1 wrote: post #16

> cloud-based password managers. Enough said. This kind of stuff should be offline only. If you need to access your password database on multiple devices, set up a LAN and/or a Wireguard tunnel for remote access.

Storing encrypted files is the best use case for the cloud. There's absolutely zero reason to set up your own wire guard tunnel if the file is encrypted. You can even throw it on Google drive, if you want.

Re: Password managers less secure than promised

#79

Post by array_key_first »

lofaszvanitt wrote: post #73
burnt-resistor wrote: post #65

Earlier quoted context omitted.

Educate us how then many unique secrets "should" be managed.

Not in one "basket".

Why not?

The thing is that your argument is just not compatible with real life. Humans are humans, they are absolutely not going to create unique and strong passwords for every service.

What happens in actuality is that they create one or two okay passwords, then reuse them, which is 100,000x worse than using a password manager.

The promise of a password manager is you get infinite perfect passwords. Perfectly long, perfectly unguessable. And then you can redirect your brain power to making one really, really good password you can remember. The benefits are plentiful. You don't have to worry about breaches. You're immune to dictionary attacks and brute forcing. And, it's much more convenient.

Re: Password managers less secure than promised

#80

Post by baal80spam »

wps wrote: post #24
LoganDark wrote: post #17

Earlier quoted context omitted.

KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.

Haha this was a powermove. It is genuinely great that since it’s just a file you can host it anywhere you want. S3, WebDAV, your own site. I personally use copyparty and WireGuard for my kdbx file. I find it better than syncthing because there’s an obvious master copy (edited in place), and there’s no good way to keep syncthing running all the time on iOS, which can lead to sync conflicts.

Yeah, some people even upload their KDBX files to github (in public repos, no less).
Post reply on HN