Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password managers less secure than promised

ethz.ch

Post reply on HN
Print view View original

81–87 of 87 posts

Re: Password managers less secure than promised

#81

Post by burnt-resistor »

array_key_first wrote: post #79
lofaszvanitt wrote: post #73

Earlier quoted context omitted.

Not in one "basket".

Why not? The thing is that your argument is just not compatible with real life. Humans are humans, they are absolutely not going to create unique and strong passwords for every service. What happens in actuality is that they create one or two okay passwords, then reuse them, which is 100,000x worse than using a password manager. The promise of a password manager is you get infinite perfect passwords. Perfectly long,…

It's unreasonable to argue with an unreasonable person, especially with behavior of refusal to engage anything more than a superficial Tweet. Hey, maybe they access a bevy of doves that know their names and have their passwords tied to their feet? Seems totally practical!

Re: Password managers less secure than promised

#82

Post by ASalazarMX »

LoganDark wrote: post #17
baal80spam wrote: post #3

That's why KeePass is still the king. Offline vault > online vault.

KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.

The database is encrypted, so theoretically it doesn't matter if other people have it, but what a chad. I suppose these are not your real passwords, or are low-value ones, because there could be zero-days we don't know about.

And I was queasy of hosting mine on Dropbox.

Re: Password managers less secure than promised

#83

Post by LoganDark »

ASalazarMX wrote: post #82
LoganDark wrote: post #17

Earlier quoted context omitted.

KeePassXC can even still be online, too; example: https://logandark.net/passwords.kdbx It's not centralized, of course; you still have to download the entire database, and then potentially upload the entire database again for any changes; but it doesn't have these vulnerabilities.

The database is encrypted, so theoretically it doesn't matter if other people have it, but what a chad. I suppose these are not your real passwords, or are low-value ones, because there could be zero-days we don't know about. And I was queasy of hosting mine on Dropbox.

A bunch of them have changed since I migrated to iCloud Passwords, but no, that is an actual real passwords database with every internet account of mine that I knew about as of around December 2024.

I tuned the encryption to take a short while to unlock for even a high-tier desktop CPU, to the tune of slow password hashes. I actually somewhat enjoyed the delay every time I opened up the database...

Re: Password managers less secure than promised

#84

Post by ASalazarMX »

LoganDark wrote: post #83
ASalazarMX wrote: post #82

Earlier quoted context omitted.

The database is encrypted, so theoretically it doesn't matter if other people have it, but what a chad. I suppose these are not your real passwords, or are low-value ones, because there could be zero-days we don't know about. And I was queasy of hosting mine on Dropbox.

A bunch of them have changed since I migrated to iCloud Passwords, but no, that is an actual real passwords database with every internet account of mine that I knew about as of around December 2024. I tuned the encryption to take a short while to unlock for even a high-tier desktop CPU, to the tune of slow password hashes. I actually somewhat enjoyed the delay every time I opened up the database...

Well, if you somehow lose the file, I'm sure you can ask here and someone will have a copy. It is a nice artifact of the times.

Re: Password managers less secure than promised

#85

Post by soupfordummies »

JamesLeonis wrote: post #59
soupfordummies wrote: post #57

Earlier quoted context omitted.

What clients are you using ? Trying syncthing with synctrayzor with my windows boxes and Synctrain on my iPhone and it’s mostly alright but still a little spotty.

I'm also using Synctrayzor on my Windows 10 machine. I'm on Android using the official Syncthing app there as well as on Linux. It sometimes takes a while for them to discover each other, and it of course works better when all the devices are on my home network. The only real problem I've encountered is when filenames have special characters another OS doesn't like.

Hey thanks for the quick reply! Yeah, I've noticed the discoverability is a lot more consistent when I just foreground the app on both devices and let it sit for 10-15 seconds. So used to instant gratification in this age :\

Re: Password managers less secure than promised

#86

Post by lofaszvanitt »

array_key_first wrote: post #79
lofaszvanitt wrote: post #73

Earlier quoted context omitted.

Not in one "basket".

Why not? The thing is that your argument is just not compatible with real life. Humans are humans, they are absolutely not going to create unique and strong passwords for every service. What happens in actuality is that they create one or two okay passwords, then reuse them, which is 100,000x worse than using a password manager. The promise of a password manager is you get infinite perfect passwords. Perfectly long,…

How many services really need good protection? A few. Bank, gov, some online shops. Where you have PII. Forums, discussion groups do not really need protection. Plus if you have proper 2fa, you can even have a pw like: meowmeowww

Re: Password managers less secure than promised

#87

Post by lofaszvanitt »

wps wrote: post #74
lofaszvanitt wrote: post #72

Earlier quoted context omitted.

Your argument is flawed. And you know it. For a starter, one gold bar there is around 12.5 kgs.

It doesn’t perfectly map, but it gets a visual point across. I cannot be convinced that it’s better for the average person to maintain a couple permutations of a primary password for a hundred different sites than it is for them to store it in a vetted and audited password manager. Even with the vulnerabilities mentioned in the paper you are far better off with a password manager and thus 100 fully unique passwords t…

Yeah, but if you use the shack once per year, then why put the shack key amongst the ones you frequently use?
Post reply on HN