Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Horcrux: A Password Manager for Paranoids

arxiv.org

Post reply on HN
Print view View original

91–100 of 168 posts

Re: Horcrux: A Password Manager for Paranoids

#91

Post by Ajedi32 »

haberman wrote: post #88
Ajedi32 wrote: post #83

Earlier quoted context omitted.

I'm using KeePass Professional Edition, not KeePassX. Pretty sure they both use the same database format and are both cross-platform, so you should be able to switch pretty easily if KeePassX doesn't do everything you want. For browser autofill I'm using the KeePassHttp plugin with ChromeIPass. For InputStick I'm using Keepass2Android with KP2A InputStick. Autotype is a built-in feature of KeePass on desktop. Passwor…

What is KeePass Professional Edition? When I Googled for that the best thing I could find is "Professional Edition" on this page: http://keepass.info/download.html Is that what you mean? It looks like it's written using Mono for non-Windows platforms. I might have shied away for that reason. What platform do you use it on? I'd love to know if it works well on non-Windows platforms (OS X, Linux).

Yes, that's what I'm referring to. I mostly use it on Windows, so I can't really comment on how well it works on MacOS or Linux. My understanding though is that it's basically a straight port, so most of the same functionality should be available.

Another option you might want to look at is KeePassXC. It's a fork of KeePassX, and it has built-in (though off-by-default) support for keepasshttp.

Re: Horcrux: A Password Manager for Paranoids

#92

Post by JetSpiegel »

kybernetikos wrote: post #60
MatthewWilkes wrote: post #13

Earlier quoted context omitted.

That's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.

I recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts. https://github.com/kybernetikos/sinkless I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.

Until you have to change a password.

Re: Horcrux: A Password Manager for Paranoids

#93

Post by GhotiFish »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Just thought I would mention: PassFF does not works with the current version of firefox. The current plugin does not work and is not supported. According to the author, we should wait for the Web-Extensions version which will be coming... no idea... soon? I asked about 2 months ago. So pass is basically just a command line password manager unless you run firefox developer edition.

Re: Horcrux: A Password Manager for Paranoids

#95

Post by Rafert »

haberman wrote: post #72

Why on earth isn't the industry moving away from per-site passwords? They are terrible. The fact that you need your own app to "manage" them is just evidence of how terrible they are. People should be able to use their phones, Yubikey, TouchID, etc. as their authentication, without needing a password (except a master password for the phone/Yubikey/TouchID). And yet I see no movement towards this from the industry. Ar…

The industry is working on killing the password. It started at Google with U2F, handed over to the FIDO Alliance (an industry group) and is now being worked on by the W3C. Have you seen the Web Authentication work? https://www.w3.org/TR/webauthn/

Re: Horcrux: A Password Manager for Paranoids

#96

Post by fdw »

GhotiFish wrote: post #93
danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

Just thought I would mention: PassFF does not works with the current version of firefox. The current plugin does not work and is not supported. According to the author, we should wait for the Web-Extensions version which will be coming... no idea... soon? I asked about 2 months ago. So pass is basically just a command line password manager unless you run firefox developer edition.

You can use browserpass [1] instead, it's a web extension for Firefox and Chrome.

[1] https://github.com/dannyvankooten/browserpass

Re: Horcrux: A Password Manager for Paranoids

#97

Post by tzs »

JetSpiegel wrote: post #92
kybernetikos wrote: post #60

Earlier quoted context omitted.

I recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts. https://github.com/kybernetikos/sinkless I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.

Until you have to change a password.

He addresses that on the page he linked to.

Re: Horcrux: A Password Manager for Paranoids

#98

Post by tzs »

fictioncircle wrote: post #12
thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

What do you mean by "treat it as code you authored"?

Re: Horcrux: A Password Manager for Paranoids

#99

Post by deno »

danjoc wrote: post #45

Sticking with zx2c4 pass. It is an assembly of gnupg, git, and pwgen. Trusted open source components. Works with a Yubikey (opensc and gpg-agent) to prevent private key theft via software. PassFF extension provides excellent browser integration. Android Password Store and OpenKeychain allow pass and yubikey to work on my mobile. Strong 2 factor password storage everywhere I need it. My biggest problem these days is d…

This article is about a novel technique that supplies dummy passwords on DOM level and intercepts network requests to replace them with actual secrets. This is not about protecting your master key, it’s about protecting the actual passwords from a variety of attacks, including script injection.

Your comment is completely off-topic.

Re: Horcrux: A Password Manager for Paranoids

#100

Post by deno »

thinkMOAR wrote: post #10

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

This does NOT protect you from script injections, keyloggers, etc. Their approach in fact DOES.
Post reply on HN