14 ms·

Don't trust password managers. They are hackable pieces of software just like the ones you are trying to protect. And they are not reliable (see last news of La

by oAlbe 11y ago

Don't trust password managers. They are hackable pieces of software just like the ones you are trying to protect. And they are not reliable (see last news of Lastpass acquisition by LogMeIn). I'm not saying you should ditch password managers and just memorize all of your password. I'm just saying: use them as a well-informed user. Back in the days, Bruce Schneier suggested to write passwords down on a piece of paper and keep it in your wallet as the least weak security measure. Today, based on this article[0], he actually recommends the use of a password manager "[...] simply because it allows you to choose longer and stronger passwords.", which basically means it's the lesser of two evils. [0] https://www.schneier.com/blog/archives/2014/09/security_of_pas.html https://www.schneier.com/blog/archives/2014/09/security_of_p...

scintill76 11y ago
Not all password managers are commercial, closed-source, and cloud-connected. This probably wasn't a main point of yours, but since you mentioned LastPass I felt this should be clarified. I'm currently using PasswordSafe (in Wine on Linux) with git to version/synchronize between systems. It is kinda painful, but at least it's nice to not be syncing to somebody's cloud or running in a browser. I've been thinking about converting an old Android device into a more secure password manager. I envision having the device hold the decryption key for the PW "vault" as long as it's connected to my authenticated system. I either request credentials from the PC and approve on-device, or select them on the screen, and it types them as a USB keyboard (or perhaps some other way less prone to garden-variety keyloggers.) I guess I haven't because it's kind of a lot of effort and will lower convenience levels. :) I ought to at least find a better way than the clipboard, to transfer passwords from the manager app to the browser etc...
- zwp 11y ago
  I want a small hardware, non-connected tablet that acts exclusively as a password manager. It connects to the computer I'm using as a USB keyboard device and only "types" a password when I physically tell it to ("yubikey on steroids"). Backups and system updates via flash card with encrypted filesystem. No wifi, no bluetooth, no phone, no ethernet, no other purpose. Edit: heh, that's funny, you edited your comment as I was replying? Now we just need someone to build it for us :)
  - scintill76 11y ago
    Haha, I also thought your comment was a response to what I edited-in about my hardware idea, but yes, we must have been writing it at the same time. When Bitcoin hardware wallets were first getting developed, I wondered why people didn't just start with open, barebones commodity hardware like you've described. Well, I suppose one reason may be that it may not exist, but it seems like it should be pretty cheap to pay some low-end Android manufacturer to remove a few features from their design. Or maybe you even buy "normal" hardware and strip out radios. At some level, the wallet manufacturers are all trusting someone, as I don't think any have designed their own low-level components. Anyway, maybe I will revisit that idea to see if a suitable locked-down, easy-to-hack, super-cheap device is available, as I agree that cutting all unnecessary comms is a good idea.
    - TazeTSchnitzel 11y ago
      For radio-free hardware, what about a Palm Pilot? Only has IrDA.
      - i336_ 11y ago
        A couple of them had Bluetooth. The only 68k-based one with builtin Wi-Fi was the AlphaSmart Dana, a writer's keyboard. You're very very unlikely going to want to type a truly secure (= long) password over and over and over, which you'd need to do in a situation where the browser's password manager is turned off, and/or a website disables password caching anyway. The Palm m5xx series could solve this problem: it had full USB, and I once read of an Palm app (like any other) that bridged the m5xx's SD slot to behave like a block device over USB, ie it turned the Palm into a USB SD card reader. That means there's a raw USB SDK out there, and adding HID keyboard support wouldn't be too hard (no kernel driver development etc). Getting passwords into the device would be nontrivial; Palm keyboards are proprietary to the series they were made for, with a few arbitrary connector updates thrown in for good measure (think iPhone docking connector saga). If the password is irritating enough to repeatedly type on a full keyboard, it would take you a good 5 minutes (and a punching bag, for afterwards) to get it into the PDA, Graffiti and custom keyboards taken into account. I think it would work out though: if the only way to get data out of the device is to tap something on its screen, that should be enough of a brick wall to dissuade would-be attackers. I guess I'm responding to this so enthusiastically because it's about Palm :P - I unfortunately never owned one of these awesome little things, but I'd love something of similar capabilities built using today's tech. With modern advances in power consumption, like MemoryLCD, micropower CPUs, short-range bluetooth, etc, the result would probably last literally weeks. It'd be enormous fun to hack on, too, and carve out a little niche for itself. :) I wonder if I should Ask HN if this would be a good idea.
- dllthomas 11y ago
  "I ought to at least find a better way than the clipboard, to transfer passwords from the manager app to the browser etc..." With X selection buffers, when you're pasting data the X application you're pasting from gets to run arbitrary code (informed of the destination!) to determine what to send. I've been wanting a password manager that asks me for verification before transferring the data.
  - anon4 11y ago
    Don't forget that your clipboard manager also stores the last N things you copied in your clipboard history. I won't lie, it is very convenient for passwords I need to type frequently while sitting on a machine I trust, that doesn't run any remote logging applications and that locks when I'm not there, but it's still obviously a security issue.
    - dllthomas 11y ago
      A clipboard manager, if you have one, is a separate X application. The password manager could deny it access, if that's what you'd prefer.
    - dangerlibrary 11y ago
      Keepass, at least, clears the password from the clipboard with a short timeout (default is 10s or so).
- Vendan 11y ago
  heh, I could build a prototype for $40~$50 or so, maybe we need to start a kickstarter
- paulryanrogers 11y ago
  KeePass is also an offline option. It includes the ability for auto type to split data among the clipboard and keyboard. Though I didn't like how wide open it is when unlocked, so I made LockyWindow as an plugin to fix that.
deleted 11y ago
[deleted]
axelfreeman 11y ago
If someone has access to your local passwordmanager he can also keylog everything you type in. Okay, if he can hack your passwordmanager he gets all of your passwords at the same time. Thats a point. It matters with one goes faster: Cranking your PW manager or you typing in all your passwords.

by oAlbe 11y ago

scintill76 11y ago

Not all password managers are commercial, closed-source, and cloud-connected. This probably wasn't a main point of yours, but since you mentioned LastPass I felt this should be clarified. I'm currently using PasswordSafe (in Wine on Linux) with git to version/synchronize between systems. It is kinda painful, but at least it's nice to not be syncing to somebody's cloud or running in a browser. I've been thinking about converting an old Android device into a more secure password manager. I envision having the device hold the decryption key for the PW "vault" as long as it's connected to my authenticated system. I either request credentials from the PC and approve on-device, or select them on the screen, and it types them as a USB keyboard (or perhaps some other way less prone to garden-variety keyloggers.) I guess I haven't because it's kind of a lot of effort and will lower convenience levels. :) I ought to at least find a better way than the clipboard, to transfer passwords from the manager app to the browser etc...

zwp 11y ago
I want a small hardware, non-connected tablet that acts exclusively as a password manager. It connects to the computer I'm using as a USB keyboard device and only "types" a password when I physically tell it to ("yubikey on steroids"). Backups and system updates via flash card with encrypted filesystem. No wifi, no bluetooth, no phone, no ethernet, no other purpose. Edit: heh, that's funny, you edited your comment as I was replying? Now we just need someone to build it for us :)
- scintill76 11y ago
  Haha, I also thought your comment was a response to what I edited-in about my hardware idea, but yes, we must have been writing it at the same time. When Bitcoin hardware wallets were first getting developed, I wondered why people didn't just start with open, barebones commodity hardware like you've described. Well, I suppose one reason may be that it may not exist, but it seems like it should be pretty cheap to pay some low-end Android manufacturer to remove a few features from their design. Or maybe you even buy "normal" hardware and strip out radios. At some level, the wallet manufacturers are all trusting someone, as I don't think any have designed their own low-level components. Anyway, maybe I will revisit that idea to see if a suitable locked-down, easy-to-hack, super-cheap device is available, as I agree that cutting all unnecessary comms is a good idea.
  - TazeTSchnitzel 11y ago
    For radio-free hardware, what about a Palm Pilot? Only has IrDA.
    - i336_ 11y ago
      A couple of them had Bluetooth. The only 68k-based one with builtin Wi-Fi was the AlphaSmart Dana, a writer's keyboard. You're very very unlikely going to want to type a truly secure (= long) password over and over and over, which you'd need to do in a situation where the browser's password manager is turned off, and/or a website disables password caching anyway. The Palm m5xx series could solve this problem: it had full USB, and I once read of an Palm app (like any other) that bridged the m5xx's SD slot to behave like a block device over USB, ie it turned the Palm into a USB SD card reader. That means there's a raw USB SDK out there, and adding HID keyboard support wouldn't be too hard (no kernel driver development etc). Getting passwords into the device would be nontrivial; Palm keyboards are proprietary to the series they were made for, with a few arbitrary connector updates thrown in for good measure (think iPhone docking connector saga). If the password is irritating enough to repeatedly type on a full keyboard, it would take you a good 5 minutes (and a punching bag, for afterwards) to get it into the PDA, Graffiti and custom keyboards taken into account. I think it would work out though: if the only way to get data out of the device is to tap something on its screen, that should be enough of a brick wall to dissuade would-be attackers. I guess I'm responding to this so enthusiastically because it's about Palm :P - I unfortunately never owned one of these awesome little things, but I'd love something of similar capabilities built using today's tech. With modern advances in power consumption, like MemoryLCD, micropower CPUs, short-range bluetooth, etc, the result would probably last literally weeks. It'd be enormous fun to hack on, too, and carve out a little niche for itself. :) I wonder if I should Ask HN if this would be a good idea.
dllthomas 11y ago
"I ought to at least find a better way than the clipboard, to transfer passwords from the manager app to the browser etc..." With X selection buffers, when you're pasting data the X application you're pasting from gets to run arbitrary code (informed of the destination!) to determine what to send. I've been wanting a password manager that asks me for verification before transferring the data.
- anon4 11y ago
  Don't forget that your clipboard manager also stores the last N things you copied in your clipboard history. I won't lie, it is very convenient for passwords I need to type frequently while sitting on a machine I trust, that doesn't run any remote logging applications and that locks when I'm not there, but it's still obviously a security issue.
  - dllthomas 11y ago
    A clipboard manager, if you have one, is a separate X application. The password manager could deny it access, if that's what you'd prefer.
  - dangerlibrary 11y ago
    Keepass, at least, clears the password from the clipboard with a short timeout (default is 10s or so).
Vendan 11y ago
heh, I could build a prototype for $40~$50 or so, maybe we need to start a kickstarter
paulryanrogers 11y ago
KeePass is also an offline option. It includes the ability for auto type to split data among the clipboard and keyboard. Though I didn't like how wide open it is when unlocked, so I made LockyWindow as an plugin to fix that.

deleted 11y ago

[deleted]

axelfreeman 11y ago

If someone has access to your local passwordmanager he can also keylog everything you type in. Okay, if he can hack your passwordmanager he gets all of your passwords at the same time. Thats a point. It matters with one goes faster: Cranking your PW manager or you typing in all your passwords.