4 ms·

Here's another question to ask: "Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl

Here's another question to ask: "Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl+F for the URL, and then Ctrl+C out the username and password every time they want to visit a site? Also, is everyone going to create a correlated entry every time they make a new account?" Good security is hard in practice because people are always going to default to the most convenient/simple way to accomplish their goal, and at this point, most of our security measures require someone to expend extra energy. That means it's going to be very hard to get people to do it. We have decades of experience with this just with regard to one layer of passwords. Adding an extra layer, like a password vault, is not going to make things better. While it absolutely true that there is more risk involved in using a third-party extension to manage a password vault than not, the actual net effect is likely better security, because if you make things too hard, people are just going to say "Fuck those annoying nerds, we're going to make every password 123456", or whatever the next-simplest answer that the system will permit is. As for LastPass making mistakes, that's true, but the benefit you get by using a well-known product like LastPass is that Project Zero has hardened it. That's not the case for most other password vault extensions, especially those made as shims for external vaults like KeePass.

bqe 10y ago
> "Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl+F for the URL, and then Ctrl+C out the username and password every time they want to visit a site? Also, is everyone going to create a correlated entry every time they make a new account?" This is not how pass or KeePass work. I recommend you try them out and see if they're really that hard to use (hint: they're not). If you really like browser integration, I also sometimes recommend using the built-in Chrome or Firefox password managers with good master passwords. They're actually easier to use than LastPass and its insecure ilk.
- cookiecaper 10y ago
  I've used KeePass for years. Am I using it all wrong or what? That's how it works on my computer. Yes, you could install a browser extension that interfaces out to KeePass (and I've used those in the past too), but that doesn't give much, if any, security benefit over LastPass; you're still exposing the attack surface to the browser's environment. I do actually also use Chrome's built-in password manager so that I don't have to copy and paste as much.
  - tripzilch 10y ago
    Check out the "perform autotype" feature in the right-click menu on an entry in KeePassX.
tincholio 10y ago
I actually do that (gpg-encrypted file with an org-mode table with usernames and passwords, easily accessed from within Emacs). It's not as much of a hassle as it sounds, really.
palant 10y ago
Point is: this can be done right. I develop Easy Passwords myself, with the same/better convenience factor and without offering a huge attack surface. It's not about LastPass making mistakes, rather about them not learning from them and thus necessarily repeating them. If you still want to believe that LastPast is hardened now - well, if it makes you happier...
tripzilch 10y ago
Totally agree with you on the convenience factor. Still doesn't mean I'm going to use a browser extension to securely manage my passwords. Or something proprietary. And lets me decide how and where to store/sync the encrypted blob of my password DB. So I use KeepassX for Linux (and Keepass2Android on my mobile), which I frankly don't understand why it's not recommended way more often. It's open source, doesn't have those problems, nor does it have a company--ego--attached to it that has incentives to downplay security-issues to save face/profit. Ego is a potential attack surface. Every time the password-manager discussion comes up, I scan the thread and check what possibly problems any of them have. And all of the other ones have at least some of those issues that I care about, even if only that the encrypted blob is stored somewhere out of your control. Except for KeepassX, for which the only "serious" downside I've read is that some big security names on Twitter seem to really dislike the GUI for some reason. Which is a fine opinion, but not one where I'd consider their expertise to hold much value over anyone else's (and personally, I disagree with). > Here's another question to ask: "Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl+F for the URL, and then Ctrl+C out the username and password every time they want to visit a site? Also, is everyone going to create a correlated entry every time they make a new account?" Okay, so here's how I use KeepassX for Linux: The application is small and lightweight and therefore already open (but locked) as an icon in my systray. I have to unlock the vault due to timeout[0]. To find the entry, type a few characters in the search box, or select it from the appropriate category/folder, I put the few ones I use most in the default/top folder for even quicker access. Then I right-click the entry and select "perform autotype". Done. "Perform autotype" seems to basically send a bunch of keyboard events: <alt-tab>, [username], <tab>, [password], <enter>. This sequence works every login form I use. There's probably exceptions, but iirc you can configure the autotype sequence. Otherwise for that one login form that is weird and annoying you can always right-click and use "copy username/password to clipboard" (which is auto cleared after X seconds). Finally if the login form won't let you autotype AND doesn't let you paste, it becomes even easier: right-click, "delete entry" and never use that service again because COME ON, really. edit to add: the Android app, Keepass2Android is slightly more cumbersome to use, but that's mainly because I find touch screen typing my master password a bit of a pain. After that it's actually easier, when you selected the entry, you select Keepass2Android as keyboard app, which only has these buttons: [User], [Pass], [Next field], [Submit]. At entering the master password there's also a checkbox "allow quick unlock", which allows you to unlock using only the last 3 chars of your master password (for duration of a second, longer+configurable, timeout). [0] Do other password managers get around this? I really don't see how, without getting the same exposure as I would get by disabling the timeout in KeepassX?

bqe 10y ago

> "Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl+F for the URL, and then Ctrl+C out the username and password every time they want to visit a site? Also, is everyone going to create a correlated entry every time they make a new account?" This is not how pass or KeePass work. I recommend you try them out and see if they're really that hard to use (hint: they're not). If you really like browser integration, I also sometimes recommend using the built-in Chrome or Firefox password managers with good master passwords. They're actually easier to use than LastPass and its insecure ilk.

cookiecaper 10y ago
I've used KeePass for years. Am I using it all wrong or what? That's how it works on my computer. Yes, you could install a browser extension that interfaces out to KeePass (and I've used those in the past too), but that doesn't give much, if any, security benefit over LastPass; you're still exposing the attack surface to the browser's environment. I do actually also use Chrome's built-in password manager so that I don't have to copy and paste as much.
- tripzilch 10y ago
  Check out the "perform autotype" feature in the right-click menu on an entry in KeePassX.

tincholio 10y ago

I actually do that (gpg-encrypted file with an org-mode table with usernames and passwords, easily accessed from within Emacs). It's not as much of a hassle as it sounds, really.

palant 10y ago

Point is: this can be done right. I develop Easy Passwords myself, with the same/better convenience factor and without offering a huge attack surface. It's not about LastPass making mistakes, rather about them not learning from them and thus necessarily repeating them. If you still want to believe that LastPast is hardened now - well, if it makes you happier...

tripzilch 10y ago

Totally agree with you on the convenience factor. Still doesn't mean I'm going to use a browser extension to securely manage my passwords. Or something proprietary. And lets me decide how and where to store/sync the encrypted blob of my password DB. So I use KeepassX for Linux (and Keepass2Android on my mobile), which I frankly don't understand why it's not recommended way more often. It's open source, doesn't have those problems, nor does it have a company--ego--attached to it that has incentives to downplay security-issues to save face/profit. Ego is a potential attack surface. Every time the password-manager discussion comes up, I scan the thread and check what possibly problems any of them have. And all of the other ones have at least some of those issues that I care about, even if only that the encrypted blob is stored somewhere out of your control. Except for KeepassX, for which the only "serious" downside I've read is that some big security names on Twitter seem to really dislike the GUI for some reason. Which is a fine opinion, but not one where I'd consider their expertise to hold much value over anyone else's (and personally, I disagree with). > Here's another question to ask: "Is everyone really going to open a separate application, unlock the vault every time they want to use it (due to timeout), Ctrl+F for the URL, and then Ctrl+C out the username and password every time they want to visit a site? Also, is everyone going to create a correlated entry every time they make a new account?" Okay, so here's how I use KeepassX for Linux: The application is small and lightweight and therefore already open (but locked) as an icon in my systray. I have to unlock the vault due to timeout[0]. To find the entry, type a few characters in the search box, or select it from the appropriate category/folder, I put the few ones I use most in the default/top folder for even quicker access. Then I right-click the entry and select "perform autotype". Done. "Perform autotype" seems to basically send a bunch of keyboard events: <alt-tab>, [username], <tab>, [password], <enter>. This sequence works every login form I use. There's probably exceptions, but iirc you can configure the autotype sequence. Otherwise for that one login form that is weird and annoying you can always right-click and use "copy username/password to clipboard" (which is auto cleared after X seconds). Finally if the login form won't let you autotype AND doesn't let you paste, it becomes even easier: right-click, "delete entry" and never use that service again because COME ON, really. edit to add: the Android app, Keepass2Android is slightly more cumbersome to use, but that's mainly because I find touch screen typing my master password a bit of a pain. After that it's actually easier, when you selected the entry, you select Keepass2Android as keyboard app, which only has these buttons: [User], [Pass], [Next field], [Submit]. At entering the master password there's also a checkbox "allow quick unlock", which allows you to unlock using only the last 3 chars of your master password (for duration of a second, longer+configurable, timeout). [0] Do other password managers get around this? I really don't see how, without getting the same exposure as I would get by disabling the timeout in KeepassX?