5 ms·

Why on earth do people who read HN keep their passwords in a cloud service? pass/gopass, stored in git over ssh on a server I control, and I have access to all

by jbg_ 10y ago

Why on earth do people who read HN keep their passwords in a cloud service? pass/gopass, stored in git over ssh on a server I control, and I have access to all my passwords everywhere while only relying on the security of ssh and gpg...

Dayshine 10y ago
I trust a company whose existence depends on keeping my passwords secure over my own ability to keep my personal server secure. It's not just ssh and gpg, it's every single service you have running on it, every piece of hardware and the OS itself.
- jbg_ 10y ago
  No. If gpg does its job you could even host the passwords in a public github repository. Several pass users do this; I used to, but my server has better availability than github over the last few years so I switched after being frustrated at not being able to sync new passwords to my phone a couple of times.
  - jbg_ 10y ago
    So, to be fair, I misspoke when I said I rely on the security of gpg AND ssh. Really, it all comes down to the security of gpg. I feel pretty okay about that.
    - nrook 10y ago
      Surely you mean "pretty good"?
      - jbg_ 10y ago
        Yes. In my variant of English they mean the same thing :)
        dewey 10y ago
        Pretty sure he was referring to https://en.wikipedia.org/wiki/Pretty_Good_Privacy https://en.wikipedia.org/wiki/Pretty_Good_Privacy ;)
miguelrochefort 10y ago
LastPass is so much more convenient. I can't imagine not having the app or browser extensions to autocomplete these passwords for me. I even use their 2FA service. How much work does it take you to create a password for a new account, or retrieve a password when logging to an existing account?
- jbg_ 10y ago
  Command-tab, pass -c domainname, command-tab It's really not that bad. There are extensions but I decided that auditing their code was harder than just using one of the terminals I already have open. Autocompletion is a security nightmare, and 2FA really doesn't help, you're blindly trusting LastPass.
arkem 10y ago
I have a security background and I've found (minor) security bugs in lastpass before and yet I still use it. I use lastpass because it is safer than what I was doing before using a password manager and most inconvenience I'm willing to put up with for my day to day computing. I like to think of it as a convenience vs security chart of password schemes and for me lastpass is on the pareto frontier of it and happens to be the most convenient option on that frontier.
- jbg_ 10y ago
  How exactly is giving a third party access to your plaintext passwords "on the pareto frontier"? There are numerous options which do not involve doing so, some of which have better convenience than pass, so I'm genuinely curious how distributing your plaintext passwords more widely could possibly be at the frontier of security...
  - arkem 10y ago
    Which options are more convenient? I'm always looking for something better. What do you mean about distributing passwords in plaintext? Can you be more specific for me? It's not the pareto frontier of security, it's the pareto frontier of security versus convenience. It's not exactly a "thing", it's just a mental model I use for thinking about security trade-offs.
  - killbrad 10y ago
    Your plaintext passwords are never sent to lastpass.
    - jbg_ 10y ago
      If they are handled by a closed source browser extension distributed by them, how are you so sure?

by jbg_ 10y ago

Dayshine 10y ago

I trust a company whose existence depends on keeping my passwords secure over my own ability to keep my personal server secure. It's not just ssh and gpg, it's every single service you have running on it, every piece of hardware and the OS itself.

jbg_ 10y ago
No. If gpg does its job you could even host the passwords in a public github repository. Several pass users do this; I used to, but my server has better availability than github over the last few years so I switched after being frustrated at not being able to sync new passwords to my phone a couple of times.
- jbg_ 10y ago
  So, to be fair, I misspoke when I said I rely on the security of gpg AND ssh. Really, it all comes down to the security of gpg. I feel pretty okay about that.
  - nrook 10y ago
    Surely you mean "pretty good"?
    - jbg_ 10y ago
      Yes. In my variant of English they mean the same thing :)
      - dewey 10y ago
        Pretty sure he was referring to https://en.wikipedia.org/wiki/Pretty_Good_Privacy https://en.wikipedia.org/wiki/Pretty_Good_Privacy ;)

miguelrochefort 10y ago

LastPass is so much more convenient. I can't imagine not having the app or browser extensions to autocomplete these passwords for me. I even use their 2FA service. How much work does it take you to create a password for a new account, or retrieve a password when logging to an existing account?

jbg_ 10y ago
Command-tab, pass -c domainname, command-tab It's really not that bad. There are extensions but I decided that auditing their code was harder than just using one of the terminals I already have open. Autocompletion is a security nightmare, and 2FA really doesn't help, you're blindly trusting LastPass.

arkem 10y ago

I have a security background and I've found (minor) security bugs in lastpass before and yet I still use it. I use lastpass because it is safer than what I was doing before using a password manager and most inconvenience I'm willing to put up with for my day to day computing. I like to think of it as a convenience vs security chart of password schemes and for me lastpass is on the pareto frontier of it and happens to be the most convenient option on that frontier.

jbg_ 10y ago
How exactly is giving a third party access to your plaintext passwords "on the pareto frontier"? There are numerous options which do not involve doing so, some of which have better convenience than pass, so I'm genuinely curious how distributing your plaintext passwords more widely could possibly be at the frontier of security...
- arkem 10y ago
  Which options are more convenient? I'm always looking for something better. What do you mean about distributing passwords in plaintext? Can you be more specific for me? It's not the pareto frontier of security, it's the pareto frontier of security versus convenience. It's not exactly a "thing", it's just a mental model I use for thinking about security trade-offs.
- killbrad 10y ago
  Your plaintext passwords are never sent to lastpass.
  - jbg_ 10y ago
    If they are handled by a closed source browser extension distributed by them, how are you so sure?