4 ms·

I like the idea, but the master password scares me a bit. So if I accidentally type my master password into Slack one day (not that that has ever happened), it

by zwily 9y ago

I like the idea, but the master password scares me a bit. So if I accidentally type my master password into Slack one day (not that that has ever happened), it seems anyone who saw it would then immediately be able to log into every website using SecureLogin as me. The README addresses a concern about "Master password is single point of failure in this system", but it talks about the case of a user forgetting it, not accidentally disclosing it.

homakov 9y ago
It's more about password hygiene. Do you have any advice how to prevent disclosing not making UX harder? I would happily implement it.
- zwily 9y ago
  Agreed on the hygiene... However, we're humans, and even the best of us will make a mistake at some point. The impact of that mistake in that scheme seems potentially catastrophic in a way that's different from traditional password managers. I don't see an easy way to fix it given your design goals (which I really like!)
  - homakov 9y ago
    I never really tried to type my password and hit Send, so I never worried about this case. Hygiene has to be reshaped to understand how important master pw is compared to all pw we used to type, like 123456.
    - zwily 9y ago
      The times I've seen people type passwords into Slack has usually been because they had the wrong field focused, and autopilot typed the password and hit Enter. (To be clear, this complaint applies to all schemes that rely on passwords derived from a master password.)
      - GordonS 9y ago
        I've done it once before, with Keepass and Lync. I was working on several tasks at once, area bit of a frenzied pace. I had a few Lync chat Windows open. I copied my password from Keepass, alt-tabbed to what I thought was the browser, pasted and hit enter. Oops, wrong window... I've had people paste their passwords to me a couple of times over the years too.
        inimino 9y ago
        One clever UI way around this would be to not use Enter in the master password field. Instead use something on the homerow like "jkl" to end every password. Then the input field just accepts whenever /.*jkl/ matches. This mostly solves the "wrong focus" problem because hitting Enter is no longer part of the muscle memory. Of course you could still enter it into a shared Google doc or something else that discloses without Enter, so it's only a partial solution.
- zwily 9y ago
  In the case where a master password does get disclosed (for whatever reason), how does a user change their password everywhere? I don't see anything about that in the README.
  - homakov 9y ago
    https://news.ycombinator.com/item?id=14482166 https://news.ycombinator.com/item?id=14482166
- reitanqild 9y ago
  Slightly harder but may generate some good ideas/discussion: A two-part password (no, not two factor) where part 1 is stored by the browser and recommended to be written down or otherwise recoverable part 2 is remembered by the user from day to day. Now if the user types the password into the wrong field or the keyboard is bugged they should still be fairly safe as long as part 1 is a good password on its own.
  - smarx007 9y ago
    How do we scale it to multiple mobile devices?
    - reitanqild 9y ago
      Don't think I understand your question. Or maybe I didn't understand the original idea.
      - homakov 9y ago
        He means how does your 2 part scheme scale (it is hard). With 1 password you simply enter it again on another device.
        reitanqild 9y ago
        Ok, the point was that part one was easily recoverable by the user. So they could sign up another device by just opening a safe and finding it or sit down with book x and reconstruct it. So slightly harder but still very much doable.
kosinus 9y ago
I also wonder if a weak link could pose a threat. Say, Attacker knows User is a member of Site X, but Site X fails to implement checks and/or rate limits properly. Attacker brute forces master password by spamming the login endpoints. Extrapolating: a database leak of any site means the attacked can locally brute force master passwords of all users? Currently, such a leak means a subset of users who reuse passwords are in trouble. Widespread deployment of this kind of scheme would take away choice, and put everyone in trouble. (Unless you start using different master passwords to create bubbles, which means we're back to square one.)
- zwily 9y ago
  I don't know if brute forcing is that much of a thread. Your password is taken through a key derivation function that takes about 20s to generate the real master key. (From what I understand).
  - ezfe 9y ago
    I just checked and on my laptop the app download takes about 5 seconds (timed manually) to process a new master password account.
- homakov 9y ago
  There is no need for rate limiting against pubkey crypto, and bruteforce is simply too expensive for current derivation.
curioussavage 9y ago
I don't think this criticism is that valid. LastPass et al are the same. After years of use I have no idea how someone would do that. It's like saying about credit cards - " but what if I randomly read the card number and pin out loud". I'm sure it could happen but it seems silly to bother criticising.
- notatoad 9y ago
  >but what if I randomly read the card number and pin out loud Except that's a reasonable scenario with an easy answer: If you compromise your credit card information, you call the issuer and you cancel the card.
  - homakov 9y ago
    (That comes with associated risks of bank stealing your money, i.e. don't own them. Just an analogy, not a bitcoin zealot.)
- IanCal 9y ago
  I can change my master password with lastpass, is the same possible with securelogin?
- notzorbo3 9y ago
  I've typed my most sensitive password on public IRC once. I assumed my screen was locked while my display came back to life after sleep mode. For some reason, my screen wasn't locked and the IRC window had the focus instead. The great thing was that, even though that was my most sensitive password (the only that unlocks my desktop and encrypted folders), it didn't matter because all I had to do was immediately change the password in the only two places it was used. I will never trust generation of site-specific passwords from a single master password. Too many things could go wrong. There could be a bug in the derivation algorithm, crypto might become brute-forcable, etc.
  - homakov 9y ago
    You can use get it here too: first part is truly random (store it locally) second is memorable. It gives you freedom to do it your way, unlike traditional approach where you have to backup a wallet no matter what.

by zwily 9y ago

homakov 9y ago

It's more about password hygiene. Do you have any advice how to prevent disclosing not making UX harder? I would happily implement it.

zwily 9y ago
Agreed on the hygiene... However, we're humans, and even the best of us will make a mistake at some point. The impact of that mistake in that scheme seems potentially catastrophic in a way that's different from traditional password managers. I don't see an easy way to fix it given your design goals (which I really like!)
- homakov 9y ago
  I never really tried to type my password and hit Send, so I never worried about this case. Hygiene has to be reshaped to understand how important master pw is compared to all pw we used to type, like 123456.
  - zwily 9y ago
    The times I've seen people type passwords into Slack has usually been because they had the wrong field focused, and autopilot typed the password and hit Enter. (To be clear, this complaint applies to all schemes that rely on passwords derived from a master password.)
    - GordonS 9y ago
      I've done it once before, with Keepass and Lync. I was working on several tasks at once, area bit of a frenzied pace. I had a few Lync chat Windows open. I copied my password from Keepass, alt-tabbed to what I thought was the browser, pasted and hit enter. Oops, wrong window... I've had people paste their passwords to me a couple of times over the years too.
      - inimino 9y ago
        One clever UI way around this would be to not use Enter in the master password field. Instead use something on the homerow like "jkl" to end every password. Then the input field just accepts whenever /.*jkl/ matches. This mostly solves the "wrong focus" problem because hitting Enter is no longer part of the muscle memory. Of course you could still enter it into a shared Google doc or something else that discloses without Enter, so it's only a partial solution.
zwily 9y ago
In the case where a master password does get disclosed (for whatever reason), how does a user change their password everywhere? I don't see anything about that in the README.
- homakov 9y ago
  https://news.ycombinator.com/item?id=14482166 https://news.ycombinator.com/item?id=14482166
reitanqild 9y ago
Slightly harder but may generate some good ideas/discussion: A two-part password (no, not two factor) where part 1 is stored by the browser and recommended to be written down or otherwise recoverable part 2 is remembered by the user from day to day. Now if the user types the password into the wrong field or the keyboard is bugged they should still be fairly safe as long as part 1 is a good password on its own.
- smarx007 9y ago
  How do we scale it to multiple mobile devices?
  - reitanqild 9y ago
    Don't think I understand your question. Or maybe I didn't understand the original idea.
    - homakov 9y ago
      He means how does your 2 part scheme scale (it is hard). With 1 password you simply enter it again on another device.
      - reitanqild 9y ago
        Ok, the point was that part one was easily recoverable by the user. So they could sign up another device by just opening a safe and finding it or sit down with book x and reconstruct it. So slightly harder but still very much doable.

kosinus 9y ago

I also wonder if a weak link could pose a threat. Say, Attacker knows User is a member of Site X, but Site X fails to implement checks and/or rate limits properly. Attacker brute forces master password by spamming the login endpoints. Extrapolating: a database leak of any site means the attacked can locally brute force master passwords of all users? Currently, such a leak means a subset of users who reuse passwords are in trouble. Widespread deployment of this kind of scheme would take away choice, and put everyone in trouble. (Unless you start using different master passwords to create bubbles, which means we're back to square one.)

zwily 9y ago
I don't know if brute forcing is that much of a thread. Your password is taken through a key derivation function that takes about 20s to generate the real master key. (From what I understand).
- ezfe 9y ago
  I just checked and on my laptop the app download takes about 5 seconds (timed manually) to process a new master password account.
homakov 9y ago
There is no need for rate limiting against pubkey crypto, and bruteforce is simply too expensive for current derivation.

curioussavage 9y ago

I don't think this criticism is that valid. LastPass et al are the same. After years of use I have no idea how someone would do that. It's like saying about credit cards - " but what if I randomly read the card number and pin out loud". I'm sure it could happen but it seems silly to bother criticising.

notatoad 9y ago
>but what if I randomly read the card number and pin out loud Except that's a reasonable scenario with an easy answer: If you compromise your credit card information, you call the issuer and you cancel the card.
- homakov 9y ago
  (That comes with associated risks of bank stealing your money, i.e. don't own them. Just an analogy, not a bitcoin zealot.)
IanCal 9y ago
I can change my master password with lastpass, is the same possible with securelogin?
notzorbo3 9y ago
I've typed my most sensitive password on public IRC once. I assumed my screen was locked while my display came back to life after sleep mode. For some reason, my screen wasn't locked and the IRC window had the focus instead. The great thing was that, even though that was my most sensitive password (the only that unlocks my desktop and encrypted folders), it didn't matter because all I had to do was immediately change the password in the only two places it was used. I will never trust generation of site-specific passwords from a single master password. Too many things could go wrong. There could be a bug in the derivation algorithm, crypto might become brute-forcable, etc.
- homakov 9y ago
  You can use get it here too: first part is truly random (store it locally) second is memorable. It gives you freedom to do it your way, unlike traditional approach where you have to backup a wallet no matter what.