5 ms·
If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not
by thinkMOAR 9y ago
If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.
- fictioncircle 9y agoIf you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)
- thinkMOAR 9y agoTrue, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.
- phinnaeus 9y agoMake sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.
- Santosh83 9y agoWhy stop with compilers? Inspect the circuit diagrams for all your hardware and then make sure the actual manufacturing followed the designs to a tee.
- Royalaid 9y agoI mean I know it hyperbole but I am pretty sure there are hardware bugs that allow access, see that Intel or IBM remote management disclosure. It might not a real backdoor but it's as good as one. As people above are mentioning keep your paranoia inside your threat model
- madamelic 9y agoI wish I could find the story where someone actually had this issue. Basically, the story was that a program for grad research was inserting all kinds of nasty, anti-semetic things into text and it turned out the previous grad student had poisoned the compiler which was modifying the strings and was able to re-poison it every time through something else. I forgot the exact details but it is an amazing read.
- fictioncircle 9y ago> True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling. Then they aren't paranoid but normal folks, eh?
- 0xfeba 9y agoRelevant: https://en.wikipedia.org/wiki/Underhanded_C_Contest https://en.wikipedia.org/wiki/Underhanded_C_Contest
- fictioncircle 9y agoValid point. https://github.com/HainaLi/horcrux_password_manager https://github.com/HainaLi/horcrux_password_manager It is in JS at least. Underhanded C is likely an easier trick to manage.
- tzs 9y agoWhat do you mean by "treat it as code you authored"?
- fictioncircle 9y agoFor purposes of security paranoia, if you can perform a security audit on open source code it is just as good as any other code you've written. Idk about other people but I find anything I don't find security holes in myself "as good" as anything I've written. I've got the same set of assumptions/blinders/competence either way.
- MatthewWilkes 9y agoThat's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.
- kybernetikos 9y agoI recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts. https://github.com/kybernetikos/sinkless https://github.com/kybernetikos/sinkless I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.
- deleted 9y ago[deleted]
- JetSpiegel 9y agoUntil you have to change a password.
- tzs 9y agoHe addresses that on the page he linked to.
- pishpash 9y agoHow do you deal with devices that do not support extensions?
- kybernetikos 9y agoPoorly at present, but it runs as a website on anything with a recent browser: https://kybernetikos.github.io/sinkless/ https://kybernetikos.github.io/sinkless/ and you can copy and paste, or there is a node script that will generate the same passwords. I'd like to make the UI work better in general, but in particular on mobile devices. But then I have many projects I'd like to make time for, and this one is probably usable enough for me for now.
- _jal 9y agoAre you trying to tell me what my threat model should be? That makes me suspicious...
- thinkMOAR 9y agoNo, actually only stating truly paranoid people would not use a 3rd party password manager. Else you still have somewhat trust in third parties, making you not paranoid. Your reply however... stamps paranoid label on it :)
- admax88q 9y agoIf you were that paranoid you wouldn't be using a web browser in the first place. After all, its some 3rd party software that has access to your passwords. There seems to be a growing chatter on HN and elsewhere about how you can't trust free software because you didn't audit/write it yourself. I'm not sure if people actually believe that or use it as a way to point out how they're smarter than other people. Sure its possible that the free software contains something malicious, but such an attitude is not constructive. If you only used software you wrote yourself you might as well not use a computer. There are degrees of trust, balancing of risks, and free software has a much better reputation of not containing malicious code.
- awqrre 9y agoDon't forget about the OS, you probably didn't write that software either (you are doomed)... and even if you keep your password on paper or in your head, there could be a keylogger when the time comes to use that password.
- JohnStrange 9y agoI'm paranoid enough to only use my own password manager, but if you must use a password manager written by someone else then don't use one that runs in a web browser. Moreover, although this doesn't apply in this case, don't use a password manager that stores anything on a server not totally controlled by you.
- awqrre 9y agoa piece of paper in your wallet is probably safer in many cases... but not as convenient
- laumars 9y agoRationally I'd say if you are truly paranoid then you'd assume that any security software you did author isn't secure enough since you acknowledge that humans, including yourself, are fallible. Thus you would prefer to use independently audited, battle tested, solutions (albeit ones that don't sync to the cloud).
- deno 9y agoThis does NOT protect you from script injections, keyloggers, etc. Their approach in fact DOES.
- my_ghola 9y agoI authored my password manager. It doesn't store the passwords anywhere.