4 ms·

How often do you need to type passwords into a machine that you either cannot or are unwilling to sync with a decent password manager? How do you trust this mac

by kijin 9y ago

How often do you need to type passwords into a machine that you either cannot or are unwilling to sync with a decent password manager? How do you trust this machine not to record and exfiltrate everything you ever typed into it? IMO it's a Good Thing (tm) that I have to jump through hoops to access my passwords on unfamiliar machines. How does one even calculate H(username|service name|master password) on an unfamiliar machine that might not have a decent scripting language installed on it? If you asked me to do it on my father's laptop, for example, I'm gonna have to download Python first.

Sniperfish 9y ago
Re. the number of machines, it's something I've encountered as an obstacle from a fair proportion of people I've spoken about password managers to. I think its more a perceived issue than a real one. Just spitballing which systems I would realistically want access to passwords on, at a minimum, includes: personal desktop, personal laptop, tablet(s), cellphone(s), family (parent, sibling, in-laws, etc) computers, office desktop, office laptop. In my case (many cases?), the latter two prevent software installation, so I would need to manually type from a manager synced on my cell. Which really is no different to what is required for 2FA - just a longer character string. Overall, a some setup and synch related inconveniences but not to a damaging degree, which is why I think this is more a matter of perception - once you think through where you're typing passwords it appears less of an obstacle.
- darylfritz 9y ago
  > the [office computers] prevent software installation, so I would need to manually type from a manager synced on my cell. I don't know about other Password Managers, but LastPass lets you access your vault using any web browser. So long as your network doesn't block the LP site, you can access your password manager from anywhere.
  - NMDaniel 9y ago
    On a similar note, Keepass can be used without admin rights with the portable version, so you can keep the portable executable along with the encrypted db file in some secure and accessible email account/web service that your network doesn't block.
    - graedus 9y ago
      Indeed, or a USB drive.
- lostcolony 9y ago
  Chrome syncing browser plugins with a password manager makes personal desktop/laptop, and office desktop/laptop pretty trivial (barring, yes, overzealous IT). Cellphone and tablet I install the relevant app once and am done. Either way, web access to the credentials isn't uncommon, though you'll need a device for 2-factor confirmation it's you. For family devices...I wouldn't want to log into them. I don't trust their security sense and don't want to risk compromising my stuff because of their mistake. Why would I anyway; I have my cellphone on me, at minimum; I can access the account there.
pishpash 9y ago
Not often, but the times you do need to use those machines are probably the direst of times, i.e. emergencies.
- kijin 9y ago
  I make sure that I always remember at least two passwords in addition to the master password for my password manager: my bank and my email. If I need immediate access to any other site and I don't have access to my password manager, I'll just trigger a password reset and check my email.

by kijin 9y ago

Sniperfish 9y ago

Re. the number of machines, it's something I've encountered as an obstacle from a fair proportion of people I've spoken about password managers to. I think its more a perceived issue than a real one. Just spitballing which systems I would realistically want access to passwords on, at a minimum, includes: personal desktop, personal laptop, tablet(s), cellphone(s), family (parent, sibling, in-laws, etc) computers, office desktop, office laptop. In my case (many cases?), the latter two prevent software installation, so I would need to manually type from a manager synced on my cell. Which really is no different to what is required for 2FA - just a longer character string. Overall, a some setup and synch related inconveniences but not to a damaging degree, which is why I think this is more a matter of perception - once you think through where you're typing passwords it appears less of an obstacle.

darylfritz 9y ago
> the [office computers] prevent software installation, so I would need to manually type from a manager synced on my cell. I don't know about other Password Managers, but LastPass lets you access your vault using any web browser. So long as your network doesn't block the LP site, you can access your password manager from anywhere.
- NMDaniel 9y ago
  On a similar note, Keepass can be used without admin rights with the portable version, so you can keep the portable executable along with the encrypted db file in some secure and accessible email account/web service that your network doesn't block.
  - graedus 9y ago
    Indeed, or a USB drive.
lostcolony 9y ago
Chrome syncing browser plugins with a password manager makes personal desktop/laptop, and office desktop/laptop pretty trivial (barring, yes, overzealous IT). Cellphone and tablet I install the relevant app once and am done. Either way, web access to the credentials isn't uncommon, though you'll need a device for 2-factor confirmation it's you. For family devices...I wouldn't want to log into them. I don't trust their security sense and don't want to risk compromising my stuff because of their mistake. Why would I anyway; I have my cellphone on me, at minimum; I can access the account there.

pishpash 9y ago

Not often, but the times you do need to use those machines are probably the direst of times, i.e. emergencies.

kijin 9y ago
I make sure that I always remember at least two passwords in addition to the master password for my password manager: my bank and my email. If I need immediate access to any other site and I don't have access to my password manager, I'll just trigger a password reset and check my email.