5 ms·

Why’s there no standard and then MS, Apple etc. can include a pw manager straight into the core OS.

by 5_minutes 9y ago

dijit 9y ago
Apple has this; it's called iCloud keychain.
- drdaeman 9y ago
  - Microsoft: Windows Vault aka Credential Manager - Mainstream GNU/Linux DEs: Gnome Keyring and KDE KWallet (both implement common XDG API) - Android: Smart Lock Passwords Neither is interoperable with each other, at least not without external tools (I'm unaware if those exist). I wrote a comment about it the other day: https://news.ycombinator.com/item?id=15697011 https://news.ycombinator.com/item?id=15697011 (it was about syncing passwords across browsers)
- stinky613 9y ago
  Idk if I'm right or you are, but I read the GP as meaning "standard _across platforms_". If my interpretation is correct, then I think I need to be the cliche bearer for the XKCD reference: https://xkcd.com/927/ https://xkcd.com/927/ If your interpretation is correct then yeah, Apple has Keychain. Also, I think I recently got an OS-level 'save password' prompt for something recently on my machine running Win10 Pro v1709... Can anyone confirm or refute this?[1] No clue if this is just a new skin for the existing Credential Manager, something new entirely, or just confusion on my part. [1] I just now tried Googling for information about this, but I nearly drowned in the sea of links about IE password saving and Edge support for password manager plugins
- tzs 9y ago
  Speaking of iCloud keychain, anyone know of a command line tool for manipulating its contents? For local keychains there is /usr/bin/security, but it does not see iCloud keychains.
Santosh83 9y ago
I voiced this same question a few days back on HN. I presume this is just not an important enough area to bring all the big corps and orgs together to brainstorm a standard and then implement it across their devices and OS. Truth is, most people are shockingly poor when it comes to security. I'd bet that 80% of computer users just store their password in the built-in browser password managers (without even a Master password set) and be done with it. Even worse, I've come across folks storing their passwords on a plain text file. For the minority who do want secure password management, there are a plethora of solutions, but nothing is completely integrated and seamless. It's all a mish-mash of standalone desktop programs, browser plugins & extensions, web services, cloud storage and so on, all stitched together ad hoc. This is doable for those who're familiar with security/encryption and can set it all up, maintain and update it, but utterly a non-starter for an average user or smartphone consumer.
- ktta 9y ago
  >I'd bet that 80% of computer users just store their password in the built-in browser password managers (without even a Master password set) and be done with it. The misconception here is that setting a master password provides any real security. It isn't much different if you use a master password or not, once you have autofill, you're already compromised in that threat model.
  - pbhjpbhj 9y ago
    Huh? So, someone boots your computer, assuming no login password, then launch your browser to get your passwords but need a master password -- how is that not protection? From the point of view of cracking the password file I'd assume that Mozilla use an encryption key for passing the password file around, just that the key is available to anyone who has access to any of your browsers?
    - ktta 9y ago
      http://lmgtfy.com/?q=how+to+get+password+from+autofill http://lmgtfy.com/?q=how+to+get+password+from+autofill

Why’s there no standard and then MS, Apple etc. can include a pw manager straight into the core OS.

dijit 9y ago

Apple has this; it's called iCloud keychain.

drdaeman 9y ago
- Microsoft: Windows Vault aka Credential Manager - Mainstream GNU/Linux DEs: Gnome Keyring and KDE KWallet (both implement common XDG API) - Android: Smart Lock Passwords Neither is interoperable with each other, at least not without external tools (I'm unaware if those exist). I wrote a comment about it the other day: https://news.ycombinator.com/item?id=15697011 https://news.ycombinator.com/item?id=15697011 (it was about syncing passwords across browsers)
stinky613 9y ago
Idk if I'm right or you are, but I read the GP as meaning "standard _across platforms_". If my interpretation is correct, then I think I need to be the cliche bearer for the XKCD reference: https://xkcd.com/927/ https://xkcd.com/927/ If your interpretation is correct then yeah, Apple has Keychain. Also, I think I recently got an OS-level 'save password' prompt for something recently on my machine running Win10 Pro v1709... Can anyone confirm or refute this?[1] No clue if this is just a new skin for the existing Credential Manager, something new entirely, or just confusion on my part. [1] I just now tried Googling for information about this, but I nearly drowned in the sea of links about IE password saving and Edge support for password manager plugins
tzs 9y ago
Speaking of iCloud keychain, anyone know of a command line tool for manipulating its contents? For local keychains there is /usr/bin/security, but it does not see iCloud keychains.

Santosh83 9y ago

I voiced this same question a few days back on HN. I presume this is just not an important enough area to bring all the big corps and orgs together to brainstorm a standard and then implement it across their devices and OS. Truth is, most people are shockingly poor when it comes to security. I'd bet that 80% of computer users just store their password in the built-in browser password managers (without even a Master password set) and be done with it. Even worse, I've come across folks storing their passwords on a plain text file. For the minority who do want secure password management, there are a plethora of solutions, but nothing is completely integrated and seamless. It's all a mish-mash of standalone desktop programs, browser plugins & extensions, web services, cloud storage and so on, all stitched together ad hoc. This is doable for those who're familiar with security/encryption and can set it all up, maintain and update it, but utterly a non-starter for an average user or smartphone consumer.

ktta 9y ago
>I'd bet that 80% of computer users just store their password in the built-in browser password managers (without even a Master password set) and be done with it. The misconception here is that setting a master password provides any real security. It isn't much different if you use a master password or not, once you have autofill, you're already compromised in that threat model.
- pbhjpbhj 9y ago
  Huh? So, someone boots your computer, assuming no login password, then launch your browser to get your passwords but need a master password -- how is that not protection? From the point of view of cracking the password file I'd assume that Mozilla use an encryption key for passing the password file around, just that the key is available to anyone who has access to any of your browsers?
  - ktta 9y ago
    http://lmgtfy.com/?q=how+to+get+password+from+autofill http://lmgtfy.com/?q=how+to+get+password+from+autofill