3 ms·

Question, assuming I have solved the problems of inputting the passwords and syncing and all other non-security-related items, are these password managers any m

Question, assuming I have solved the problems of inputting the passwords and syncing and all other non-security-related items, are these password managers any more secure than an AES encrypted file?

jpalomaki 9y ago
With files and reasonably secure passwords you are probably using copy-paste to move the passwords. Keeping sensitive information on clipboard is a risk. Not just because of malware, you might also accidentally paste the information to wrong place. Browser plugins can have issues, but they also improve security by only allowing you the enter the password when legitimate domain is requesting it. With copy-paste approach you might enter the password to some phishing site (obviously browser plugins can introduce their own security issues, so this is a trade-off). Dedicated applications may take steps to protect the sensitive information in the memory while a normal text editor probably does not do that. With AES encrypted file you would need to think the workflow to make sure the unencrypted contents is not exposed for example via temporary files. Dedicated appliation can also automatically lock the contents after some timeout, with text files you need to take care this manually.
- kodablah 9y ago
  Would definitely not use the clipboard. Might use stdout of a quick exe run, or might use native OS keyboard messages... but that's a different concern. My question here was just about the contents themselves and less about the handling. Maybe, as the author here did, I can just run a server conforming to bitwarden's API.
Santosh83 9y ago
Yes, a good password manager ought to securely erase temporary files and encrypt working memory and zero released memory. You don't get these extras dealing with a GPG encrypted file in a standard text editor.
- kodablah 9y ago
  I would assume no temporary files and short-lived process which reads/writes and dies. Then, of course, the burden is on the caller not to be careless with the state. I dunno. Just more curious here about the data at rest more than its use.
  - Santosh83 9y ago
    I'd assume data encrypted with AES (say by GPG) to be as secure as a password manager's DB, at rest. Provided you take care of adjust the iterations of the KDF, use a good KDF (like argon or scrypt), and tweak other parameters (like using a keyfile along with your passphrase) that a password manager might automatically set for you. But there should be no essential differences between the two. In fact since GPG's code is more battle tested than most password managers it might even be more secure, other factors disregarded as you mention.
ecesena 9y ago
I personally like deterministic ones. I recently wrote about that [1] and we’re building an app. Would love to hear what do you think. [1] https://hackernoon.com/how-i-manage-my-passwords-technical-version-8549dc1bde1e https://hackernoon.com/how-i-manage-my-passwords-technical-v...

Question, assuming I have solved the problems of inputting the passwords and syncing and all other non-security-related items, are these password managers any more secure than an AES encrypted file?

jpalomaki 9y ago

With files and reasonably secure passwords you are probably using copy-paste to move the passwords. Keeping sensitive information on clipboard is a risk. Not just because of malware, you might also accidentally paste the information to wrong place. Browser plugins can have issues, but they also improve security by only allowing you the enter the password when legitimate domain is requesting it. With copy-paste approach you might enter the password to some phishing site (obviously browser plugins can introduce their own security issues, so this is a trade-off). Dedicated applications may take steps to protect the sensitive information in the memory while a normal text editor probably does not do that. With AES encrypted file you would need to think the workflow to make sure the unencrypted contents is not exposed for example via temporary files. Dedicated appliation can also automatically lock the contents after some timeout, with text files you need to take care this manually.

kodablah 9y ago
Would definitely not use the clipboard. Might use stdout of a quick exe run, or might use native OS keyboard messages... but that's a different concern. My question here was just about the contents themselves and less about the handling. Maybe, as the author here did, I can just run a server conforming to bitwarden's API.

Santosh83 9y ago

Yes, a good password manager ought to securely erase temporary files and encrypt working memory and zero released memory. You don't get these extras dealing with a GPG encrypted file in a standard text editor.

kodablah 9y ago
I would assume no temporary files and short-lived process which reads/writes and dies. Then, of course, the burden is on the caller not to be careless with the state. I dunno. Just more curious here about the data at rest more than its use.
- Santosh83 9y ago
  I'd assume data encrypted with AES (say by GPG) to be as secure as a password manager's DB, at rest. Provided you take care of adjust the iterations of the KDF, use a good KDF (like argon or scrypt), and tweak other parameters (like using a keyfile along with your passphrase) that a password manager might automatically set for you. But there should be no essential differences between the two. In fact since GPG's code is more battle tested than most password managers it might even be more secure, other factors disregarded as you mention.

ecesena 9y ago

I personally like deterministic ones. I recently wrote about that [1] and we’re building an app. Would love to hear what do you think. [1] https://hackernoon.com/how-i-manage-my-passwords-technical-version-8549dc1bde1e https://hackernoon.com/how-i-manage-my-passwords-technical-v...