14 ms·
Microsoft forced users to install a password manager with a critical flaw
- bcaulfield 9y agoWhat password managers do HN readers recommend?
- craftyguy 9y agoI use pass with git for synchronization. It's simple, and portable (passwords are gpg-encrypted plain text files)
- bhhaskin 9y agoCan't recommend Pass enough. It is great. Also you can use it with a smartcard.
- Cknight70 9y agoI'd recommend Keepass.
- bcaulfield 9y agoThoughts on LastPass? Good? Bad? Cromulent?
- Cknight70 9y agoDon't know if Last pass is good since I've never used it. I know its closed source and it has had numerous security exploits with it, though they seem to get fixed in a timely manner. That's just the negatives though it may be a good password manager for all I know about it. https://en.wikipedia.org/wiki/LastPass#Security_issues https://en.wikipedia.org/wiki/LastPass#Security_issues
- WorldMaker 9y agoThe biggest benefit I see to KeePass over LastPass is sync/cloud choice. LastPass I file in the category of password managers [1] that are more new-user-friendly than KeePass because they directly handle cross-device sync on their own cloud offerings. However, I like the flexibility to use any "file sync" tool I want to pass KeePass files around between my devices (or none at all, depending on the threat model of individual password files). That opens up flexibility to use things like Keybase File Share and Resilio Sync Encrypted Shares where you have additional options in in-transfer and at-rest encryption of your files. [1] In that category some security-minded friends that I trust have done their own research on the subject recommend Dashlane over LastPass.
- stephengillie 9y agoWindows and Android KeePass apps interoperate well over Dropbox.
- bllguo 9y agoThere have been security issues with LastPass. When Firefox switched to webextensions and broke lastpass, I switched to bitwarden, on the recommendation of other HN users
- inetknght 9y agoI use KeePass.
- DenisM 9y agoThese days I just go to Wirecutter with any such questions: https://thewirecutter.com/reviews/best-password-managers/ https://thewirecutter.com/reviews/best-password-managers/
- ploxiln 9y agoIt seems they only considered fancy-UI lots-of-features browser-integrated commercial password managers. I would never use any of those. For a graphical password manager, consider instead PasswordSafe, KeePass, KeePassXC. They're not complicated. Don't look for or enable any integrations. Manually copy your encrypted password database to google drive or dropbox. It's simple and secure. Anything more automated and "easy" is almost always found to be vulnerable. LastPass and OnePass have both had problems with their fancy online accounts and recovery systems and browser integrations. Just don't bother with all that crap, you don't need it.
- hungerstrike 9y agoI use KeePass and KeePass Touch because I'm not paying some service to store my password for me.
- INTPenis 9y agoI use pass(1) personally. It's just a shell wrapper for vim and gpg. But I'd recommend keepass if you want something graphical.
- Elvewyn 9y agoPass has QTPass, if you want to use it with a GUI!
- dewiz 9y agoEnpass, it's well integrated into browser and doesn't force to trust some random cloud
- dddddaviddddd 9y agoI use 1Password but AgileBits's push to cloud services is troubling — will definitely move to something else if they remove local vaults.
- ta98789878 9y agoI use KeePassX, because of this: https://mobile.twitter.com/taviso/status/817065731703468032?lang=en https://mobile.twitter.com/taviso/status/817065731703468032?...
- abrowne 9y agoYou want KeePassXC https://keepassxc.org/ https://keepassxc.org/
- mehrdadn 9y agoWhat is the benefit of KeePassXC over KeePass[X]? I just tried it and the lack of plugin or sync support was a deal-breaker for me. I have plugins for syncing to cloud storage, for browser integration, for OTP generation, etc., none of which it seems to support?
- abrowne 9y agoKeepassXC is the active fork of KeepassX. KeepassX/C are cross-platform Qt apps that use the same vault format as Keepass, a Windows app that apparently will run under Mono as well.
- mehrdadn 9y agoDo you know what he thinks of 1Password? e.g. I've seen this comment [1] on 1Password, but do you know what his actual thoughts are? He's not fond of it, but does he have anything concrete to say about it as to why? I have friends using 1Password and I would like to be able to tell them and give them concrete reasons to switch to KeePass if there are security issues with it. [1] https://twitter.com/taviso/status/760231214812844032 https://twitter.com/taviso/status/760231214812844032
- zie 9y agoThere aren't security issues with 1Password really, but there are other issues, mostly around the company AgileBits. From my other comment on this thread: These days AgileBits(the 1password people) are doing everything they can to get everyone onto a subscription plan, and are breaking local vaults slowly. Most people don't seem to recommend it anymore. The only security issue really is the online vault(which isn't a security issue per-say, but is a security weakness since your passwords are no longer under your direct control). This may or may not be an issue for you, depending on your security posture.
- darren_ 9y agoI just type a long string of random crap into the password field on sign-up and recover it with my 2-factor protected gmail account every time i actually need to log-in. In practise for the services I use this is almost never. This technique might not work so well for people who actually have to share devices, log out of things, etc.
- katastic 9y agoSo wait... you don't remember any of your passwords or write them down and hope you can recover them whenever you need them?
- Globz 9y agoKeePass + VeraCrypt container, never failed me. Before that I used TrueCrypt but it is no longer trustable.
- _qbxp 9y agoWhat's the VeraCrypt container for? Isn't the DB already encrypted?
- Globz 9y agoYes but because I sync KeePass over Dropbox I want to hide the true content of my data and + it adds another security layer to break before getting to my Password vault.
- mehrdadn 9y ago> Before that I used TrueCrypt but it is no longer trustable. Really? Why?
- Globz 9y agoWell unless you are talking about TrueCrypt "next" - https://truecrypt.ch/ https://truecrypt.ch/ then yeah I guess this one is safe but I was talking about the original version from - http://truecrypt.sourceforge.net/ http://truecrypt.sourceforge.net/ WARNING: Using TrueCrypt is not secure as it may contain unfixed security issues This page exists only to help migrate existing data encrypted by TrueCrypt. The development of TrueCrypt was ended in 5/2014 after Microsoft terminated support of Windows XP. Windows 8/7/Vista and later offer integrated support for encrypted disks and virtual disk images. Such integrated support is also available on other platforms (click here for more information). You should migrate any data encrypted by TrueCrypt to encrypted disks or virtual disk images supported on your platform.
- mehrdadn 9y agoOh, I did mean the original version. I was just asking because as far as I know, nobody has found any serious flaw in it. The developers have only stated that it may contain unfixed security issues because they are no longer supporting it. Consider that if any security issue was fixed in any of TrueCrypt's forks, then people would be saying TC is known to be insecure, and as far as I know this is not the case. So if you expect there to be any vulnerabilities in TC, you should also expect the same to be true for VC or TC.next, etc.
- scrollaway 9y ago(Pasting an old comment as reply, hope it's helpful!) If you're just starting, here's some guidance on setting up a password manager. First of all: Don't be afraid of using one. It's not just more secure, it's super convenient. Never again will you ask yourself: Did I make an account for this website/service? What email did I use? Never again will you have to remember a password. Using a password manager is a quality of life improvement. KeepassXC is what I recommend to people at this point. It's free and you own your data (your passwords). They live wherever you want them to live. There are plenty of online services that are supposedly more convenient but I have to say I trust them less -- YMMV (1Password is the best I'm aware of). https://keepassxc.org https://keepassxc.org If you do use keepassxc, you get the added benefit of being able to store 2FA settings in it as well (if you store them in the same database as your passwords, be aware that you lose the security benefit of a second factor, however it is still more secure than not having 2FA enabled due to the One-time password component). Put every account you ever made and ever make into keepass. Enable 2fa wherever you don't have it enabled. Add login URLs and notes. Generate your passwords from keepass itself; the password generator is really powerful and lets you very easily deal with site-specific shitty password limitations. I'm telling you this because, seriously, it's incredibly convenient to have this stuff as long as you're rigorous about maintaining it. Oh, also, keepass has the full history of all your passwords. Need to look up an old password? Go into details and look at "History". You can also attach files to items (items don't have to be accounts at all, you can use keepassxc as a simple encrypted storage db). Mobile support: Keepass2Android. Best android client, with google drive support. iOS I have no idea, suggestions welcome. IMPORTANT: BE STUPIDLY PARANOID AND RIGOROUSLY CAREFUL ABOUT YOUR MASTER PASSWORD. That thing, together with your keepass database, unlocks all your accounts ever. Use a really long passphrase that you will never have to write down (if you do decide to write it down because you don't trust yourself, store it in a safety deposit box, don't put it in a bloody drawer). Make sure the device you unlock the database on is malware-free. PS: Wondering what's up with Keepass vs. KeepassX vs. KeepassXC? Keepass is the original app, written in .NET but with poor multi-platform support. KeepassX is a rewrite in Qt and is a fantastic password manager, but has gone unmaintained recently. The open source community picked up the slack in the KeepassXC fork (after continuing countless attempts to upstream the patches) and has implemented lots of powerful features. I've switched to it and at this point I strongly believe it's the better client.
- dboreham 9y agogpg/pass
- zie 9y ago1password used to be the best paid solution out there, and Keepass(in various versions) the best free/OSS version. These days AgileBits(the 1password people) are doing everything they can to get everyone onto a subscription plan, and are breaking local vaults slowly. Most people don't seem to recommend it anymore. Now you have other options: * KeepassXC (the latest seemingly well-recommended keepass variant - but there are a bunch of them) * Bitwarden (it's OSS and can support author(s) with payment. Can run on your own server/machine while still supporting cross device sync) * Pass (and the go variant, and the Qt variant) uses GPG under the hood, basically just a directory/git repo full of encrypted text files. Sync across devices is your problem. I'm seriously evaluating Bitwarden to replace 1Password as it's pretty simple to understand and has a similar strategy as 1Password security wise, but is OSS.
- senectus1 9y ago+1 for BitWarden
- SpikeDad 9y agoGuess it's good I remove it in my deployments. Microsoft seems to be throwing good sense out the window in Windows 10. A number of items I remove get reinstalled during updates. Options I turn off get turned on as well. They're obviously playing on the majority of users' ignorance. This is despicable.
- gatmne 9y agoI've personally heard of two separate companies looking to transition away from Windows to Linux desktops for employees (one of whom I spoke with personally). I think this might be an indicator of a larger trend that's at its tipping point.
- StreamBright 9y agoThis is exactly the reason I will never use Windows again.
- Andrenid 9y agoThe last big Windows 10 update I did the other day completely reset me installation to stock. Wiped all my drivers including GPU, all my settings, reinstalled everything I'd tweaked over the months/years, the works. I've been meaning to ditch Windows (again) for a while and this is the final straw.
- ASalazarMX 9y ago> completely reset me installation to stock I'm picturing a very upset buccaneer.
- blibble 9y agoyep, the day Candy Crush reinstalled itself and re-appeared in my start menu after I explicitly removed it was the day I removed Windows on every single one of my machines, and it's never, ever coming back MS have always been known for producing poor quality software, but they'd never been actively untrustworthy and hostile to the end-user... that completely changed with Windows 10 2.5 years later and I don't feel as if I've lost anything, I guess it was the push I finally needed to dump Windows forever
- RcouF1uZ4gsC 9y ago>If an outsider can find a bug similar to the 16-month-old vulnerability so quickly and easily, it stands to reason people inside the software company should have found it long ago While true, it should be noted that Tavis Ormandy is not just any "outsider" and is something of a god when it comes to finding vulnerabilities.
- bomb199 9y agoI find this line of thinking pervasive among criticisms of all kinds of developers. Especially in video game forums! "If they did it, then our game dev can too!" Like large programs are just some kind of widget you can just move from place to place.
- partycoder 9y agoIt's the general direction of the software industry to neglect non-functional requirements. I make functional requirement emphasizers starting by product managers directly responsible for this. Their fantasy is to be the next Steve Jobs' era Apple but usually they first become the next Equifax.
- sergers 9y agoWindows 10 LTSB (long term servicing branch) should have been the original win10 release, with "add-ons" of the extra junk... instead they give you the most junk filled os and make you pay a premium (and very limited availability) for LTSB to strip it out and slow down the patches so they aren't forced down whenever ms wants. Good like buying it easily if you not a premier partner or msdn subscriber. We just qualified for our new client machine builds and will be providing that to customers only going forward for win10 requests. Have not checked if this password keeper still gets deployed, will have to check monday. If it's distributed part of Windows store, then it won't be cause that's stripped out itself