5 ms·

Except for the case where they entire password DB can be decrypted and read (in the case of 1Password 7, at least). Sure, a keylogger could eventually get all

Except for the case where they entire password DB can be decrypted and read (in the case of 1Password 7, at least). Sure, a keylogger could eventually get all of the passwords I use on the regular, but it couldn't get literally every password I have and in a nice, neat format along with where the passwords are used. Reading the current password from memory = keylogger, I'm not worried about that. Reading every password I have or have ever had, including (I assume) encrypted notes and such? = keylogger on steroids.

UncleMeat 8y ago
Is that different? "Eventually get all of your passwords" sounds just as bad to me, especially since only some passwords are worth anything and my email password can be used to reset all other passwords.
- oarsinsync 8y ago
  You can't reset my online banking login password by email. You can't reset my online banking operation password by email. You can't reset my crypto wallet passwords by email. If you can read all of these from memory without me ever having interacted with the password, you can take all my money and then what do I do?
  - UncleMeat 8y ago
    The malware just waits until you use one of these passwords? The threat model of "I have these crazy essential passwords that I literally never use" is worthless. It costs the malware author nothing to wait.
    - oarsinsync 8y ago
      Malware is like any other threat to any system. The longer it persists, the more likely it is to be detected and purged. Malware that exists purely transiently in my system is a lot more likely to be successful and remain undetected, than malware that persists.
  - Too 8y ago
    What bank does not use 2FA?! Only having your password should not expose your banking.
xoa 8y ago
>Sure, a keylogger could eventually get all of the passwords I use on the regular, but it couldn't get literally every password I have and in a nice, neat format along with where the passwords are used. But passwords aren't just about you, they're about the server they're also stored on too. Without a password manager, how do you propose remembering unique fully random passwords for dozens to hundreds of services over the course of decades? And they must still be easy enough to enter that most people will actually use it. And also be trivial to change at will, for when (not if) the password database is compromised. And in fact you directly bring up the problem of that being worse for services you use extremely infrequently. So if you use it frequently the keylogger gains it anyway, and if you don't use it frequently then what's your usable system again? Also, are not the most important things you want taken the least also the ones that tend to be used the most frequently? And with access to your email and in fact all communication services used on that system you don't see how an attacker wouldn't just be able to "I forgot my password" for many if not most services? >Reading the current password from memory = keylogger, I'm not worried about that. You're not worried about your system being rooted? I'd say you have an awfully different set of priorities when it comes to security then most of the world even beyond HN.
- spudlyo 8y ago
  A notebook and pencil in your desk drawer solves this problem reasonably well if you're patient. In some ways that is more secure than having all the passwords stored where an attacker can grab them from the comfort of their living room.
  - sleepybrett 8y ago
    .. and when you are trying to log into one of those accounts when you are away from your desk drawer?
    - spudlyo 8y ago
      You wait 'til you get home? Personally, I use 1Password, but I have a friend who swears by the notebook approach. He also caries a feature phone and uses a desktop computer, which makes it a lot more practical.
tedunangst 8y ago
At some point you're going to enter the master password to unlock the next password, at which point it will be stolen, giving up every password.
- Faark 8y ago
  Only with additional work, if the attacker also extracts your password file. That's something I'd like some resistance against anyway, so malware can't simply do that and potentially decrypt it a few years down the line. This of cause doesn't help against a resourceful and highly targeted attack, but that's less of a concern for me than some malware toolbox adding support for common password managers.
  - WorldMaker 8y ago
    Also, on Windows, KeePass at least offers the option to always ask for the master password only in the same secure desktop that UAC and login/logout use. (I don't know why this isn't the default behavior, other than maybe cross-platform compat, but it is not the default. First thing I turn on for fresh installs.) That at least helps mitigate against most software keyloggers / remote automation hack attempts. (Leading the threat concerns back to rootkits and physical hardware access.)
m1sta_ 8y ago
Masterpassword compromised = all compromised.

UncleMeat 8y ago

Is that different? "Eventually get all of your passwords" sounds just as bad to me, especially since only some passwords are worth anything and my email password can be used to reset all other passwords.

oarsinsync 8y ago
You can't reset my online banking login password by email. You can't reset my online banking operation password by email. You can't reset my crypto wallet passwords by email. If you can read all of these from memory without me ever having interacted with the password, you can take all my money and then what do I do?
- UncleMeat 8y ago
  The malware just waits until you use one of these passwords? The threat model of "I have these crazy essential passwords that I literally never use" is worthless. It costs the malware author nothing to wait.
  - oarsinsync 8y ago
    Malware is like any other threat to any system. The longer it persists, the more likely it is to be detected and purged. Malware that exists purely transiently in my system is a lot more likely to be successful and remain undetected, than malware that persists.
- Too 8y ago
  What bank does not use 2FA?! Only having your password should not expose your banking.

xoa 8y ago

>Sure, a keylogger could eventually get all of the passwords I use on the regular, but it couldn't get literally every password I have and in a nice, neat format along with where the passwords are used. But passwords aren't just about you, they're about the server they're also stored on too. Without a password manager, how do you propose remembering unique fully random passwords for dozens to hundreds of services over the course of decades? And they must still be easy enough to enter that most people will actually use it. And also be trivial to change at will, for when (not if) the password database is compromised. And in fact you directly bring up the problem of that being worse for services you use extremely infrequently. So if you use it frequently the keylogger gains it anyway, and if you don't use it frequently then what's your usable system again? Also, are not the most important things you want taken the least also the ones that tend to be used the most frequently? And with access to your email and in fact all communication services used on that system you don't see how an attacker wouldn't just be able to "I forgot my password" for many if not most services? >Reading the current password from memory = keylogger, I'm not worried about that. You're not worried about your system being rooted? I'd say you have an awfully different set of priorities when it comes to security then most of the world even beyond HN.

spudlyo 8y ago
A notebook and pencil in your desk drawer solves this problem reasonably well if you're patient. In some ways that is more secure than having all the passwords stored where an attacker can grab them from the comfort of their living room.
- sleepybrett 8y ago
  .. and when you are trying to log into one of those accounts when you are away from your desk drawer?
  - spudlyo 8y ago
    You wait 'til you get home? Personally, I use 1Password, but I have a friend who swears by the notebook approach. He also caries a feature phone and uses a desktop computer, which makes it a lot more practical.

tedunangst 8y ago

At some point you're going to enter the master password to unlock the next password, at which point it will be stolen, giving up every password.

Faark 8y ago
Only with additional work, if the attacker also extracts your password file. That's something I'd like some resistance against anyway, so malware can't simply do that and potentially decrypt it a few years down the line. This of cause doesn't help against a resourceful and highly targeted attack, but that's less of a concern for me than some malware toolbox adding support for common password managers.
- WorldMaker 8y ago
  Also, on Windows, KeePass at least offers the option to always ask for the master password only in the same secure desktop that UAC and login/logout use. (I don't know why this isn't the default behavior, other than maybe cross-platform compat, but it is not the default. First thing I turn on for fresh installs.) That at least helps mitigate against most software keyloggers / remote automation hack attempts. (Leading the threat concerns back to rootkits and physical hardware access.)

m1sta_ 8y ago

Masterpassword compromised = all compromised.