6 ms·

Great article, as always. I think one of the key points is how awful password managers are for non-technical people to use. It's not necessarily the developers

Great article, as always. I think one of the key points is how awful password managers are for non-technical people to use. It's not necessarily the developers' fault because it's difficult to interact with all the things they need to, but it makes it practically impossible to get someone to use one unless they're technical enough to be able to figure out all the random issues that come up all the time. I'd love to be able to get some non-technical family/friends to use one, but there are just way too many times that showing someone how to use a password manager goes something like: "Okay, so now you've generated a password and you click 'Register' and... oh hold on, the page redirected for some reason and the pop-up to save the account info is gone, so, uh... well, I think there's a generated-password history page somewhere, let me just look through the Settings area even though it's not a setting... okay, there it is, so it should be this one. I'll just copy that and now I have to create a new vault entry for the site manually by typing in everything and pasting this password in there, and then..." It's terrible, because a password manager that would just work and stay out of the way could make such a huge difference to general account security, but they all seem to still be difficult to use and require you to have a pretty good understanding of what's going on to be able to deal with random problems.

simonw 7y ago
Current versions of iOS have a built-in password manager as part of Mobile Safari - it feels like this could be a much more user-friendly option, I'd love to see some formal usability studies of how it compares to 1Password et al.
- dev_dull 7y ago
  It works really well provided you enable iCloud and use safari as both desktop and mobile browser, which I think is probably a lot of people in the author’s orbit.
  - ec109685 7y ago
    On desktop Mac, you can copy password from keychain to chrome. Kinda crappy, but gets job done in slightly more secure manner as Notes.
    - saagarjha 7y ago
      You can do this on iOS as well, but it's somewhat more complicated.
      - ec109685 7y ago
        Not that much more. Good point!
- ec109685 7y ago
  The iOS password manager also works in properly designed apps as well. Websites and apps must test themselves with the popular password managers and ensure it is a smooth experience — otherwise they are being security hostile. The other dumb thing is forcing there to be a password for an account. If I reset my password via an email reset, just let me click on a link to login into the app (ensure things like deep linking into apps work). A one time token is way better than any password. Let me go through that flow on multiple devices without resetting the first device. Send me an email every time a new device receives a sign in. If email is weakest link (password reset) don’t make me even less secure by requiring me to dream up another password. Now there are two vectors to crack me.
techntoke 7y ago
Many of them stay out of the way. I use a more technical one (Browserpass) and even that is a generate password once and it automatically syncs with Google Drive or whatever file sync service you want.
saghm 7y ago
Are these issues that a "dumber" password manager would have? I'm thinking of one that would run in a standalone app and only have the ability to generate passwords and save them for a given website identifier (presumably the domain name), look up passwords given the identifier, and delete entries when no longer needed. The passwords here could be all encrypted with a single password that the user has to remember, and then the user can just copy/paste the password from the manager to the browser as needed. I think OS X has something like this built-in (I think it's called Keychain, although I'm not a Mac user, so I'm not sure if it actually has the exact semantics described here). My guess is that a lot of the issues you're talking about mostly stem from trying to interact directly with the webpage, which I'm not convinced is a robust model if the goal is to optimize for non-technical users.
- jjnoakes 7y ago
  That is certainly easier to use, but comes with higher risks of phishing. The Holy Grail would somehow do both.
- mooreds 7y ago
  I use one of those. It's open source software and I have the password safe file on my Dropbox account so it is everywhere and backed up. That way I need to remember at most two passwords (Dropbox and my password manager). Works great for me and I have used it for small teams as well. https://www.pwsafe.org/ https://www.pwsafe.org/
- shakna 7y ago
  Sounds like pass [0]. Which is dead simple, GPG. (And optionally git for sync). Whilst pass itself is a CLI, meaning non-technical users, it also has a ton of web browser extensions that target it and are dead simple to use. [0] https://www.passwordstore.org/ https://www.passwordstore.org/
tptacek 7y ago
I think password managers could be easier to use, but that the fundamental problem here is, well, fundamental. The major security win of a password manager is that you end up randomizing your passwords across all your accounts; it does no good to "manage" a series of related passwords that will get credential-stuffed as soon as one of your providers has a breach. To get specialized passwords for all your accounts, you have to be able to reliably use the password manager on all your devices, which means not only configuring it and regenerating passwords the first time, but getting it to work again and synchronize it on every new device you use. If you're motivated, you can get this to work. But people are not generally motivated. Password managers are a thing I could confidently roll out as a security officer for a startup, where people are in effect being paid to take what I tell them about opsec seriously. They're not something I could confidently roll out in a campaign. If you're going to get a campaign to do 2, maybe 3 things, you're going to tackle 2FA, phishing (security keys) and attachments (Chromebooks, iPads, and GDrive viewers). If you could do a 4th thing, I don't know that password managers would make that list. (For the record, I did one training with Maciej, at an NGO, not a campaign, with rooms full of people who were, if not well-motivated, at least super respectful of our time and who had at least the appearance of being attentive to what we were telling them. And getting 1Password working for any of them proved hopeless. I think even I stopped being able to make 1Password work for a couple days after trying it with them. Unlike me, Maciej has a gift for talking to people about this stuff, and also unlike me, he did these trainings dozens of times. If the best password manager he could roll out was Notes.app, people who make password managers might want to figure out why that is.)
- maxerickson 7y ago
  I want to be able to pass authentications from my phone to my laptop or tablet. The interaction model seems better there, but there's so much missing integration.
  - jiveturkey 7y ago
    What exactly does 'pass authentications' mean? Apple has app handoff which does this. Or do you just mean keychain/password sync? Which most if not all the major password managers have.
SlowRobotAhead 7y ago
I put my mom on LastPass. She has 2FA enabled and working, we can share passwords to each other, she’s happy to access via PC browser extension or iPhone, and she can’t possibly screw it up. I think the easy system already exists.
tomglynch 7y ago
A password manager provides the exact same benefits as the website hashing the users password client side with a salt - before sending the password as per usual (over SSL and then hashing the hashed password server side also). Why is this not done?
- ec109685 7y ago
  Huh? If I log out, how does the website let me log in again?
  - tomglynch 7y ago
    Insert your password, it is appended with a salt and hashed, and then sent to the server which logs you in.
    - ec109685 7y ago
      What is the salt based on?
- shakna 7y ago
  Then your password is just the hash and salt. And presumeably you're generating those with JavaScript, which adds a surface to target to exfiltrate passwords. No need to get into the server, just inject some JS or redirect a CDN or... It doesn't actually add any security is the short story.
  - tomglynch 7y ago
    > Then your password is just the hash and salt. Yes, and by that it appears random. Which is exactly what we want and what password managers provide. > just inject some JS or redirect a CDN or... This is the case anyway with regular passwords. > It doesn't actually add any security is the short story. Are you sure?
    - shakna 7y ago
vinceguidry 7y ago
I tried getting an older friend of mine to use a password manager. After a few hours, we were back to using one password. I'm now convinced that the way forward with the technically unsophisticated is indeed abstinence. Do not bank online, treat the internet as a place where everything you do is public, and deal with threats as they arise. As far as password managers have come, they're still only usable by power users, normal users can be educated to use them, but the truly unsophisticated really should just stay offline. Fear is a far easier sell than mastery.
- idlewords 7y ago
  Banking is one of the safer things you can do online, thanks to the high level of regulation and consumer protection around the financial industry.
  - u801e 7y ago
    Though they tend to be the ones that have password length and character restrictions.
    - dredmorbius 7y ago
      For better or worse, banks tend to use back-end risk-prediction and risk-prevention methods. Those stop-loss much, though by no means all, fraud losses. One unified model of understanding all the FIRE sector (finance, insurance, real estate) is to consider them as fundamentally attendant to the question of managing risk. To a vastly greater extant than any other economic sector.
ssully 7y ago
Outside of what you describe (the little edge case issue that pop up 5% of the time), I found the biggest problem for on boarding for password managers is just time. I was able to successfully get my Dad to switch to LastPass, but it took a lot of time to recontextualize what he knew about passwords before, and how to work LastPass into his daily life. After the initial setup (which involved setting up the account, showing how it works, and migrating about 25% of his passwords), he would ask me questions about it every few days. Just basic stuff like what to do when some sites don't work nice with it, LastPass not saving a password correctly, and other stuff. Once he did learn it though, it has been pretty much smooth sailing. I am only really familiar with KeePass and LastPass, but both programs have pretty terrible on boarding. LastPass has an ok 'how it works' [1] page, but what these apps really need is a guided tour/tutorial explaining what a password manager is, how to use it, and how to migrate your current password setup over to theirs. Using a password manager almost has it's own language, and teaching the users that language is the hardest part in my limited experience. [1]: https://www.lastpass.com/how-lastpass-works https://www.lastpass.com/how-lastpass-works
thirdsun 7y ago
I just introduced 1Password in our company, to our mostly non-technical staff and being a long time 1Password user myself it was indeed surprisingly complicated and involved more friction than most of us here would expect. One of the major barriers was explaining that the actual process of moving to secure, unique passwords requires changing them manually at every service in a repeated sequence of back and forth between the service' configuration and 1Password. Users expected the changes made in 1Password to apply and automatically sync to whatever service they were changing at the moment, which is of course not possible. Another issue were domains, which are basically the only way to connect a 1Password entry to a website. Naturally I had to explain to keep the website/domain attribute as short as possible to avoid problems like 1Password not recognizing that the current website at foo.ebay.com does in fact belong to the entry with the attribute bar.ebay.com. This isn't helped by the fact that 1Password automatically suggest creating entries it recognizes as new, which often include specific login domains and urls. Setting ebay.com as website attribute is the right way to do it, but of course this is rather confusing for most people. I'd argue that most people might be better off without the browser extension and should instead start with the simplified copy and paste process of manually opening 1Password whenever a sign in is required.
- jiveturkey 7y ago
  > Users expected the changes made in 1Password to apply and automatically sync to whatever service they were changing at the moment, which is of course not possible. Of course it is possible, it's just not implemented. There have been proposals for standard URLs that would accomplish this, but none of these have taken off. Just wasn't sure if you meant not possible "today" or not possible "at all".
  - thirdsun 7y ago
    Yes, I know - we had this discussion about a potential standard set of user configuration URLs just recently here on HN, but in my comment it was meant as not possible right now.

simonw 7y ago

Current versions of iOS have a built-in password manager as part of Mobile Safari - it feels like this could be a much more user-friendly option, I'd love to see some formal usability studies of how it compares to 1Password et al.

dev_dull 7y ago
It works really well provided you enable iCloud and use safari as both desktop and mobile browser, which I think is probably a lot of people in the author’s orbit.
- ec109685 7y ago
  On desktop Mac, you can copy password from keychain to chrome. Kinda crappy, but gets job done in slightly more secure manner as Notes.
  - saagarjha 7y ago
    You can do this on iOS as well, but it's somewhat more complicated.
    - ec109685 7y ago
      Not that much more. Good point!
ec109685 7y ago
The iOS password manager also works in properly designed apps as well. Websites and apps must test themselves with the popular password managers and ensure it is a smooth experience — otherwise they are being security hostile. The other dumb thing is forcing there to be a password for an account. If I reset my password via an email reset, just let me click on a link to login into the app (ensure things like deep linking into apps work). A one time token is way better than any password. Let me go through that flow on multiple devices without resetting the first device. Send me an email every time a new device receives a sign in. If email is weakest link (password reset) don’t make me even less secure by requiring me to dream up another password. Now there are two vectors to crack me.

techntoke 7y ago

Many of them stay out of the way. I use a more technical one (Browserpass) and even that is a generate password once and it automatically syncs with Google Drive or whatever file sync service you want.

saghm 7y ago

Are these issues that a "dumber" password manager would have? I'm thinking of one that would run in a standalone app and only have the ability to generate passwords and save them for a given website identifier (presumably the domain name), look up passwords given the identifier, and delete entries when no longer needed. The passwords here could be all encrypted with a single password that the user has to remember, and then the user can just copy/paste the password from the manager to the browser as needed. I think OS X has something like this built-in (I think it's called Keychain, although I'm not a Mac user, so I'm not sure if it actually has the exact semantics described here). My guess is that a lot of the issues you're talking about mostly stem from trying to interact directly with the webpage, which I'm not convinced is a robust model if the goal is to optimize for non-technical users.

jjnoakes 7y ago
That is certainly easier to use, but comes with higher risks of phishing. The Holy Grail would somehow do both.
mooreds 7y ago
I use one of those. It's open source software and I have the password safe file on my Dropbox account so it is everywhere and backed up. That way I need to remember at most two passwords (Dropbox and my password manager). Works great for me and I have used it for small teams as well. https://www.pwsafe.org/ https://www.pwsafe.org/
shakna 7y ago
Sounds like pass [0]. Which is dead simple, GPG. (And optionally git for sync). Whilst pass itself is a CLI, meaning non-technical users, it also has a ton of web browser extensions that target it and are dead simple to use. [0] https://www.passwordstore.org/ https://www.passwordstore.org/

tptacek 7y ago

I think password managers could be easier to use, but that the fundamental problem here is, well, fundamental. The major security win of a password manager is that you end up randomizing your passwords across all your accounts; it does no good to "manage" a series of related passwords that will get credential-stuffed as soon as one of your providers has a breach. To get specialized passwords for all your accounts, you have to be able to reliably use the password manager on all your devices, which means not only configuring it and regenerating passwords the first time, but getting it to work again and synchronize it on every new device you use. If you're motivated, you can get this to work. But people are not generally motivated. Password managers are a thing I could confidently roll out as a security officer for a startup, where people are in effect being paid to take what I tell them about opsec seriously. They're not something I could confidently roll out in a campaign. If you're going to get a campaign to do 2, maybe 3 things, you're going to tackle 2FA, phishing (security keys) and attachments (Chromebooks, iPads, and GDrive viewers). If you could do a 4th thing, I don't know that password managers would make that list. (For the record, I did one training with Maciej, at an NGO, not a campaign, with rooms full of people who were, if not well-motivated, at least super respectful of our time and who had at least the appearance of being attentive to what we were telling them. And getting 1Password working for any of them proved hopeless. I think even I stopped being able to make 1Password work for a couple days after trying it with them. Unlike me, Maciej has a gift for talking to people about this stuff, and also unlike me, he did these trainings dozens of times. If the best password manager he could roll out was Notes.app, people who make password managers might want to figure out why that is.)

maxerickson 7y ago
I want to be able to pass authentications from my phone to my laptop or tablet. The interaction model seems better there, but there's so much missing integration.
- jiveturkey 7y ago
  What exactly does 'pass authentications' mean? Apple has app handoff which does this. Or do you just mean keychain/password sync? Which most if not all the major password managers have.

SlowRobotAhead 7y ago

I put my mom on LastPass. She has 2FA enabled and working, we can share passwords to each other, she’s happy to access via PC browser extension or iPhone, and she can’t possibly screw it up. I think the easy system already exists.

tomglynch 7y ago

A password manager provides the exact same benefits as the website hashing the users password client side with a salt - before sending the password as per usual (over SSL and then hashing the hashed password server side also). Why is this not done?

ec109685 7y ago
Huh? If I log out, how does the website let me log in again?
- tomglynch 7y ago
  Insert your password, it is appended with a salt and hashed, and then sent to the server which logs you in.
  - ec109685 7y ago
    What is the salt based on?
shakna 7y ago
Then your password is just the hash and salt. And presumeably you're generating those with JavaScript, which adds a surface to target to exfiltrate passwords. No need to get into the server, just inject some JS or redirect a CDN or... It doesn't actually add any security is the short story.
- tomglynch 7y ago
  > Then your password is just the hash and salt. Yes, and by that it appears random. Which is exactly what we want and what password managers provide. > just inject some JS or redirect a CDN or... This is the case anyway with regular passwords. > It doesn't actually add any security is the short story. Are you sure?
  - shakna 7y ago

vinceguidry 7y ago

I tried getting an older friend of mine to use a password manager. After a few hours, we were back to using one password. I'm now convinced that the way forward with the technically unsophisticated is indeed abstinence. Do not bank online, treat the internet as a place where everything you do is public, and deal with threats as they arise. As far as password managers have come, they're still only usable by power users, normal users can be educated to use them, but the truly unsophisticated really should just stay offline. Fear is a far easier sell than mastery.

idlewords 7y ago
Banking is one of the safer things you can do online, thanks to the high level of regulation and consumer protection around the financial industry.
- u801e 7y ago
  Though they tend to be the ones that have password length and character restrictions.
  - dredmorbius 7y ago
    For better or worse, banks tend to use back-end risk-prediction and risk-prevention methods. Those stop-loss much, though by no means all, fraud losses. One unified model of understanding all the FIRE sector (finance, insurance, real estate) is to consider them as fundamentally attendant to the question of managing risk. To a vastly greater extant than any other economic sector.

ssully 7y ago

Outside of what you describe (the little edge case issue that pop up 5% of the time), I found the biggest problem for on boarding for password managers is just time. I was able to successfully get my Dad to switch to LastPass, but it took a lot of time to recontextualize what he knew about passwords before, and how to work LastPass into his daily life. After the initial setup (which involved setting up the account, showing how it works, and migrating about 25% of his passwords), he would ask me questions about it every few days. Just basic stuff like what to do when some sites don't work nice with it, LastPass not saving a password correctly, and other stuff. Once he did learn it though, it has been pretty much smooth sailing. I am only really familiar with KeePass and LastPass, but both programs have pretty terrible on boarding. LastPass has an ok 'how it works' [1] page, but what these apps really need is a guided tour/tutorial explaining what a password manager is, how to use it, and how to migrate your current password setup over to theirs. Using a password manager almost has it's own language, and teaching the users that language is the hardest part in my limited experience. [1]: https://www.lastpass.com/how-lastpass-works https://www.lastpass.com/how-lastpass-works

thirdsun 7y ago

I just introduced 1Password in our company, to our mostly non-technical staff and being a long time 1Password user myself it was indeed surprisingly complicated and involved more friction than most of us here would expect. One of the major barriers was explaining that the actual process of moving to secure, unique passwords requires changing them manually at every service in a repeated sequence of back and forth between the service' configuration and 1Password. Users expected the changes made in 1Password to apply and automatically sync to whatever service they were changing at the moment, which is of course not possible. Another issue were domains, which are basically the only way to connect a 1Password entry to a website. Naturally I had to explain to keep the website/domain attribute as short as possible to avoid problems like 1Password not recognizing that the current website at foo.ebay.com does in fact belong to the entry with the attribute bar.ebay.com. This isn't helped by the fact that 1Password automatically suggest creating entries it recognizes as new, which often include specific login domains and urls. Setting ebay.com as website attribute is the right way to do it, but of course this is rather confusing for most people. I'd argue that most people might be better off without the browser extension and should instead start with the simplified copy and paste process of manually opening 1Password whenever a sign in is required.

jiveturkey 7y ago
> Users expected the changes made in 1Password to apply and automatically sync to whatever service they were changing at the moment, which is of course not possible. Of course it is possible, it's just not implemented. There have been proposals for standard URLs that would accomplish this, but none of these have taken off. Just wasn't sure if you meant not possible "today" or not possible "at all".
- thirdsun 7y ago
  Yes, I know - we had this discussion about a potential standard set of user configuration URLs just recently here on HN, but in my comment it was meant as not possible right now.