8 ms·
I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install La
by trianglem 7y ago
I agree with all of this except password managers. If you use a lot of different public computers or temporary work laptops they don’t always let you install LastPass, so I frequently ended up being unable to access my accounts.
- nickthegreek 7y agoI access my manager from my phone and type them in. I would never install my LastPass on a public computer even if they let me.
- Sohcahtoa82 7y agoAnd then you've got your phone open, displaying your password to shoulder surfers, for as long as it takes to type in your password.
- cbm-vic-20 7y agoI have a hard enough time typing 4mfkD.Q.27cC8,'@eG}a4{\* , I am very much not worried about a "shoulder surfer" either seeing the cleartext password on my tiny phone screen, or watching all of those keystrokes without me noticing them.
- naniwaduni 7y agoI'd be more concerned about it getting caught on camera.
- diamondo25 7y agoThey used to have a mobile page you could login to. It was really plain but it did what it did best: provide an easy and clean way to access your passwords when you are somewhere. It was something like https://lastpass.com/mobile https://lastpass.com/mobile ...
- fluidcruft 7y agoIt would be really cool if you could plug your phone in and it appeared as a USB keyboard device and you could "type" the password from the password manager that way without ever giving the computer access to anything except that password. Maybe some sort of simple USB dongle (like a yubikey) could be fed by the phone via bluetooth or nfc to do this?
- peteretep 7y agoIt would be even cooler if I could open an app on my phone, point it at a QR code on screen, and not have anything else bother me
- trillic 7y agoThis is (sorta) how SQRL works. https://www.grc.com/sqrl/sqrl.htm https://www.grc.com/sqrl/sqrl.htm
- fragmede 7y agoWhich, to be fair, is close to how it works inside Apple's walled garden. Logging into iCloud on a new computer will cause the iPhone attached to that account to pop-up a "confirm login" dialog, so the second factor for login is as unobtrusive as possible.
- tomp 7y agoNo you still need a password, which also makes it insecure on a public computer (where keyloggers might be installed). Instead, the better solution would be, you point your phone to a QR code on the computer screen, press “confirm”, the computer is magically logged in, until you then press “log out” on your phone and the computer is logged out.
- tatersolid 7y agoYou’ve just described SQRL
- 7y ago
- bashinator 7y agoIt would be even cooler if there were no possible vector for the computer to then compromise your phone, but I don't really see that happening.
- lostlogin 7y agoThat gets old very fast too though. Copying a long and complicated password manually is pretty grim.
- xmprt 7y agoPardon my ignorance but if you're worried about the computer being compromised so that they could somehow access your LastPass, why would you even use it for any authenticated work in the first place?
- toomuchtodo 7y agoFor scenarios like this, where the hardware is untrusted, Yubikey type devices are really the only solution (where the device can present as a user input device, and provide the necessary string secret). Everyone else can use a password manager. EDIT: If you're on an untrusted device, should you really be putting secrets into it? Maybe not!
- thenewnewguy 7y agoLastPass (like all other good online password managers) has a web UI.
- nirvdrum 7y agoI had an employer that blocked access to lastpass.com to discourage that sort of thing. I guess the idea is you shouldn't be using a work computer for personal stuff and you shouldn't put work passwords on a 3rd part site. In reality, things aren't split that cleanly, so the block was annoying.
- paxy 7y agoThat's an even bigger reason to use password managers. Use a mobile app and 2FA.
- all_blue_chucks 7y agoYou should never, ever, ever type a password on a public computer.
- spookthesunset 7y agoSo basically, you should never use public computers for anything beyond looking at YouTube anonymously?
- anon73044 7y agoAnd searching things that you can't search for at home or on your phone. The kinds of things that people get put on watchlist for, like where to buy industrial quantities of hydrofluoric acid.
- bashinator 7y agoUpvote. You have no way of knowing if that computer is compromised, say with bogus root SSL certificates to allow MitM of ostensibly secure web sites.
- iudqnolq 7y agoWhat if you store passwords for non-ssl sites in your password manager? I have passwords for some really old mailing lists that don't use SSL and had a big warning that they're completely insecure on the page. I especially don't want to use a shared password if it has a decent chance of being compromised, but if I cared if that account got compromised I wouldn't have set it up.
- n4r9 7y agoUse KeePass on a USB drive with a key file. You won't have to type a password or transmit anything over the internet.
- Aloha 7y agoWhich is why at a previous employer, everyone just stuffed all of it in a spreadsheet, with expiry dates, and last logged in times.
- iudqnolq 7y agoThat actually sounds pretty secure, if the computer had a reasonable password and FDE you've just implemented a hacky password manager. Even without FDE you're better than anyone who writes it down on a sticky or uses something trivial. Unless they're using Excel functions to generate password{n++} . That'd be clever and yet horrid at the same time.
- jankiehodgpodge 7y agoAlthough at most workplaces your documents are just a folder on a shared drive somewhere, which may not be secured well and in some cases not secured at all.
- Aloha 7y agoI used a little php script to do the password generation, and yes we did use FDE
- iudqnolq 7y agoIf the script is accessible to other people I suppose you have to worry about it being hacked, especially if you let php get out of date or take input in say password length?
- SlowRobotAhead 7y agoYou can use the Lastpass site on any computer without the browser extension.