4 ms·

Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would b

Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.

swiley 6y ago
You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.
- CarelessExpert 6y ago
  Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...
  - jjav 6y ago
    If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secure.
    - jfrunyon 6y ago
      > A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
      - cutemonster 6y ago
        Different types of vulnerabilities, not that much comparable
      - jjav 6y ago
        > A browser is too complex but an OS and SSH aren't? Yes, most certainly. A browser is running adversarial third party code all the time as a matter of course. While browsers do a good job at isolating, expecting this to be perfect is way too fragile for a security critical requirement like putting all passwords in one basket. An isolated and minimized OS install, much easier to harden. Never runs any code you don't know about.
    - EVa5I7bHFq9mnYK 6y ago
      Not sure I can call clipboard a very secure communication protocol.
      - cutemonster 6y ago
        If your OS is owned (hostile apps have access to the clipboard), you're doomed anyway? You can use different computers / VMs
    - megous 6y ago
      I think about making something similar. Though the direction would be in reverse. Say a Pinephone with no way to ssh into by default that is normally powered off. No services listening on the network running on it + strict firewall. It can only initiate connections to other devices. Unless I want to sign a ssh key from a CA stored on it or provide a password to some of my other devices it's just powered off. All of DRAM is cleared prior to shutdown. Pinephone can boot to UI in ~2-3s so it would not be bothersome to keep it normally off, and boot up only when needed. Battery would last months for a single charge for this use case. It would run just a few processes. Init, maybe wpa_supplicant for wifi, and a UI process. Very simple SW, extremely limited attack surface. Pinephone has a nice feature that it can emulate any USB device, so I could connect it over USB to any machine, and just make it look like a keyboard, and just type in the username and password into a focused field, for the password filling feature. If I want to create a short term ssh certificate and sign a SSH key for access to a customer machine, the phone would connect to my workstation/notebook/whatever directly over ssh and sign/upload the certificate.
    - CarelessExpert 6y ago
      > If you're optimizing for UX you're not optimizing for security. It's just how it is. Security can never be perfect. It's a lesson in trade-offs. For example, if you make security so hard or inconvenient that people won't engage in secure behaviors, then in the end you're worse off. This is the reason password rotation has fallen out of favor lately. If in general we did away with password managers and took your lead, I guarantee we would collectively be worse off because, for most folks, what you describe would be seen as way more trouble than it's worth. Your black-and-white take also fails to account for varied threat models. Remember, the most common threat model online today is service breaches leading to passwords being exposed, followed by credential stuffing. Password managers encourage practices that eliminate that threat model. If your threat model is centered on password manager service breaches like this one, then use a solution that doesn't require cloud hosting (e.g. keepass). So now we need to worry about device breaches, which requires hackers to go after individual users (either targeted or untargeted), which has a much higher cost/complexity. We've made the hackers job a lot harder, which is good. And if your model is centered on device breaches, well, bad news: your browser already sees your passwords go by (among many other things), so if the device is breached, you're hooped, password manager or no password manager.
- bosie 6y ago
  No notepad for me unfortunately. how do you use your setup on mobile?
  - swiley 6y ago
    I have a hard time imagining getting any useful (maybe I could review PRs?) work done on a smartphone, also my company didn't give me one and both they and I have a strict policy of not mixing personal and work devices.
    - CarelessExpert 6y ago
      Okay, but what about your personal accounts? Do you just not use them on your phone? Manually key in passwords while looking at them on a PC?
- Too 6y ago
  They don't rely on transferring the password via an insecure channel - your clipboard. Other applications can sniff the clipboard, you might accidentally copy another of your credentials into website or you might forget to clear it after use and then later accidentally paste it into an irc-channel. There is also risk of visually exposing the password in the text editor, either to someone else in the room, screen sharing or screenshot from another malicious app. A bit into the tinfoil-hat side, but it's passwords we are talking about after all.
  - atat7024 6y ago
    Malicious JavaScript can sniff the clipboard.

Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.

swiley 6y ago

You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.

CarelessExpert 6y ago
Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android + browser plugins + syncthing. The idea of storing my passwords in someone else's cloud gives me the heebie jeebies...
- jjav 6y ago
  If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secure.
  - jfrunyon 6y ago
    > A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.
    - cutemonster 6y ago
      Different types of vulnerabilities, not that much comparable
    - jjav 6y ago
      > A browser is too complex but an OS and SSH aren't? Yes, most certainly. A browser is running adversarial third party code all the time as a matter of course. While browsers do a good job at isolating, expecting this to be perfect is way too fragile for a security critical requirement like putting all passwords in one basket. An isolated and minimized OS install, much easier to harden. Never runs any code you don't know about.
  - EVa5I7bHFq9mnYK 6y ago
    Not sure I can call clipboard a very secure communication protocol.
    - cutemonster 6y ago
      If your OS is owned (hostile apps have access to the clipboard), you're doomed anyway? You can use different computers / VMs
  - megous 6y ago
    I think about making something similar. Though the direction would be in reverse. Say a Pinephone with no way to ssh into by default that is normally powered off. No services listening on the network running on it + strict firewall. It can only initiate connections to other devices. Unless I want to sign a ssh key from a CA stored on it or provide a password to some of my other devices it's just powered off. All of DRAM is cleared prior to shutdown. Pinephone can boot to UI in ~2-3s so it would not be bothersome to keep it normally off, and boot up only when needed. Battery would last months for a single charge for this use case. It would run just a few processes. Init, maybe wpa_supplicant for wifi, and a UI process. Very simple SW, extremely limited attack surface. Pinephone has a nice feature that it can emulate any USB device, so I could connect it over USB to any machine, and just make it look like a keyboard, and just type in the username and password into a focused field, for the password filling feature. If I want to create a short term ssh certificate and sign a SSH key for access to a customer machine, the phone would connect to my workstation/notebook/whatever directly over ssh and sign/upload the certificate.
  - CarelessExpert 6y ago
    > If you're optimizing for UX you're not optimizing for security. It's just how it is. Security can never be perfect. It's a lesson in trade-offs. For example, if you make security so hard or inconvenient that people won't engage in secure behaviors, then in the end you're worse off. This is the reason password rotation has fallen out of favor lately. If in general we did away with password managers and took your lead, I guarantee we would collectively be worse off because, for most folks, what you describe would be seen as way more trouble than it's worth. Your black-and-white take also fails to account for varied threat models. Remember, the most common threat model online today is service breaches leading to passwords being exposed, followed by credential stuffing. Password managers encourage practices that eliminate that threat model. If your threat model is centered on password manager service breaches like this one, then use a solution that doesn't require cloud hosting (e.g. keepass). So now we need to worry about device breaches, which requires hackers to go after individual users (either targeted or untargeted), which has a much higher cost/complexity. We've made the hackers job a lot harder, which is good. And if your model is centered on device breaches, well, bad news: your browser already sees your passwords go by (among many other things), so if the device is breached, you're hooped, password manager or no password manager.
bosie 6y ago
No notepad for me unfortunately. how do you use your setup on mobile?
- swiley 6y ago
  I have a hard time imagining getting any useful (maybe I could review PRs?) work done on a smartphone, also my company didn't give me one and both they and I have a strict policy of not mixing personal and work devices.
  - CarelessExpert 6y ago
    Okay, but what about your personal accounts? Do you just not use them on your phone? Manually key in passwords while looking at them on a PC?
Too 6y ago
They don't rely on transferring the password via an insecure channel - your clipboard. Other applications can sniff the clipboard, you might accidentally copy another of your credentials into website or you might forget to clear it after use and then later accidentally paste it into an irc-channel. There is also risk of visually exposing the password in the text editor, either to someone else in the room, screen sharing or screenshot from another malicious app. A bit into the tinfoil-hat side, but it's passwords we are talking about after all.
- atat7024 6y ago
  Malicious JavaScript can sniff the clipboard.