4 ms·

That's why I never used and will never use a password manager... You can't get more security by trusting more intermediaries with your passwords. When it comes

That's why I never used and will never use a password manager... You can't get more security by trusting more intermediaries with your passwords. When it comes to anything that matters, you want to trust as few intermediaries as possible. The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. Why not just remember your passwords? There is an infinite number of strategies and secret rules which you can use to easily remember your passwords. Or for low-importance services, why not just use your browser's built-in password manager? You have to trust the browser maker anyway.

scrollaway 5y ago
If you think the concept doesn't make sense, consider that you do not understand it. Highly respected people whose entire careers is security will disagree with you. I'm not telling you to take an argument for authority, but maybe do some introspection about who is more likely to be correct there... Edit: Parent comment edited out some really outrageous claims, so my reply no longer makes as much sense.
- cryptica 5y ago
  Of course security folks who stand to profit from selling these password management solutions will insist that these solutions are important... After all, like you say, their whole career depends on selling 'security products' to companies and individuals. This kind of argument would never stand up in court because of conflict of interests. About the edit, the meaning of my comment hasn't changed. I just removed the phrase "the concept doesn't make any sense" and expanded it to explain why it doesn't make any sense... It's dishonest to say that I've made an outrageous claim or changed the meaning of the comment in any way. But it's good that expanding my reasoning has led you to reconsider the validity of your argument.
  - scrollaway 5y ago
    > But it's good that expanding my reasoning has led you to reconsider the validity of your argument. What I meant is that my first sentence, which references something you removed from your original comment, sounds very out of context now. And no, none of the folks I'm thinking of actually make money from password management solutions. Your comment sounds the same as "of course all those doctors would recommend getting vaccinated since they make a profit from selling you the vaccines". Please, just stop.
    - cryptica 5y ago
      >> And no, none of the folks I'm thinking of actually make money from password management solutions. Not directly, but maybe their peers do. If your buddy works at Facebook, you're not going to say bad things about Facebook's business. It also applies to some extent if it's your friend's friend; group-think is a powerful effect. >> Your comment sounds the same as "of course all those doctors would recommend getting vaccinated since they make a profit from selling you the vaccines". Well of course that's a factor to consider. The medical industry is not immune to ulterior motives. For example, doctors have been known for over-prescribing opioids and many people actually died as a result. I'm pretty sure all these doctors thought they were doing the right thing; all their colleagues were also prescribing the same drugs. Also many drugs which received FDA approval were later found to be unsafe, caused birth defects, deaths etc... It's foolish to suggest that anything is 100% safe and ulterior motives will certainly have a negative effect on safety.
      - scrollaway 5y ago
        I have several buddies who work at Facebook and i think Facebook is evil and one of the worst companies to work for in tech. They know my stance on it, now you do too, and I've disproven your opening argument. I didn't mention opioids did i? I'm going to ignore further comments from you in this thread because this has all the hallmarks of a bad faith discussion. Assuming that's not your intention, maybe do some introspection on why that is.
  - jachee 5y ago
    Who stands to profit from FOSS, self-hosted password management solutions (e.g. Keepass) then? Generating long, high-entropy, unique passwords and then not relying on your brain to remember (and your fingers to type) is always going to be more secure than doing it the hard way for its own sake.
jfrunyon 5y ago
> You can't get more security by trusting more intermediaries with your passwords. I would agree, were it not for the fact that every worthwhile password manager never sends your passwords to any intermediary. There is of course some risk related to the strength of the encryption, software updates/supply chain attacks, client backdoors, etc; however, in most scenarios that is far outweighed by the additional security on a "link in the chain" which is much more likely to be attacked (better credentials - higher entropy, better rotation, and so on). > The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. You're right, it is obvious, that's why those entities don't have access to them! > Why not just remember your passwords? There is an infinite number of strategies and secret rules which you can use to easily remember your passwords. That is incredibly low entropy. This will likely prevent you from falling victim to a simple dictionary or credential-stuffing attack, but not much else. > Or for low-importance services, why not just use your browser's built-in password manager? You have to trust the browser maker anyway. Well, that IS a password manager. And as to why not use it, because in an enterprise environment you should probably have automatic/encrypted/signed sharing, as well as logs of who accessed a password, who modified a password, etc. By the way, I just want to point out that your "password manager" could be "rot13 and write it down in a notebook and put it in a locked cabinet". Or it could be "put it in a text file and GPG-encrypt it". There are plenty of options available which don't involve even trusting the code of any third-party.
- cryptica 5y ago
  >> every worthwhile password manager never sends your passwords to any intermediary Except in cases where the password manager is 100% open source, the people who wrote the password manager are intermediaries. As I said, you need to trust an additional intermediary.
  - jfrunyon 5y ago
    And as I said, a password manager can be a physical piece of paper that only you ever see. There is absolutely no need to trust an additional intermediary unless you choose a password manager which requires that. And additionally, you can choose exactly how much trust you put in the intermediary, because there are many password managers out there to choose from.

scrollaway 5y ago

If you think the concept doesn't make sense, consider that you do not understand it. Highly respected people whose entire careers is security will disagree with you. I'm not telling you to take an argument for authority, but maybe do some introspection about who is more likely to be correct there... Edit: Parent comment edited out some really outrageous claims, so my reply no longer makes as much sense.

cryptica 5y ago
Of course security folks who stand to profit from selling these password management solutions will insist that these solutions are important... After all, like you say, their whole career depends on selling 'security products' to companies and individuals. This kind of argument would never stand up in court because of conflict of interests. About the edit, the meaning of my comment hasn't changed. I just removed the phrase "the concept doesn't make any sense" and expanded it to explain why it doesn't make any sense... It's dishonest to say that I've made an outrageous claim or changed the meaning of the comment in any way. But it's good that expanding my reasoning has led you to reconsider the validity of your argument.
- scrollaway 5y ago
  > But it's good that expanding my reasoning has led you to reconsider the validity of your argument. What I meant is that my first sentence, which references something you removed from your original comment, sounds very out of context now. And no, none of the folks I'm thinking of actually make money from password management solutions. Your comment sounds the same as "of course all those doctors would recommend getting vaccinated since they make a profit from selling you the vaccines". Please, just stop.
  - cryptica 5y ago
    >> And no, none of the folks I'm thinking of actually make money from password management solutions. Not directly, but maybe their peers do. If your buddy works at Facebook, you're not going to say bad things about Facebook's business. It also applies to some extent if it's your friend's friend; group-think is a powerful effect. >> Your comment sounds the same as "of course all those doctors would recommend getting vaccinated since they make a profit from selling you the vaccines". Well of course that's a factor to consider. The medical industry is not immune to ulterior motives. For example, doctors have been known for over-prescribing opioids and many people actually died as a result. I'm pretty sure all these doctors thought they were doing the right thing; all their colleagues were also prescribing the same drugs. Also many drugs which received FDA approval were later found to be unsafe, caused birth defects, deaths etc... It's foolish to suggest that anything is 100% safe and ulterior motives will certainly have a negative effect on safety.
    - scrollaway 5y ago
      I have several buddies who work at Facebook and i think Facebook is evil and one of the worst companies to work for in tech. They know my stance on it, now you do too, and I've disproven your opening argument. I didn't mention opioids did i? I'm going to ignore further comments from you in this thread because this has all the hallmarks of a bad faith discussion. Assuming that's not your intention, maybe do some introspection on why that is.
- jachee 5y ago
  Who stands to profit from FOSS, self-hosted password management solutions (e.g. Keepass) then? Generating long, high-entropy, unique passwords and then not relying on your brain to remember (and your fingers to type) is always going to be more secure than doing it the hard way for its own sake.

jfrunyon 5y ago

> You can't get more security by trusting more intermediaries with your passwords. I would agree, were it not for the fact that every worthwhile password manager never sends your passwords to any intermediary. There is of course some risk related to the strength of the encryption, software updates/supply chain attacks, client backdoors, etc; however, in most scenarios that is far outweighed by the additional security on a "link in the chain" which is much more likely to be attacked (better credentials - higher entropy, better rotation, and so on). > The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. You're right, it is obvious, that's why those entities don't have access to them! > Why not just remember your passwords? There is an infinite number of strategies and secret rules which you can use to easily remember your passwords. That is incredibly low entropy. This will likely prevent you from falling victim to a simple dictionary or credential-stuffing attack, but not much else. > Or for low-importance services, why not just use your browser's built-in password manager? You have to trust the browser maker anyway. Well, that IS a password manager. And as to why not use it, because in an enterprise environment you should probably have automatic/encrypted/signed sharing, as well as logs of who accessed a password, who modified a password, etc. By the way, I just want to point out that your "password manager" could be "rot13 and write it down in a notebook and put it in a locked cabinet". Or it could be "put it in a text file and GPG-encrypt it". There are plenty of options available which don't involve even trusting the code of any third-party.

cryptica 5y ago
>> every worthwhile password manager never sends your passwords to any intermediary Except in cases where the password manager is 100% open source, the people who wrote the password manager are intermediaries. As I said, you need to trust an additional intermediary.
- jfrunyon 5y ago
  And as I said, a password manager can be a physical piece of paper that only you ever see. There is absolutely no need to trust an additional intermediary unless you choose a password manager which requires that. And additionally, you can choose exactly how much trust you put in the intermediary, because there are many password managers out there to choose from.