4 ms·

No, but in all seriousness, I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords. While I appreciat

by jrm4 5y ago

No, but in all seriousness, I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords. While I appreciate that they do have good skin in the game by being paid, etc -- your password storage on SOMEONE ELSE'S MACHINE fundamentally creates another huge attack vector/opportunity to screw it up, when they also must be accessed locally somehow. I appreciate it if you're like "look, the convenience outweighs the safety," but it really feels like most of these discussions hand-waves away this fundamental flaw. I say this especially as someone who doesn't do a lot of passworded services on my phone, because, you know, that stuff is really insecure no matter how good your password is.

iudqnolq 5y ago
Here's the mistake I made that made me decide to switch to 1password https://news.ycombinator.com/item?id=26801155 https://news.ycombinator.com/item?id=26801155 Also, depending on your phone, it might be significantly more secure against non-superpower actors.
- jrm4 5y ago
  Fair, but I just have them backed up to a non-encrypted USB key, offline.
  - iudqnolq 5y ago
    If it works for you, that's good. It's less the specific issue and more it indicated to me I was rolling my own crypto and didn't know enough to avoid shooting my feet off.
- nerdponx 5y ago
  KeepassXC is an option.
octobus2021 5y ago
Exactly. I have an open source password manager on my Linux laptop and the data files are backed up weekly to 2 different locations (along with other valuable information). Granted, I have little need for password management on the phone, but even if I did, why would I trust someone to keep track of my credentials? I just don't get it why so many people seem to be ok with this...
dieortin 5y ago
What’s the harm on storing your passwords on someone else’s machine, as long as they’re encrypted with a good password?
- jrm4 5y ago
  I suppose I mean "service" more than "machine," i.e. any system in which the owner of the other machine has a shot at getting at your stuff. I know "zero-knowledge" is possible, but, again -- why risk it?
kelnos 5y ago
> * I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords.* I'm generally fine with this if the password vault is end-to-end encrypted, the vault's password is never shared with the server, and the server doesn't have access to the plaintext passwords at all. At that point you have to trust that the crypto used for the vault is done correctly (and that trust is easier to come by if the clients are open source). But that's the same trust you'd have to extend if you used another solution (e.g. Bitwarden) that allowed you to self-host the sync service. If you only access password-protected resources from one system, then you don't need sync at all, and this problem goes away. If you do need sync, you're going to have this problem no matter what.
- jrm4 5y ago
  Define sync? I still far more trust "my own encrypted volume" plus "home-rolled synchronization (Syncthing, in my case)" than e.g. a Bitwarden. (also, I have no idea exactly what "end-to-end encrypted" actually means these days, given the loose way many apps/services seem to define it.)
bombcar 5y ago
Since most passwords can be reset via email, you're placing a similar level of trust in your email provider (and if you host your own, in your domain provider). At some point the paranoia isn't productive anymore.
- jrm4 5y ago
  My threat model isn't super high profile, so no? Partly given 2FA, but more importantly the fact that I check my email pretty frequently (most of them will be like "hey, someone's trying to change your password, is it you?), I don't think that's a fair comparison.
  - bombcar 5y ago
    Be aware that anyone who has access to your email can also delete the "we changed your password" emails. Properly engineered a cloud-based password storage system should be at least as secure as email, if not moreso (and I believe 1password has it engineered that way).
    - jrm4 5y ago
      Sure -- except that the deeply centralized password storage system is a MUCH more attractive target; you've put all the goodies in one place, which is part of my entire point. There is a WHOLE LOT of incentive to try to hack 1Password and far less to try to hack my dinky email, or even, e.g. gmail to try to find what you're looking for as the hacker.

by jrm4 5y ago

iudqnolq 5y ago

Here's the mistake I made that made me decide to switch to 1password https://news.ycombinator.com/item?id=26801155 https://news.ycombinator.com/item?id=26801155 Also, depending on your phone, it might be significantly more secure against non-superpower actors.

jrm4 5y ago
Fair, but I just have them backed up to a non-encrypted USB key, offline.
- iudqnolq 5y ago
  If it works for you, that's good. It's less the specific issue and more it indicated to me I was rolling my own crypto and didn't know enough to avoid shooting my feet off.
nerdponx 5y ago
KeepassXC is an option.

octobus2021 5y ago

Exactly. I have an open source password manager on my Linux laptop and the data files are backed up weekly to 2 different locations (along with other valuable information). Granted, I have little need for password management on the phone, but even if I did, why would I trust someone to keep track of my credentials? I just don't get it why so many people seem to be ok with this...

dieortin 5y ago

What’s the harm on storing your passwords on someone else’s machine, as long as they’re encrypted with a good password?

jrm4 5y ago
I suppose I mean "service" more than "machine," i.e. any system in which the owner of the other machine has a shot at getting at your stuff. I know "zero-knowledge" is possible, but, again -- why risk it?

kelnos 5y ago

> * I emphatically DO NOT UNDERSTAND the extent to which people place trust in external services to manage passwords.* I'm generally fine with this if the password vault is end-to-end encrypted, the vault's password is never shared with the server, and the server doesn't have access to the plaintext passwords at all. At that point you have to trust that the crypto used for the vault is done correctly (and that trust is easier to come by if the clients are open source). But that's the same trust you'd have to extend if you used another solution (e.g. Bitwarden) that allowed you to self-host the sync service. If you only access password-protected resources from one system, then you don't need sync at all, and this problem goes away. If you do need sync, you're going to have this problem no matter what.

jrm4 5y ago
Define sync? I still far more trust "my own encrypted volume" plus "home-rolled synchronization (Syncthing, in my case)" than e.g. a Bitwarden. (also, I have no idea exactly what "end-to-end encrypted" actually means these days, given the loose way many apps/services seem to define it.)

bombcar 5y ago

Since most passwords can be reset via email, you're placing a similar level of trust in your email provider (and if you host your own, in your domain provider). At some point the paranoia isn't productive anymore.

jrm4 5y ago
My threat model isn't super high profile, so no? Partly given 2FA, but more importantly the fact that I check my email pretty frequently (most of them will be like "hey, someone's trying to change your password, is it you?), I don't think that's a fair comparison.
- bombcar 5y ago
  Be aware that anyone who has access to your email can also delete the "we changed your password" emails. Properly engineered a cloud-based password storage system should be at least as secure as email, if not moreso (and I believe 1password has it engineered that way).
  - jrm4 5y ago
    Sure -- except that the deeply centralized password storage system is a MUCH more attractive target; you've put all the goodies in one place, which is part of my entire point. There is a WHOLE LOT of incentive to try to hack 1Password and far less to try to hack my dinky email, or even, e.g. gmail to try to find what you're looking for as the hacker.