6 ms·

This somewhat overlooks the main threat model that password managers solve - leaked credentials. People can’t remember 80 passwords so they reuse the same one,

This somewhat overlooks the main threat model that password managers solve - leaked credentials. People can’t remember 80 passwords so they reuse the same one, that password eventually gets leaked and 9/10 times it doesn’t get leaked due to a targeted attack or a compromised machine but rather due to a breach of a service you signed up too. Sure password managers have issues, they don’t solve user related errors and can even add to the attack surface of a machine they are running on but that’s really not important... Using password managers and generating different passwords for each service reduces the blast radius from any breach. This is why I don’t care if the password manager has the best encryption, or does it even encrypts at all or does it uses the clipboard vs some more secure side channel. Yeah that’s nice but that’s not in my threat model. Which is why I don’t care if your password manager is a spreadsheet, it’s a terrible choice for a business because their threat landscape and the fact that a spreadsheet won’t allow you to audit who has access to what but for you or your mom even that is better than using the same password everywhere else. Heck at home print your passwords and store them somewhere safe... put them on a post note for all I care as long as you live alone or at least not with anyone you wouldn’t want stumbling on that list...

hsn915 5y ago
How does this address the point of the article? Which is that you should use the browser's builtin password manager and not a third party manager that injects user scripts into all websites and break the sandbox model?
- 542458 5y ago
  The point is that while yes, many 3rd party password managers have issues, the overwhelming majority of attacks are not against password managers but against reused passwords - so honestly either the 1st or 3rd party choice is a win over using neither.
  - H8crilA 5y ago
    Ok so: 1) not use any manager => bad 2) use a 3rd party => pretty crap as the article says 3) use a built-in => great Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy. I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additional code into the website itself. I thought there's a dedicated browser API or something.
    - kennywinker 5y ago
      3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into my password manager - compromised password warnings (maybe some of the built in password systems do this now?)
      - H8crilA 5y ago
        2, 3, 4 are handled by Chrome, for example. These really are trivial features that any decent corpo can get right. 1 obviously isn't.
        kennywinker 5y ago
        Oh, yes, I forgot a pretty important one, I don't want to upload all my passwords to google. Offline storage, and direct device-to-device syncing.
        lazide 5y ago
        Last I checked I couldn’t export Chrome passwords (aka offline backup), couldn’t add non site passwords, and couldn’t manage non site based passwords/secrets with chrome password manager. And that was a month ago?
  - gruez 5y ago
    That's only because there are more people who reuse passwords than people who use online password managers. As they're becoming popular, more cybercriminals are going to exploit it.
    - shawnz 5y ago
      But also there will also be more attention directed toward these low-hanging vulnerabilities, so perhaps password manager vendors will adapt too.
    - laumars 5y ago
      There are already enough people using password managers that they’re a target. If they were as easy targets as you imply, then they’d already be exploited. The fact they’re not demonstrates that’s reused passwords is lower hanging fruit.
    - dogma1138 5y ago
      Attacking password managers is still a scalability problem, there would be always better targets out there to gain access to credentials. Sure if you are in a position that your threat model includes actual targeted attacks then you need to reconsider things. But then software password managers might not be the way to go regardless. A lot of security advice needs to be taken in the context it was given - that context is always a specific threat model(s). Writing down passwords in an office is a terrible idea, keeping a small book with passwords in a drawer in your study is quite fine for most people. Security is always a trade off between different threat models, anything you do reduces the likelihood of ones and increase the likelihood of others. Encrypting the laptop reduces the chance of some random person extracting data if the device is lost or stolen, also to some extent reduces the chances of it being successfully searched by law enforcement. It does however increases the chances of a threat agent torturing you or your loved ones for access. Now this isn’t an argument to not use device encryption, unless ofc the threat of violence is actually real at that point neither option might actually be viable and you would look for other means to store and transport data other than an encrypted device.
- true_religion 5y ago
  If you are on Safari, your browsers' builtin password manager is unfortunately Keychain and you cannot easily export your passwords out of keychain. Additionally, if you use two different browsers or operating systems you'll need a 3rd party tool to keep your passwords in sync. For me, that's why I use a 3rd party. --- Funny thing is though, I consider myself the 1st party. The website or app I am using is the 2nd party. Anyone else including the browser is a 3rd party. Neither Google, nor Apple, nor Mozilla, to name a few of the top browser-makers, are anything more than middlemen. I think it's better to trust them with less rather than allow them to keep the passwords as well since they have no incentive to make them portable between competing browsers.
newdude116 5y ago
Yeah, idiot web programmers that don't encrypt PWs and use salting. Use a PW manager. If you really don't want to use one, don't use the same PW. At least at your own salt. eg. HN@thepwialwaysuse4 HN would be the "salt" for Hackernews.
- jmartrican 5y ago
  But if that salted pw gets exposed, can a hacker just guess your pws for other sites? E.g. myBank@thepwialwaysuse
  - indigo945 5y ago
    Yes, but you're not important enough for someone to try your password on other sites by hand, and bots are hopefully not smart enough to do this automatically. You should still use a password manager. Or at least a paper notebook.
    - pnt12 5y ago
      Do bots need to do this automatically? What if a programmer gets that database and does a quick search for those naive salts? Then he can do some pattern matching and try the same pattern in some sites like PayPal, Apple, Gmail, etc. Generalize it a bit and you can even create a tool to do this for you for every new database leaked.
      - newdude116 5y ago
        He would have to break the cryptographic algo to see the salt. Good luck with that. Sure that is possible for the NSA with weak encryption. But most hackers wont be able to do this. The salt does not give a slightly different hash but a totally different hash. Also, using salt (your own or server based) should protect you from some kind of rainbow table attacks. But just use a PW manager (e.g. enpass.io ) I am very happy with it but I don't use the autofill plug-ins. You can never be paranoid enough.
flemhans 5y ago
This is addressed in the article: >Second, everyone needs to be using unique passwords. You don’t have to use a password manager to do that, whatever system works for you is fine. If you want to use a notebook in a desk drawer, that’s totally acceptable.

hsn915 5y ago

How does this address the point of the article? Which is that you should use the browser's builtin password manager and not a third party manager that injects user scripts into all websites and break the sandbox model?

542458 5y ago
The point is that while yes, many 3rd party password managers have issues, the overwhelming majority of attacks are not against password managers but against reused passwords - so honestly either the 1st or 3rd party choice is a win over using neither.
- H8crilA 5y ago
  Ok so: 1) not use any manager => bad 2) use a 3rd party => pretty crap as the article says 3) use a built-in => great Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy. I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additional code into the website itself. I thought there's a dedicated browser API or something.
  - kennywinker 5y ago
    3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into my password manager - compromised password warnings (maybe some of the built in password systems do this now?)
    - H8crilA 5y ago
      2, 3, 4 are handled by Chrome, for example. These really are trivial features that any decent corpo can get right. 1 obviously isn't.
      - kennywinker 5y ago
        Oh, yes, I forgot a pretty important one, I don't want to upload all my passwords to google. Offline storage, and direct device-to-device syncing.
      - lazide 5y ago
        Last I checked I couldn’t export Chrome passwords (aka offline backup), couldn’t add non site passwords, and couldn’t manage non site based passwords/secrets with chrome password manager. And that was a month ago?
- gruez 5y ago
  That's only because there are more people who reuse passwords than people who use online password managers. As they're becoming popular, more cybercriminals are going to exploit it.
  - shawnz 5y ago
    But also there will also be more attention directed toward these low-hanging vulnerabilities, so perhaps password manager vendors will adapt too.
  - laumars 5y ago
    There are already enough people using password managers that they’re a target. If they were as easy targets as you imply, then they’d already be exploited. The fact they’re not demonstrates that’s reused passwords is lower hanging fruit.
  - dogma1138 5y ago
    Attacking password managers is still a scalability problem, there would be always better targets out there to gain access to credentials. Sure if you are in a position that your threat model includes actual targeted attacks then you need to reconsider things. But then software password managers might not be the way to go regardless. A lot of security advice needs to be taken in the context it was given - that context is always a specific threat model(s). Writing down passwords in an office is a terrible idea, keeping a small book with passwords in a drawer in your study is quite fine for most people. Security is always a trade off between different threat models, anything you do reduces the likelihood of ones and increase the likelihood of others. Encrypting the laptop reduces the chance of some random person extracting data if the device is lost or stolen, also to some extent reduces the chances of it being successfully searched by law enforcement. It does however increases the chances of a threat agent torturing you or your loved ones for access. Now this isn’t an argument to not use device encryption, unless ofc the threat of violence is actually real at that point neither option might actually be viable and you would look for other means to store and transport data other than an encrypted device.
true_religion 5y ago
If you are on Safari, your browsers' builtin password manager is unfortunately Keychain and you cannot easily export your passwords out of keychain. Additionally, if you use two different browsers or operating systems you'll need a 3rd party tool to keep your passwords in sync. For me, that's why I use a 3rd party. --- Funny thing is though, I consider myself the 1st party. The website or app I am using is the 2nd party. Anyone else including the browser is a 3rd party. Neither Google, nor Apple, nor Mozilla, to name a few of the top browser-makers, are anything more than middlemen. I think it's better to trust them with less rather than allow them to keep the passwords as well since they have no incentive to make them portable between competing browsers.

newdude116 5y ago

Yeah, idiot web programmers that don't encrypt PWs and use salting. Use a PW manager. If you really don't want to use one, don't use the same PW. At least at your own salt. eg. HN@thepwialwaysuse4 HN would be the "salt" for Hackernews.

jmartrican 5y ago
But if that salted pw gets exposed, can a hacker just guess your pws for other sites? E.g. myBank@thepwialwaysuse
- indigo945 5y ago
  Yes, but you're not important enough for someone to try your password on other sites by hand, and bots are hopefully not smart enough to do this automatically. You should still use a password manager. Or at least a paper notebook.
  - pnt12 5y ago
    Do bots need to do this automatically? What if a programmer gets that database and does a quick search for those naive salts? Then he can do some pattern matching and try the same pattern in some sites like PayPal, Apple, Gmail, etc. Generalize it a bit and you can even create a tool to do this for you for every new database leaked.
    - newdude116 5y ago
      He would have to break the cryptographic algo to see the salt. Good luck with that. Sure that is possible for the NSA with weak encryption. But most hackers wont be able to do this. The salt does not give a slightly different hash but a totally different hash. Also, using salt (your own or server based) should protect you from some kind of rainbow table attacks. But just use a PW manager (e.g. enpass.io ) I am very happy with it but I don't use the autofill plug-ins. You can never be paranoid enough.

flemhans 5y ago

This is addressed in the article: >Second, everyone needs to be using unique passwords. You don’t have to use a password manager to do that, whatever system works for you is fine. If you want to use a notebook in a desk drawer, that’s totally acceptable.