8 ms·

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They h

I don’t trust or use SAAS password managers. They are massive honeypots just waiting to be pwned and everyones’ passwords to all their websites stolen. They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password. I imagine nation state-supported malicious hackers are targeting them. Everything else is getting breached and leaked these days, there’s a non-trivial possibility these will too. I just use KeePassXC instead, and periodically ‘sync’ the database across my workstations and laptop. And by ‘sync’, I mean manually export the database and rsync it around to my workstations and laptop and re-import it on each. But given how infrequently I create new web accounts, this isn’t a major hassle. It works fine, I don’t need some centralized service for this.

wtf77 5y ago
Same here. KeePassXC, sync manually and backup it manually. I don't trust SaaS as well.
- giuliogabrieli 5y ago
  I add on KeepassXC, synched to one of my cloud storage in the background with a decently misleading name and in a misleading folder.
  - a1445c8b 5y ago
    So…security by obscurity.
    - playpause 5y ago
      Nothing wrong with security through obscurity as an extra layer on top of encryption.
      - a1445c8b 5y ago
        Fair point. In the end, all these security measures that we’re using are really just a form of “security through obscurity,” isn’t it. ;-)
- jedberg 5y ago
  You could use Syncthing so you don't have to manually sync and backup nor trust any SaaS
barbazoo 5y ago
> they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password Maybe I'm missing something but sure they can't store its hash but they can and do store the password strongly encrypted. Presumably without the master password, at least, it should be close to impossible to retrieve the passwords. Or is that assumption wrong?
- booi 5y ago
  That's exactly what they do and they have the audits[0][1] to prove it. [0] https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ [1] https://bitwarden.com/images/resources/Bitwarden-Security-Assessment-Report-2021.pdf https://bitwarden.com/images/resources/Bitwarden-Security-As...
- ryandvm 5y ago
  That is correct and they apparently have the audits to prove it. That said, it's not bulletproof. The chink in the armor is the browser extensions they all use. All it would take is somebody to slip some trojan code into one of the browser extensions and all of the sudden you have a few hundred million decrypted password databases which could trivially be uploaded to wherever.
  - kevindong 5y ago
    Could you not argue the same thing for almost any code used by almost any piece of software closer to the metal? e.g. someone manages to slip malicious code into Chrome/Chromium which eventually makes its way out to every Electron app/most browsers, or something gets injected into Windows/macOS/Linux, etc.
    - dogman144 5y ago
      On one hand, yes software supply chain vulns are getting difficult to maintain conceptually total coverage of while also maintaining a pleasant environment for developers to productive in. On the other hand, yes there eventually is a trust point somewhere. A spiral of upstream what-ifs isn't productive IMO, I agree.
fuzzieozzie 5y ago
I am the same, but with the enhancement of using Resilio Sync to automatically sync the file between devices.
- pedrogpimenta 5y ago
  I do the same, with Nextcloud though, but I doubt SkyMarshal would consider that as an enhancement. He, and others, sync it manually and "offline" for security reasons.
  - SkyMarshal 5y ago
    You can use any kind of sync software you prefer, be it cloud-based or local LAN-only. At least with cloud-based it’s not a glaringly visible honeypot with a huge target painted on it. Setting up local automated sync is on my todo list, it’s just lower priority than too many other things. As I mentioned, I don’t create new accounts so often that I need automated sync.
DougN7 5y ago
I do the same thing but worry about a nation state or rich enough hackers to just take over the project and add nefarious code. I’ll never audit the code and make sure it produces the binary I get from the Apple store. So I’ve started adding my own “salt” - I type an extra character or two (same for all passwords) to the end of every password I enter. It’s the easiest way to protect against not being able to trust my local password app that I can think off.
- brokenmachine 5y ago
  If the hacker can decrypt your whole password safe and view all your plaintext passwords, I think they'll work out your scheme.
  - BenjiWiebe 5y ago
    Unless the hacker mass decrypts a couple million passwords, in which case one person's passwords that don't work for the login bot probably won't catch the hacker's attention.
  - DougN7 5y ago
    I don’t understand how. If I record that my password for Google is xyzzy, but in reality it’s xyzzy123, and 123 is part of every password but not recorded anywhere (other than my mind), how would they work that out? They’d just see that none of my passwords worked. If there is a weakness to this system please let me know.
TimTheTinker 5y ago
For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits https://bugcrowd.com/agilebits
- SkyMarshal 5y ago
  I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.
  - jolux 5y ago
    1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates. Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.
    - deleted 5y ago
      [deleted]
    - TimTheTinker 5y ago
      Parent comment is right about the value of a successful vault exploit. Given the number of people and companies using 1Password now, $100k would likely pale in comparison to an exploit's value on the black market.
    - coldtea 5y ago
      >1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. Doesn't matter for our case, since it already assumes the database potentially compromisable. The parent's comment concerned whether the "bounty for capturing a flag inside a publicly available encrypted vault" is enough. So the question is not whether the bounty is enough given it's impossible to win, but whether it's enough given it might be possible to win. In other words, whether someone who finds an exploit to decrypt the vaults contents would get a better value by (a) revealing it to 1Password company and taking the $100K bounty, or (b) selling the exploit to people who would give millions to be able to decrypt other's vaults...
slooonz 5y ago
> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (aka is not "hunter3")
- SkyMarshal 5y ago
  > as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.
  - leokennis 5y ago
    Do you understand the concept of a password manager? You only have to remember one password, and for that reason people can choose a longer and more complex one. Then your passwords are encrypted using that master password. So people cannot “reverse” your password if you pick a reasonably long master password. For reference, my master password is a 27 character sentence which would take somewhere between a millennium and the heat death of the universe to crack. It encrypts around 500 passwords, each in itself 25-35 character long pass phrases I do not know.
    - gigglesupstairs 5y ago
      This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.
      - leokennis 5y ago
        I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for). Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location. So should I forget my master password: drive to box 1. Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone somewhere, and I have access to all my accounts. Should my password manager go bankrupt overnight and take my vault with them: drive to boxes 1 and 2, then click “forgot my password” on all services and use my e-mail to recover access. Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them: at least I have my own e-mail domain, so I can set up a new mailbox elsewhere Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them, and my domain registrar go bankrupt overnight and take my domain with them: yeah…then I’m screwed. I’ll migrate to a wooded country and become a hermit.
oblio 5y ago
Mobile devices?
- xblau 5y ago
  On Android you can use Keepass2Android[0] to open your KeePass files. You still have to copy your kdbx file to your phone somehow, of course. [0] https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi...
- kabr 5y ago
  Resilio Sync + Keepass2Android or Keepass Touch (iOS)
dehrmann 5y ago
Not sure if this helps or hurts, but the places they're most likely to see a problem are in the clients and automatic browser plugin updates. An attacker doesn't even need to target a password manager directly; they can collect passwords pretty well with any compromised plugin, just not all of the passwords at once.
PinguTS 5y ago
For that reason I trust 1Password in the non-SAAS version. The password vault is stored locally and then snchronized between devices via iCloud. So there is no single point. First there needs to be an exploit for iCloud and second to the 1Password vault. The benefit of this is, the vault is a simple website by itself that can be loaded into any webbrowser without the app.
- SkyMarshal 5y ago
  Oh that’s cool, didn’t realize 1pw had a self-hosted version, will check it out.
  - voltaireodactyl 5y ago
    Unfortunately, the self-hosted option is only available in version 7. Version 8 is the current version and does not offer self hosting. 1Password has said they will not offer it in future versions either, so it’s not worth getting set up if self hosting is critical to you.
balaji1 5y ago
for the N number of websites that force me to create accounts, I use an auto-generated password from the password manager and save to the same SaaS password manager. These are for websites I don't care if the passwords get leaked, I can live with the damage. Some have access to credit cards, but meh. For the old-school (am I young?) websites like mail, fb, bank accounts, etc I remember the passwords. Seems like a workable compromise for now. Tho I am scared I will start getting lazy and start storing sensitive websites in pwd managers.
phantomathkg 5y ago
If your threat model truly think it worth the hassle for you to use KeePass offline and sync offline. Then so be it. However, given KeePass is still a piece of software, nothing stop state-supported malicious hackers injecting vulnerability into it, and suck your password away into their database. Have you consider making sure all your computers are offline when using KeePass?
- BenjiWiebe 5y ago
  Just don't update your password manager. If it's fully offline (and it's a mature product), there's a pretty low chance there'll be an update that you'll actually need. As time goes on without reported backdoors, the chance that your passwords are safe just gets better.
weq 5y ago
Password managers just move the the problem somewhere else IMO. Saving passwords with your browser is even worse. Passwords should not be rotated unless they have been comphremised. Password rotation is the problem, not your password. Use different teirs of passwords. Have a single password u use for anything that is non-senstive, and then go custom on anything that is. Only login to those sensitive services from 1 devices, forgo your convience. These custom passwords should be very rarely be used and u can come up with some custom way to store / remmeber them. Atleast then i have to spend hours and hours and hours on your box, looking, instead of minutes.
ajdude 5y ago
I’m in the boat as well, I don’t quite trust SaaS managers and ultimately settled on KeePassXC. I also host my own mailinabox though, so my database is synced on my personal Nextcloud across my devices. In addition to a master passphrase, I also use a keyfile for keypass, so even if the database is compromised I would hope that it’s still not useful without the keyfile.

wtf77 5y ago

Same here. KeePassXC, sync manually and backup it manually. I don't trust SaaS as well.

giuliogabrieli 5y ago
I add on KeepassXC, synched to one of my cloud storage in the background with a decently misleading name and in a misleading folder.
- a1445c8b 5y ago
  So…security by obscurity.
  - playpause 5y ago
    Nothing wrong with security through obscurity as an extra layer on top of encryption.
    - a1445c8b 5y ago
      Fair point. In the end, all these security measures that we’re using are really just a form of “security through obscurity,” isn’t it. ;-)
jedberg 5y ago
You could use Syncthing so you don't have to manually sync and backup nor trust any SaaS

barbazoo 5y ago

> they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password Maybe I'm missing something but sure they can't store its hash but they can and do store the password strongly encrypted. Presumably without the master password, at least, it should be close to impossible to retrieve the passwords. Or is that assumption wrong?

booi 5y ago
That's exactly what they do and they have the audits[0][1] to prove it. [0] https://support.1password.com/security-assessments/ https://support.1password.com/security-assessments/ [1] https://bitwarden.com/images/resources/Bitwarden-Security-Assessment-Report-2021.pdf https://bitwarden.com/images/resources/Bitwarden-Security-As...
ryandvm 5y ago
That is correct and they apparently have the audits to prove it. That said, it's not bulletproof. The chink in the armor is the browser extensions they all use. All it would take is somebody to slip some trojan code into one of the browser extensions and all of the sudden you have a few hundred million decrypted password databases which could trivially be uploaded to wherever.
- kevindong 5y ago
  Could you not argue the same thing for almost any code used by almost any piece of software closer to the metal? e.g. someone manages to slip malicious code into Chrome/Chromium which eventually makes its way out to every Electron app/most browsers, or something gets injected into Windows/macOS/Linux, etc.
  - dogman144 5y ago
    On one hand, yes software supply chain vulns are getting difficult to maintain conceptually total coverage of while also maintaining a pleasant environment for developers to productive in. On the other hand, yes there eventually is a trust point somewhere. A spiral of upstream what-ifs isn't productive IMO, I agree.

fuzzieozzie 5y ago

I am the same, but with the enhancement of using Resilio Sync to automatically sync the file between devices.

pedrogpimenta 5y ago
I do the same, with Nextcloud though, but I doubt SkyMarshal would consider that as an enhancement. He, and others, sync it manually and "offline" for security reasons.
- SkyMarshal 5y ago
  You can use any kind of sync software you prefer, be it cloud-based or local LAN-only. At least with cloud-based it’s not a glaringly visible honeypot with a huge target painted on it. Setting up local automated sync is on my todo list, it’s just lower priority than too many other things. As I mentioned, I don’t create new accounts so often that I need automated sync.

DougN7 5y ago

I do the same thing but worry about a nation state or rich enough hackers to just take over the project and add nefarious code. I’ll never audit the code and make sure it produces the binary I get from the Apple store. So I’ve started adding my own “salt” - I type an extra character or two (same for all passwords) to the end of every password I enter. It’s the easiest way to protect against not being able to trust my local password app that I can think off.

brokenmachine 5y ago
If the hacker can decrypt your whole password safe and view all your plaintext passwords, I think they'll work out your scheme.
- BenjiWiebe 5y ago
  Unless the hacker mass decrypts a couple million passwords, in which case one person's passwords that don't work for the login bot probably won't catch the hacker's attention.
- DougN7 5y ago
  I don’t understand how. If I record that my password for Google is xyzzy, but in reality it’s xyzzy123, and 123 is part of every password but not recorded anywhere (other than my mind), how would they work that out? They’d just see that none of my passwords worked. If there is a weakness to this system please let me know.

TimTheTinker 5y ago

For what it's worth, 1Password has a longstanding $100k bounty for capturing a flag inside a publicly available encrypted vault. https://bugcrowd.com/agilebits https://bugcrowd.com/agilebits

SkyMarshal 5y ago
I suspect that’s not nearly enough, given that their breached database would probably sell for multiple orders of magnitude more on the darknet. Should probably be $1M at least.
- jolux 5y ago
  1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. A successful hack of 1Password would probably require pushing bad client updates. Besides which bug bounties are not really intended to disincentivize people from committing crimes, they're intended to incentivize researchers to report findings and reward them for their efforts.
  - deleted 5y ago
    [deleted]
  - TimTheTinker 5y ago
    Parent comment is right about the value of a successful vault exploit. Given the number of people and companies using 1Password now, $100k would likely pale in comparison to an exploit's value on the black market.
  - coldtea 5y ago
    >1Password vaults are encrypted end-to-end, their database would not be worth nearly that much. It's a bunch of worthless data. Doesn't matter for our case, since it already assumes the database potentially compromisable. The parent's comment concerned whether the "bounty for capturing a flag inside a publicly available encrypted vault" is enough. So the question is not whether the bounty is enough given it's impossible to win, but whether it's enough given it might be possible to win. In other words, whether someone who finds an exploit to decrypt the vaults contents would get a better value by (a) revealing it to 1Password company and taking the $100K bounty, or (b) selling the exploit to people who would give millions to be able to decrypt other's vaults...

slooonz 5y ago

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (aka is not "hunter3")

SkyMarshal 5y ago
> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.
- leokennis 5y ago
  Do you understand the concept of a password manager? You only have to remember one password, and for that reason people can choose a longer and more complex one. Then your passwords are encrypted using that master password. So people cannot “reverse” your password if you pick a reasonably long master password. For reference, my master password is a 27 character sentence which would take somewhere between a millennium and the heat death of the universe to crack. It encrypts around 500 passwords, each in itself 25-35 character long pass phrases I do not know.
  - gigglesupstairs 5y ago
    This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.
    - leokennis 5y ago
      I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for). Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location. So should I forget my master password: drive to box 1. Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone somewhere, and I have access to all my accounts. Should my password manager go bankrupt overnight and take my vault with them: drive to boxes 1 and 2, then click “forgot my password” on all services and use my e-mail to recover access. Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them: at least I have my own e-mail domain, so I can set up a new mailbox elsewhere Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them, and my domain registrar go bankrupt overnight and take my domain with them: yeah…then I’m screwed. I’ll migrate to a wooded country and become a hermit.

oblio 5y ago

Mobile devices?

xblau 5y ago
On Android you can use Keepass2Android[0] to open your KeePass files. You still have to copy your kdbx file to your phone somehow, of course. [0] https://play.google.com/store/apps/details?id=keepass2android.keepass2android https://play.google.com/store/apps/details?id=keepass2androi...
kabr 5y ago
Resilio Sync + Keepass2Android or Keepass Touch (iOS)

dehrmann 5y ago

Not sure if this helps or hurts, but the places they're most likely to see a problem are in the clients and automatic browser plugin updates. An attacker doesn't even need to target a password manager directly; they can collect passwords pretty well with any compromised plugin, just not all of the passwords at once.

PinguTS 5y ago

For that reason I trust 1Password in the non-SAAS version. The password vault is stored locally and then snchronized between devices via iCloud. So there is no single point. First there needs to be an exploit for iCloud and second to the 1Password vault. The benefit of this is, the vault is a simple website by itself that can be loaded into any webbrowser without the app.

SkyMarshal 5y ago
Oh that’s cool, didn’t realize 1pw had a self-hosted version, will check it out.
- voltaireodactyl 5y ago
  Unfortunately, the self-hosted option is only available in version 7. Version 8 is the current version and does not offer self hosting. 1Password has said they will not offer it in future versions either, so it’s not worth getting set up if self hosting is critical to you.

balaji1 5y ago

for the N number of websites that force me to create accounts, I use an auto-generated password from the password manager and save to the same SaaS password manager. These are for websites I don't care if the passwords get leaked, I can live with the damage. Some have access to credit cards, but meh. For the old-school (am I young?) websites like mail, fb, bank accounts, etc I remember the passwords. Seems like a workable compromise for now. Tho I am scared I will start getting lazy and start storing sensitive websites in pwd managers.

phantomathkg 5y ago

If your threat model truly think it worth the hassle for you to use KeePass offline and sync offline. Then so be it. However, given KeePass is still a piece of software, nothing stop state-supported malicious hackers injecting vulnerability into it, and suck your password away into their database. Have you consider making sure all your computers are offline when using KeePass?

BenjiWiebe 5y ago
Just don't update your password manager. If it's fully offline (and it's a mature product), there's a pretty low chance there'll be an update that you'll actually need. As time goes on without reported backdoors, the chance that your passwords are safe just gets better.

weq 5y ago

Password managers just move the the problem somewhere else IMO. Saving passwords with your browser is even worse. Passwords should not be rotated unless they have been comphremised. Password rotation is the problem, not your password. Use different teirs of passwords. Have a single password u use for anything that is non-senstive, and then go custom on anything that is. Only login to those sensitive services from 1 devices, forgo your convience. These custom passwords should be very rarely be used and u can come up with some custom way to store / remmeber them. Atleast then i have to spend hours and hours and hours on your box, looking, instead of minutes.

ajdude 5y ago

I’m in the boat as well, I don’t quite trust SaaS managers and ultimately settled on KeePassXC. I also host my own mailinabox though, so my database is synced on my personal Nextcloud across my devices. In addition to a master passphrase, I also use a keyfile for keypass, so even if the database is compromised I would hope that it’s still not useful without the keyfile.