5 ms·

Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant r

by nix23 4y ago

Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant right?

gillesjacobs 4y ago
Of course, lesson learned, I chose convenience over common sense. Self-hosted, encrypted passwords it is from now on. LastPass is luckily(?) the only counterparty I ever trusted to this degree except for maybe my banks. (Great, after I fix this password mess, I will have to start looking into trustless banking)
- hackernewds 4y ago
  [flagged]
  - gillesjacobs 4y ago
    All in good spirits with a smile and a wink ;) though I don't appreciate being language policed.
orcanwe 4y ago
If you’re being so cocky, I’m sure you would never type your secrets into any piece of software that auto-updates, right? After all, you’re trusting someone else not to release a software update that leaks your secrets. And I’m sure you do a full audit of the Chrome source code every time a new version is released. And for your locally hosted password manager software too, right?
- nix23 4y ago
  >I’m sure you would never type your secrets into any piece of software that auto-updates, right? Never all of them, with notes, urls and other stuff....what has auto-update todo with it? I don't save my passwords in a password-cloud-service....is that really so hard to understand why it is a bad idea if you do that? Well here you have it why it's a bad idea.
  - dns_snek 4y ago
    Any software running on your PC can gain access to any online account on your PC. If you have auto-updates enabled, a malicious update could be pushed to your PC at any time to compromise you and tens of millions of other users, even with something as ubiquitous as uBlock Origin. At some point you have to trust someone unless you wish to live off the grid, that's just an unfortunate reality.
    - nix23 4y ago
      So your argumentation is: The attack surface is already big, let's make it even bigger..in this case for pure laziness. Good point really...
      - dns_snek 4y ago
        My argument is that a chain is only as strong as the weakest link in the chain. After all, what's the alternative? - Remembering all of your (strong, unique) passwords? Impossible. - Using a single password, or a system for deriving "unique" passwords to make them easy to memorize? More insecure than an cloud-based password manager. People forget and get injured. - Using an offline password manager such as KeePass? Doable, but you trade one set of concerns for another. How many NPM packages have been compromised, stealing data from developer machines? How many people get knowingly, or unknowingly infected? Are you certain that the likelihood of your own machine getting compromised is lower than that of e.g. Bitwarden? Furthermore, if you use something like DropBox to sync your "offline" vault across devices, you're once again trusting someone else to keep the vault safe. Your risk of a targeted attack might be lower with offline storage, but your risk of an automated attack is significantly increased, because most people don't know how to properly secure their $5 VPS or Raspberry Pi that they're using to self-host their password manager. You claimed that using any cloud-based password manager is a bad idea, I disagree. Password managers are not made equal so it's important to do some research and pick one that undergoes extensive security audits, is preferably open source and use a strong passphrase to secure it. A password manager that fits this criteria will produce a vault file that would take hundreds of years to crack, even if their servers get breached and all data is stolen. This was notably not the case with LastPass. It was neither properly implemented, nor (properly) audited, nor open source.
scrollaway 4y ago
When you're using a password, you're entrusting that password to: - Your web browser (which you're entrusting with a WHOLE LOAD of things by the way) - Your operating system (Same same) - A crapload of software that runs locally, depending on which OS you're running - That security camera behind you in the Starbucks you're working from - That guy sitting next to you in the metro looking at your phone. Surely you're using a privacy screen, I hope? - Whoever manufactured your computer's hardware - Whichever god you're praying to if any. Hopefully your password isn't naughty. Hey, you know, just... don't be a smartass with people. opsec is extremely difficult, and there's always a thing to find to victim-blame. I mean, fuck, Lastpass didn't have great reputation in the first place (they fucked up several times in the past) and people should be using bitwarden/1password/keepassxc, not LP. That is STILL NOT A REASON to victim-blame.
- nix23 4y ago
  Your examples are like telling everyone that smoking and drinking can be deadly but then jumping off a cliff....bravo! jumping off a cliff = giving all your passwords to a 3rd party smoking = showing the starbuck-cam your single doted password
  - scrollaway 4y ago
    You could simply apologize to the GP instead of tripling down on snark, here and in sibling comments. Whatever happens makes no difference to me personally, it's more about making HN a nicer place.
    - nix23 4y ago
      >You could simply apologize to the GP instead of tripling down on snark No why? It's wrong to give your password to a 3rd party, you cant be a victim if you jump of a cliff all by yourself...so no victim-blaming here...the victims could be the (theoretical) customers of him. And btw i never called him "smartass"....so i would say if anything the "apologize"-thing is on the other side, but no feelings hurt ;) Oh and you used that word too...so much for a nicer HN and victim-blaming ;)
cush 4y ago
What would knowing them help? I wouldn't trust anyone I know with storing all my passwords

by nix23 4y ago

Don't trust people you don't know with your secrets...why do you even think they encrypt anything (trust?), in the real world you would never be that ignorant right?

gillesjacobs 4y ago

Of course, lesson learned, I chose convenience over common sense. Self-hosted, encrypted passwords it is from now on. LastPass is luckily(?) the only counterparty I ever trusted to this degree except for maybe my banks. (Great, after I fix this password mess, I will have to start looking into trustless banking)

hackernewds 4y ago
[flagged]
- gillesjacobs 4y ago
  All in good spirits with a smile and a wink ;) though I don't appreciate being language policed.

orcanwe 4y ago

If you’re being so cocky, I’m sure you would never type your secrets into any piece of software that auto-updates, right? After all, you’re trusting someone else not to release a software update that leaks your secrets. And I’m sure you do a full audit of the Chrome source code every time a new version is released. And for your locally hosted password manager software too, right?

nix23 4y ago
>I’m sure you would never type your secrets into any piece of software that auto-updates, right? Never all of them, with notes, urls and other stuff....what has auto-update todo with it? I don't save my passwords in a password-cloud-service....is that really so hard to understand why it is a bad idea if you do that? Well here you have it why it's a bad idea.
- dns_snek 4y ago
  Any software running on your PC can gain access to any online account on your PC. If you have auto-updates enabled, a malicious update could be pushed to your PC at any time to compromise you and tens of millions of other users, even with something as ubiquitous as uBlock Origin. At some point you have to trust someone unless you wish to live off the grid, that's just an unfortunate reality.
  - nix23 4y ago
    So your argumentation is: The attack surface is already big, let's make it even bigger..in this case for pure laziness. Good point really...
    - dns_snek 4y ago
      My argument is that a chain is only as strong as the weakest link in the chain. After all, what's the alternative? - Remembering all of your (strong, unique) passwords? Impossible. - Using a single password, or a system for deriving "unique" passwords to make them easy to memorize? More insecure than an cloud-based password manager. People forget and get injured. - Using an offline password manager such as KeePass? Doable, but you trade one set of concerns for another. How many NPM packages have been compromised, stealing data from developer machines? How many people get knowingly, or unknowingly infected? Are you certain that the likelihood of your own machine getting compromised is lower than that of e.g. Bitwarden? Furthermore, if you use something like DropBox to sync your "offline" vault across devices, you're once again trusting someone else to keep the vault safe. Your risk of a targeted attack might be lower with offline storage, but your risk of an automated attack is significantly increased, because most people don't know how to properly secure their $5 VPS or Raspberry Pi that they're using to self-host their password manager. You claimed that using any cloud-based password manager is a bad idea, I disagree. Password managers are not made equal so it's important to do some research and pick one that undergoes extensive security audits, is preferably open source and use a strong passphrase to secure it. A password manager that fits this criteria will produce a vault file that would take hundreds of years to crack, even if their servers get breached and all data is stolen. This was notably not the case with LastPass. It was neither properly implemented, nor (properly) audited, nor open source.

scrollaway 4y ago

When you're using a password, you're entrusting that password to: - Your web browser (which you're entrusting with a WHOLE LOAD of things by the way) - Your operating system (Same same) - A crapload of software that runs locally, depending on which OS you're running - That security camera behind you in the Starbucks you're working from - That guy sitting next to you in the metro looking at your phone. Surely you're using a privacy screen, I hope? - Whoever manufactured your computer's hardware - Whichever god you're praying to if any. Hopefully your password isn't naughty. Hey, you know, just... don't be a smartass with people. opsec is extremely difficult, and there's always a thing to find to victim-blame. I mean, fuck, Lastpass didn't have great reputation in the first place (they fucked up several times in the past) and people should be using bitwarden/1password/keepassxc, not LP. That is STILL NOT A REASON to victim-blame.

nix23 4y ago
Your examples are like telling everyone that smoking and drinking can be deadly but then jumping off a cliff....bravo! jumping off a cliff = giving all your passwords to a 3rd party smoking = showing the starbuck-cam your single doted password
- scrollaway 4y ago
  You could simply apologize to the GP instead of tripling down on snark, here and in sibling comments. Whatever happens makes no difference to me personally, it's more about making HN a nicer place.
  - nix23 4y ago
    >You could simply apologize to the GP instead of tripling down on snark No why? It's wrong to give your password to a 3rd party, you cant be a victim if you jump of a cliff all by yourself...so no victim-blaming here...the victims could be the (theoretical) customers of him. And btw i never called him "smartass"....so i would say if anything the "apologize"-thing is on the other side, but no feelings hurt ;) Oh and you used that word too...so much for a nicer HN and victim-blaming ;)

cush 4y ago

What would knowing them help? I wouldn't trust anyone I know with storing all my passwords