8 ms·

In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? I've never used a pw manager because it seems ab

• Saris 4y ago
  Well, what's the alternative besides a local keepass DB or something?
  • thot_experiment 4y ago
    I use a mental algorithm that generates a unique password for each site. It's easy to remember the algorithm and I get a complex unique password for every site. I don't think a password existing outside of your head makes sense. (though some sites force unique passwords/and password changes, which can be annoying as I have to remember to bump a value mentally for how many times i've been forced to do it, luckily for the most part it's not an issue)
    • xconverge 4y ago
      I see, you left this out of your original post and it would have had me reply entirely different. This certainly can work for you and makes sense, expecting everyone to do this instead of using a tool to do this is unrealistic IMO. Everyone thinks about things differently and many people "dont care" about security and just want a password that works.
    • ncallaway 4y ago
      That’s great but for 95% of the population they’ll never do that. They’ll come up with a generic low security password that’s easy to both remember and type. And they’ll reuse essentially that same password on every site. So, for your practices maybe a password manager is a step down. But for 95% of the popular it’s a step up. Security is a spectrum, and password managers move most people to a more secure stance. You can yell at people that they can be more secure until you’re blue in the face, but most of them will shrug and ignore you.
    • CJefferson 4y ago
      If this was common, password hackers would encode such algorithms into password hackers, then once your password is leaked from one site,it's game over (I suspect the set of human brain easily executable algorithms isn't that large).
  • Schnitz 4y ago
    A local keepass is a great alternative, been doing that for ages and honestly copying my keepass db to a device every once in a while is way less troublesome than quadruple factoring into lastpass/1password or whatever.
    • scarab92 4y ago
      For most people, the keepass db will need to be synced and they’ll also want clients on their computers and phones to access it. What’s the difference, security wise, to an all in one offering that works the same way under the hood, like 1password cloud or bitwarden? It seems to me that those syncing keepass databases around are just incurring pain without any real increase in security.
      • derkades 4y ago
        Having a different vendor for the frontend software and the cloud storage part does arguably increase security. Let's say a national security agency wants access to your passwords. They can "easily" make LastPass send a custom version of the client to your browser. This custom version could send your password to LastPass, allowing them to decrypt your database. To me it seems like it would be harder to ship a malicious KeePass program to a single user. Especially if that user has installed KeePass using their Linux OS package manager.
      • noisy_boy 4y ago
        Syncing is basically painless and automatic with Syncthing[0] - you only need to set it up once per device (unless you are adding devices frequently which isn't the typical usecase for personal use). [0]: https://syncthing.net/ https://syncthing.net/
• wmf 4y ago
  The alternative to a password manager is to set all your passwords the same then that master password gets leaked.
  • forgotusername6 4y ago
    Probably much safer these days to just write them down in a notebook
    • CJefferson 4y ago
      This is what I personally recomend to all non computer experts -- a passbook being stolen from home seems much less likely than a serious computer issue.
• xconverge 4y ago
  If one site gets breached/exposed, your memorized username/password combination used all across the internet is now immediately available to the bad actors and you might not even know or remember everywhere it was used. Having a unique password for each site is the main advantage of a password manager to mitigate the damage in this case (to just the 1 site that was breached). Talking about your vault/passwords and "single basket" being obtained is relevant when using a password manager, especially with articles/news like this but just a different attack vector.
  • voidfunc 4y ago
    Doesn't this assume the passwords aren't hashed and salted?
    • xconverge 4y ago
      Yes my comment made a lot of assumptions, but the original post invited them I think. Reading the other comments from the original poster changes the tone of the original message a lot. I think for someone who knows the term "infosec" and has a mental algorithm, a password manager isnt necessary per-se. If we are talking about the general public, in a constantly evolving digital world, I think password managers are a good thing. I think this site is a tiny fraction of the potential userbase for a password manager
  • thot_experiment 4y ago
    I don't think that having a unique password per site is unachievable. I do it and I don't use a PW manager. Even something as simple as prepending the site name in ROT13 to a reused password greatly reduces your exposure to the sort of background infosec threat radiation that's like 99.99% of the threat model for most people
    • george_probably 4y ago
      Cool, now go explain that to your parents. NOW make sure they go through and change every single password on every single account they currently have and don't just get annoyed like 5 passwords deep and decide not to bother. The issue isn't you or me, it's what 99% of the world has to use. For the large majority of people, a password manager with one super strong password (and 2FA) makes WAY more sense.
• deleted 4y ago
  [deleted]
• itake 4y ago
  The alternative is: - Password re-use - Formulaic passwords - Simple passwords that are easy to type on a phone That are easily crackable Or performing password recovery every time you want to login.
• charcircuit 4y ago
  The alternative is repeating passwords which is a worse version of putting all your eggs in one basket.
• dhdgrygev 4y ago
  The average person, when not allowed to use a convenient password manager, will either use the same password for every site or come up with a predictable pattern. Encouraging a password manager helps make sure they don't get destroyed completely when a blog they signed up on 5 years ago is hacked. This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impossible to remember unique strings for each site.
  • codetrotter 4y ago
    > This is partly because so many things want an account now. I have over 500 passwords saved, it would be straight up impossible to remember unique strings for each site. How many of those accounts are essential? I create throw-away accounts on the regular. There are many accounts, but few that really matter. For the ones that matter I take care to make sure I have the passwords. For the rest, who cares :)
    • danielvaughn 4y ago
      I use the same password for every account that doesn’t have any private/payment info of mine. Don’t really care if they get hacked.
  • eurticket 4y ago
    What are some good methods to not create patterns, while allowing yourself to have an easier time remembering more complicated passwords?
    • usrusr 4y ago
      If you go for the shared strong secret part "uniquefied" by an added per-site trivial part (not saying that you should), you increase risk the longer the trivial part gets: if an attacker somehow determines that your password here is 123hacker456news789 they will easily guess that they can get into your Facebook using 123face456book789. Less easy if it's 123h456n789 (Because you don't really use the spaceballs password, in reality h and n don't stand out half as much). If it's 123c456w789 guessing Facebook's 123c456o789 from that would be quite close to brute forcing unless they get their hands on dozens off that kind.
• Biganon 4y ago
  I'm on the opposite side: I don't understand how a password manager can be compromised. Your passwords are encrypted and decrypted OFFLINE, on your device. You only ever send the ENCRYPTED vault. Your key never transits. How is that complicated? And how did LastPass fuck this up anyway?
  • drdec 4y ago
    I assumed that the hackers have the encrypted vaults. Is it known that that they have unencrypted password data?
    • dhdgrygev 4y ago
      No, but apparently the urls were not encrypted, so that could be quite a gold mine for blackmail.
    • thot_experiment 4y ago
      I believe they are only the encrypted vaults, but with the cost of compute plummeting and the inclusion of unencrypted data alongside the encrypted data I think you have reason to worry if you believe there are people who would perform a dedicated attack on you, or you are in a class likely to be identified as high value.
      • drdec 4y ago
        Oh, absolutely, you need to test that information as exposed and react accordingly. Fortunately for me, I don't use LastPass.
      • TillE 4y ago
        > the cost of compute plummeting You should do some actual math to roughly estimate what it would take to crack a good password. Use a strong password, use a resource-intensive key derivation function, and you should feel extremely comfortable that your encrypted data will not be cracked within your lifetime.
    • JoshuaEN 4y ago
• cirrus3 4y ago
  The info LastPass and most other password managers I'd use have is useless even someone got it... sure they might get my email and what sites I stored passwords for, but the passwords themselves are not just sitting there in plain text or decreeable format able to be used.
  • bikeformind 4y ago
    …Let’s say you have several crypto exchange credentials stored, as well as a login to a finacial service that requires high net worth accreditation. Congratulations, you are now a high value identity theft or kidnapping target. How about a married man who had a secret account on a dating site? Or the URL of a medical results portal at a specialist institution? Now your medical history is out in the open.
• 0x45696e6172 4y ago
  Because it is better than the alternative. Pick two: (1) memorizable passwords (2) bruteforce-resistant passwords (3) account-unique passwords. The best tradeoff for me is (2)+(3) sacrificing (1), so I use a local password manager (named 'pass'). That said, I would never trust a 3rd party like LastPass.
  • koolba 4y ago
    Not being able to do #1 can be a feature. If you can’t easily login to your accounts it adds just the right amount of friction to buying things online.
    • paledot 4y ago
      Indeed, made worse/better by the need to fetch my Yubikey to sign in. Likewise how Firefox Focus helped me to kick my Facebook habit.
  • wutbrodo 4y ago
    Choose a complex base password + a memorizable _algorithm_ that combines (eg) domain names with the base password. That satisfies all of your requirements, and it's not super difficult to create an algorithm that is easy to perform mentally and hard to reverse. I started doing this in college, and it's been super easy to keep up and my passwords are pretty secure.
    • benhurmarcel 4y ago
      I did this before using a password manager. I found that it does work but it's still a pain. For example, what do you do when you're forced to change a password? You need to remember that this website doesn't follow the rule. There's also the case of password being used by several websites with different names or urls, you need to remember which is the base one. Also it's really convenient to store other things than passwords in the password maanger. Like some notes, your customer number, which email you signed up with, some PIN they give you...
• EVa5I7bHFq9mnYK 4y ago
  For example, I am old and can't remember sh-t. I can only remember one master password, and I've already forgotten it twice. Now have it backed up on a piece of paper. Looking forward for a day when I forget where I put that piece of paper ...
  • qwertox 4y ago
    It's not just age. If you don't use a password often you will definitely forget it unless you have a mental algorithm to generate those passwords like parent commenter suggests.
• feanaro 4y ago
  Reusing passwords or having low entropy passwords is a larger risk. The thing is... Your password manager should be offline, not a cloud service.
  • yreg 4y ago
    >Your password manager should be offline, not a cloud service. Why?
    • TillE 4y ago
      There's this persistent vague myth on HN that there's something terrible about having an encrypted blob publicly exposed, which to me demonstrates a total lack of understanding about cryptography. Or they're just using weak passwords. Don't do that. The problem here is that a bunch of unencrypted data was exposed, which is really bad and dumb of LastPass.
      • feanaro 4y ago
        If you assume the strongest opposing argument, it's clear the "myth" isn't arising from a misunderstanding of cryptography. Rather, it's arising from the practical observation that password managers are not perfect, and therefore encryption is often not sufficient. In fact, you offer this argument yourself in your comment -- it is really bad and dumb of LastPass, and yet it happened, because these things happen in reality. Exploiting bugs in the end-user web application, accidentally exposing unencrypted data, unnecessarily collecting all data in a single location in the first place, a break in cryptography leading to a total break of security are all failure modes that only affect cloud password managers.
    • taneq 4y ago
      Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?
• civopsec 4y ago
  > In light of this breach, can someone explain to me why it's not stupid to keep all your passwords in one place? My passwords-in-one-place software is not on the Web/Cloud. (And I don’t understand why this point needs to be restated in every Lastpass thread.)
• userbinator 4y ago
  You could just tell users to write down their unique passwords physically and store them somewhere safe instead of reusing the same password, but that wouldn't fit the narrative of being able to sell services for password management and no doubt another thing the "security" community seems to be highly against. I agree it's 100% stupid --- "all your eggs in one basket" is exactly the phrase that comes to mind for me too. Centralisation makes for one massive point of failure. If everyone stored passwords in their head or offline, it'd already make it much harder for attackers but there's no recurring $$$ for services in helping people do that. If people can be convinced to believe fake news, what other irrationalities can they be persuaded to believe? It's all just the power of marketing.
  • dredmorbius 4y ago
    At the scale of present-day secured-systems use, this becomes fairly cumbersome quickly. The typical person, as long ago as 2015, had around (and possibly over) 100 accounts. I'm seeing people referring to many hundreds managed by LastPass or other password-management systems. Using, say, a paper-based system whether in a bound journal or a set of index or Rolodex cards, a 500-account archive would take up most of a journal, or a pretty hefty chunk of cards, and that archive itself would require physical security (though at least data exfiltration would be slower than from a digital archive). It's not the sort of thing you could easily carry around with you, or access from multiple locations, should you need to do so. In corporate use, the problem is compounded by: - Multiple people requiring access to systems. - Both shared-account and multi-account systems (e.g., a shared root to servers, master DBA account, or embedded / appliance devices with a single account). - Multi-office (or remote / home office) access. - Multi-device access (as in people are accessing systems from multiple devices). This doesn't necessarily mean that a third-party service is your best or only option, but it strongly tends toward a managed third-party system being convenient where "convenient" means "our business which lacks a true CISO role would be dead in the water without it". Mind: I'm not defending LastPass here, and I don't use it. The solutions I've seen in the past which have impressed me most were based on managed SSH keys with SSH access to critical systems, and the bare minimum of shared accounts. I'd also like to see: 1) Far fewer authenticated services where that authentication is not necessary. For the most part, if I can avoid creating a new account, I do. (My circumstances leave me considerable latitude that many people wouldn't have, in this regard.) Systems based on asserted identity through PGP seem to me one option (e.g., rather than logging in and posting content, you'd post PGP-signed content, which the remote system would vet. Similarly, reading private content would be encrypted against your keys. This doesn't address all account-based interactions, but it does cover a large bit of landscape. 2) Physical-token based security particularly based on NFC or Yubikey-type devices. Keep in mind that an earlier widely-used technology, RSA keyfobs which would generate one-time PINs as a 2FA, turned out to have a nasty vuln some years back. But fewer accounts, PKI-based auth, and physical 2FA ... seem increasingly necessary changes. As numerous others apparently do: I use a local, encrypted, password keystore that is not managed by a third-party service. (And don't even get me started on third-party data privacy doctrines.)
• avianlyric 4y ago
  > having to go through the reset dance every once in a while because you forgot one. So you do use a centralised password manager. You just call it email, rather than 1Password.
• nkrisc 4y ago
  Because it’s less bad than the alternatives. I can’t remember a unique password for every account I have. > I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. I’m going to forget it. Either I use a centralized password keeper or the real login process is the reset password flow. Using a password manager is probably more secure and convenient than whatever solution a can feasibly come up with in my own. Everything requires a password and I will not be able to remember them all. It took me about 15 years to finally remember my own SSN.
  • tempestn 4y ago
    Not only could you forget it, I imagine it's going to be pretty difficult to have a mental algorithm that's going to be secure against a couple of your passwords being compromised. So if someone wanted to target you, I bet they'd have a decent chance of cracking the algorithm. Now of course, unless you're a prominent figure, that's very unlikely. But so is a full breach of a major PW manager (preferably not LastPass).
    • TechBro8615 4y ago
      I don't think you need to be a prominent figure to be worried about being targeted specifically. If you date someone in infosec and then break up with them they could easily become a stalker who searches haveibeenpwned for your accounts and starts whittling away at your passwords...
• coder543 4y ago
  No one has mentioned this to you yet, from what I can see, but Master Password[0] is basically what you're asking for. It is well worth it to switch to an implementation of that instead of your mental calculus. > I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. Being completely honest, I consider this a terrible strategy. I seriously doubt your "algorithm" is anywhere close to as secure as you think it is. Humans suck at coming up with passwords, period, no matter how clever they think they are, and then memorizing those passwords is at least as difficult. Any algorithm that would actually be secure would take far too long to mentally apply to each website each time you visit it. Fully featured password managers like 1Password can include much more than just usernames and passwords, which increases their value significantly. Otherwise, users absolutely store that incredibly important information in completely unencrypted places, often synced with the cloud, because it is important information that they need access to, and they want to make sure it doesn't get lost. There is tremendous value in having a user-friendly encrypted vault. Since the entire vault is fully end to end encrypted with any decent password manager (like 1Password), the weaknesses that repeatedly affect LastPass do not ever apply here. The only thing that matters is having a strong password on your vault, and keeping that password secure. It doesn't matter if 1Password gets hacked, no one will even know what websites you have accounts on. Coincidentally, 1Password also doesn't have the same history of breaches that LastPass does. The only other security risk beyond a weak password is a supply chain attack, where 1Password ships a compromised version of the 1Password client that steals your vault password, but this is significantly harder for a malicious actor to pull off than the breaches LastPass has dealt with, and any software vendor that you trust could be compromised and install a keylogger on your device, which would achieve the same outcome, so this is not specific to 1Password, and therefore I don't consider it very relevant to the discussion beyond mentioning that other people might bring it up. > That's my personal approach and I think it's a better way to go. It's really not, but someone who comes to the internet to rant about this stuff is so strongly convicted of their belief that I don't think I'm going to be able to change it, so I'll just leave it at that. I have cared a lot about cybersecurity for a long time, even before I worked in the cybersecurity industry for a few years, which gave me lots of additional exposure to experienced people and current events. I have never recommended LastPass to anyone, and I would never recommend it to anyone. 1Password is a completely different story. There are valid open source alternatives, which you can self host, but most people (outside of this forum) are not going to succeed at hosting their own password manager, so it's important to find a trustworthy hosted option. [0]: https://en.wikipedia.org/wiki/Master_Password_(algorithm) https://en.wikipedia.org/wiki/Master_Password_(algorithm)
• the8472 4y ago
  Use an offline password manager, avoid SaaS. Make sure it's secured with Argon2 and burns a a few seconds of compute to unlock. Use hardware MFA tokens for your most critical accounts. You could also tie individual copies of the database to the machine's TPM and only sync after decrypting (yet another factor). > I believe there are alternatives that are more secure such as using a mental algorithm that generates a unique password per site. That gets tedious when you also have to conform to stupid, different password policies on various sites. If you want to compartmentalize things you could use multiple password databases with different master passwords? The master password is still something you have in your head.
  • aobdev 4y ago
    These passwords have to be encrypted so they can be retrieved later, right? I don’t think Argon2 works for that purpose.
    • the8472 4y ago
      Argon2 can be used as KDF, not just as a password hash in an authentication database.
  • wutbrodo 4y ago
    This isn't a problem in practice. Ime you can cover 99.9% of sites with uppercase, numbers, and a special symbol like "!".
• grupthink 4y ago
  Might as well store your online passwords in your email, since it’s used for password resets. Might feel weird but your email is your weakest link anyway.
• lamontcg 4y ago
  > using a mental algorithm that generates a unique password per site. If someone has access to one or more of your passwords and can reverse engineer your 'algorithm' then you have effectively just reused the same password everywhere. Even if you include some amount of memorized numbers or whatever the entropy is probably a lot lower than having an xkcd-strong password in a manager and randomized passwords stored in it.
• registeredcorn 4y ago
  For the job I work at, I easily have 100-200 accounts that I need access to (we have multiple environments for the same projects, so things tend to get inflated very quickly). The accounts that I need to access are accounts that I did not make, and do not have admin control over. If I didn't have a password manager that someone could "share" these passwords to me, I would instead have to do some wonky method of: Employee sends me two emails encrypted. Email 1 contains a list of usernames. Email 2 contains a list of passwords. Any time I need to access any site, I need to open up the two files that were sent, count down to whatever line that project would be relevant to, then copy/paste the username from the first file. Then do the same with the other. (And hope that I didn't miscount.) This also doesn't account for things like password expiration. Some of our projects require it, while others don't. I would constantly be receiving new encrypted emails with this info from people, and be struggling to keep the locally stored files updated. This would then also open me up to higher risk in that, if my computer ever got compromised, or anyone elses for that matter, than then every single password would have to be changed for every single site, and new encrypted emails would have to be sent out. It's stressing me out just to think about, honestly. Password managers are, honestly, kind of a clunky and weird idea. I think that the sorts of problems we see are likely always going to be an issue, but until we get passed the entire idea of even using username/password as the standard, than we're going to need a means to manage them in this way. Basically, I wouldn't call Password Managers "secure" but I'd call them "secure-ish". It's making the best of a bad situation.
• CatWChainsaw 4y ago
  I love my analog password manager.
• Mystery-Machine 4y ago
  If you don't keep your 2FA keys in your password manager, it offers much better protection than anything you can come up with in your head. What happens when you need to change a password on one site? How do you know which password algorithm you're using on which site now? Why am I asking you this? Because I was in the same situation and it became difficult to track. Now I keep all my passwords in a password manager, my 2FA codes in another app/service, and my recovery codes in the third place that's not connect with the first two in any way. Similarly, obviously, I don't have my 2FA service account + password in my password manager.
• xboxnolifes 4y ago
  The attack vector I'm worried about is a website I use improperly storing passwords (plaintext, etc) and having a leak. To protect against this I use a unique password per website. I cannot possibly remember a unique, secure password for every website I use. So, I use a password manager.
• noisy_boy 4y ago
  To those who are advocating storing the passwords in your head, what happens if a bus hits you and your partner has no idea about the passwords? You want to share the algorithm with them? What if they can't remember the algorithm/make a mistake? I would wager that keeping the secure database on cloud and/or a usb key along with master password in a bank safe deposit locker is a much safer way to pass the details to them.
• csomar 4y ago
  I was opposed to pw managers too, but then found out that my "master" password was leaked, which means I needed to reset all passwords (and good luck doing that because are you keeping a list of all sites you are using?) I also found out that I can easily forget passwords if they outnumber 5. Doing creative passwords around websites also does not generate enough entropy if one of your passwords is leaked. I then tried Trezor/Ledger and Yubi. They are the best solution, theoretically. However, I find myself more than once in a situation where I am at an airport and I need quick access to something through my phone. All options above require a laptop, though with Yubi NFC it might be possible. But that means you are also taking your Yubi everywhere you go... Bitwarden fixes all of that, or any pw that is open source and self-hosted. I'm using the paid version because 1. I want to support them and 2. self-hosted can be a dangerous option if your server goes down and you are locked out of your stuff...