4 ms·

So your more secure solution involves using... another, stronger, password? How would your mother use 1Password if she now has to remember _two_ passwords? Bot

by imiric 4y ago

So your more secure solution involves using... another, stronger, password? How would your mother use 1Password if she now has to remember _two_ passwords? Both LastPass and Bitwarden (and 1Password) support 2FA. This isn't a solution that will have mass adoption, but the UX is much better and more secure than using a secret key. It could even be used by non technical users, depending on the device. But password managers aren't a solution for digital identity. They're a hassle to use and a huge security risk, especially centralized ones. What we need is a solution that is more secure, but crucially also easier to use. The industry has been trending towards passwordless solutions for years now (OTP, FIDO, WebAuthn, etc.), and the current passkey iteration by Google might be something that could have mass adoption. Assuming you trust Google, but the technology seems sound. We still might want to use secure storage for other data, but that's a much more niche use case that can be secured with existing MFA solutions, and doesn't have to be as user friendly as identity management.

prmoustache 4y ago
> Both LastPass and Bitwarden (and 1Password) support 2FA. AFAIK it doesn't help if your vault is in the hand of someone who obtained it from a security breach on lastpass/bitwarden side.
- dividedbyzero 4y ago
  That's where 1password's security key helps because you need that for decryption. Apps will store it so you really only need it once when setting up a new phone/computer and you can transfer it from another via qr code, but if all you have is a vault dump, you're out of luck even if you phish the password (which should be easier than phishing the security key since it's used a lot and in muscle memory)
  - deleted 4y ago
    [deleted]
xvector 4y ago
> How would your mother use 1Password if she now has to remember _two_ passwords? She doesn't have to remember the secret key. She prints out copies and puts them somewhere safe. > Both LastPass and Bitwarden (and 1Password) support 2FA [...] the UX is much better and more secure than using a secret key No. Please don't make statements like this if you're not certain. 2FA confers zero benefit in a breach like this one. It is merely an access control, and doesn't provide any cryptographic benefit. Secret keys, however, make such a breach basically worthless. No amount of rainbow table usage or master password compromise will help you unless you can obtain the secret key.
- Eleison23 4y ago
  [dead]

by imiric 4y ago

prmoustache 4y ago

> Both LastPass and Bitwarden (and 1Password) support 2FA. AFAIK it doesn't help if your vault is in the hand of someone who obtained it from a security breach on lastpass/bitwarden side.

dividedbyzero 4y ago
That's where 1password's security key helps because you need that for decryption. Apps will store it so you really only need it once when setting up a new phone/computer and you can transfer it from another via qr code, but if all you have is a vault dump, you're out of luck even if you phish the password (which should be easier than phishing the security key since it's used a lot and in muscle memory)
- deleted 4y ago
  [deleted]

xvector 4y ago

> How would your mother use 1Password if she now has to remember _two_ passwords? She doesn't have to remember the secret key. She prints out copies and puts them somewhere safe. > Both LastPass and Bitwarden (and 1Password) support 2FA [...] the UX is much better and more secure than using a secret key No. Please don't make statements like this if you're not certain. 2FA confers zero benefit in a breach like this one. It is merely an access control, and doesn't provide any cryptographic benefit. Secret keys, however, make such a breach basically worthless. No amount of rainbow table usage or master password compromise will help you unless you can obtain the secret key.

Eleison23 4y ago
[dead]