3 ms·

I'm really curious what people in the know have to say about PM's in general and what the good options are. I personally really love having an in-browser passw

I'm really curious what people in the know have to say about PM's in general and what the good options are. I personally really love having an in-browser password manager. It's an incredible convenience and it lets every service have a unique and nearly impossible to crack password. I have far too many services to remember them all, and using the same password for everything would be terrible. But of course I see the risk of having "one password to rule them all" and putting so much faith in one service. If it fails, losing everything is possible. I don't mind paying of course if there's a reason to, though for now the free version of Bitwarden has been fine for years.

palant 4y ago
Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all covered. Except for #5 where they opted for convenience: https://palant.info/2018/08/29/password-managers-please-make-sure-autofill-is-secure/ https://palant.info/2018/08/29/password-managers-please-make... This doesn’t mean that they are perfect. While Firefox allows you to choose a master password for your local password storage, even after improvements this is a very weak protection: https://palant.info/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother/ https://palant.info/2018/03/10/master-password-in-firefox-or.... From what I remember, Chrome doesn’t offer any local protection whatsoever – if somebody manages to copy this data off your computer it’s gone. More critical aspect is the sync functionality: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/ https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy.... Following my report, Chrome Sync has been improved and now offers reasonable protection at least for passwords – assuming that you set a passphrase which isn’t the default. In principle, Firefox Sync is better because it always encrypts all data, not merely passwords. But its bruteforce protection is very weak, the bug report I link to is still unresolved. So you would need a really strong password to protect the data (ideally randomly generated).
edflsafoiewq 4y ago
I have a small script that does hash(key + masterPasswd). key is usually just the site's domain name. I have the script and a few of the important passwords (eg my email) written down on paper in case my drive dies. It works fine for me.
- palant 4y ago
  You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters. Originally (before I started writing my own password manager) I also thought that this is a safe method of password generation. And then I realized that it isn’t. Wrote about it here: https://palant.info/2016/04/20/security-considerations-for-password-generators/ https://palant.info/2016/04/20/security-considerations-for-p...
  - edflsafoiewq 4y ago
    Assuming you have the password and key, you'd need to brute force hash and masterPasswd. Seems hard.
    - palant 4y ago
      It isn’t. You certainly used MD5, SHA1, SHA256 or SHA512 as hash, with SHA256 being the most likely one. All of these are very easy to bruteforce – if someone has one of your passwords, bruteforcing your master password won’t take all too long.
      - edflsafoiewq 4y ago
        hash(x+const), hash^n(x), etc. are also hash functions.

palant 4y ago

Browsers’ built-in password managers certainly have above average quality, at least when used as a purely local solution. A while ago I listed typical issues of the browser integration in password managers, browser vendors have it all covered. Except for #5 where they opted for convenience: https://palant.info/2018/08/29/password-managers-please-make-sure-autofill-is-secure/ https://palant.info/2018/08/29/password-managers-please-make... This doesn’t mean that they are perfect. While Firefox allows you to choose a master password for your local password storage, even after improvements this is a very weak protection: https://palant.info/2018/03/10/master-password-in-firefox-or-thunderbird-do-not-bother/ https://palant.info/2018/03/10/master-password-in-firefox-or.... From what I remember, Chrome doesn’t offer any local protection whatsoever – if somebody manages to copy this data off your computer it’s gone. More critical aspect is the sync functionality: https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sync-be-trusted-with-sensitive-data/ https://palant.info/2018/03/13/can-chrome-sync-or-firefox-sy.... Following my report, Chrome Sync has been improved and now offers reasonable protection at least for passwords – assuming that you set a passphrase which isn’t the default. In principle, Firefox Sync is better because it always encrypts all data, not merely passwords. But its bruteforce protection is very weak, the bug report I link to is still unresolved. So you would need a really strong password to protect the data (ideally randomly generated).

edflsafoiewq 4y ago

I have a small script that does hash(key + masterPasswd). key is usually just the site's domain name. I have the script and a few of the important passwords (eg my email) written down on paper in case my drive dies. It works fine for me.

palant 4y ago
You just exposed all your passwords to bruteforcing attacks. Unless “hash” in this case is something like scrypt with sane parameters. Originally (before I started writing my own password manager) I also thought that this is a safe method of password generation. And then I realized that it isn’t. Wrote about it here: https://palant.info/2016/04/20/security-considerations-for-password-generators/ https://palant.info/2016/04/20/security-considerations-for-p...
- edflsafoiewq 4y ago
  Assuming you have the password and key, you'd need to brute force hash and masterPasswd. Seems hard.
  - palant 4y ago
    It isn’t. You certainly used MD5, SHA1, SHA256 or SHA512 as hash, with SHA256 being the most likely one. All of these are very easy to bruteforce – if someone has one of your passwords, bruteforcing your master password won’t take all too long.
    - edflsafoiewq 4y ago
      hash(x+const), hash^n(x), etc. are also hash functions.