30 ms·

The hard part of building a (good) password manager is not actually the encryption backend (gpg, age, etc...), or the frontend (CLI, dmenu, GUI...), or the sync

The hard part of building a (good) password manager is not actually the encryption backend (gpg, age, etc...), or the frontend (CLI, dmenu, GUI...), or the sync (git, CRDTs, whatever), or even integrating the biometric unlock -- but correctly integrating it with every app and website that expects to take your passwords. AWS console has three fields (account, user, password), most websites will take your password and/or MFA code on a separate page, some apps will use Electron, some will use native widgets, some will use NON-native widgets (like GTK/Qt on Mac/Windows), some apps (like games) will be running in full screen... It's a world of madness and I have huge respect for the password managers that actually try to solve these problems (even if most do it only half-decently).

TedDoesntTalk 4y ago
> integrating it with every app and website Yes, and I would add password device sync for multiple operating systems and browser extensions. Without sync, hundreds of unique, unmemorable passwords are not much value.
TillE 4y ago
This is precisely why I stopped using KeePass, the browser extensions just weren't good enough. Bitwarden is significantly better, though it also occasionally does the thing where the prompt to save a new password disappears, because of redirects or something.
- latchkey 4y ago
  I've retrained myself to always just create the account first in BW instead of rely on that prompt mechanism. Once the account is created in BW, you can just auto-fill it into the u/p fields.
ricardobeat 4y ago
I've been using a homegrown solution that is very similar to this, for about three years now. The way I access it is via Blink app on iPad/iPhone, the terminal on mac, WSL on Windows. Copy and paste the password, clear the clipboard (done automatically when using the terminal). It takes a few extra seconds but works anywhere, and I can add password-specific notes for cases like your AWS example. Putting the password in the clipboard is the least safe part, but I definitely prefer this over giving some random app full access to my browser / system.
- rollcat 4y ago
  > It takes a few extra seconds That's specifically the part I was extremely unhappy with, as a former pass+dmenu user, who has migrated to 1Password. It's a cold, autumn evening, we're down from the mountain hike and running to catch the last train home to return from the trip, and I need to buy the ticket either before or as soon as I'm on board; my stiff fingers are trying to make things happen on a phone with a small screen, poor reception, and a slowly dying battery. I need that password *now*.
RamenJunkie_ 4y ago
I really don't understand this trend that has popped up int he last few years of putting the Password on a separate page from the username. The Password manager usually catches it but sometimes does not. It just needlessly adds an extra step/page to the log in process.
- deathanatos 4y ago
  This is sometimes for SSO. If your user logs in with some form of SSO, after the username entry, you get redirected to your IdP, instead of prompted for a password.
  - projektfu 4y ago
    I think it's also fashion. Monkey see Google, monkey do Google.
- deleted 4y ago
  [deleted]
- counttheforks 4y ago
  It allows you to determine the authentication method based on username. Some users may need SSO, some may need email login, and yet others may simply use a password.
- ipqk 4y ago
  As others have said, it depends on the authentication method. Some users may not even have a password. They'll be sent an email or sms with an authenticated link. So to put a password box in front of them may be confusing. But it's definitely annoying to those of us with general passwords.
vbezhenar 4y ago
I've yet to see password manager I'd trust to mess my browser with. I don't want autocomplete. I want convenient and controlled access to my passwords and that's about it. Every password manager wants to run its non-opaque JavaScript on my login pages which I can't allow. What I need is: show button on top bar if current website has stored passwords. At this point no logins/passwords are requested from the password manager, only website URLs (or even hashes). After I click this button, request and show list of logins saved for this website. Let me choose login if there are multiple. Otherwise alter browser context menu. Now when I right-click on text input, add items like "Insert login: vbezhenar" and "Insert password for vbezhenar". And only when I choose "insert password" - actually request password from the password manager. That's the only sane UI. Until I find it or write it myself, I'll continue to copy-paste passwords around. It's a sad state of things where password managers are still not as usable as text file.
- kadoban 4y ago
  This seems _pretty_ close to how Bitwarden works. In fact, unless I'm missing some requirement, it's close enough that you can do that yourself if you just manually click the "copy username" and "copy password" buttons instead of the usual "just fill crap from this login" button. Those buttons aren't any harder to reach either, they're just smaller.
  - remram 4y ago
    But are we sure they don't inject any JavaScript before you hit the "fill" button?
    - kadoban 4y ago
      Not entirely sure, to be honest. I guess you could just not even install the browser extension and just use the separate application. It'll probably be less secure (don't think it'll know what page you're on, so it can prevent phishing) and more annoying, but if that's a hard requirement it should work.
- Jim_Heckler 4y ago
onionisafruit 4y ago
It would be nice if there was something like ad blocker filter lists for password managers so that every new password manager doesn't have to keep this up on its own. Maybe there is and I haven't run across it.
pqb 4y ago
That's true, the simple & fast UI (TUI/GUI) helps a lot. However, I would not extrapolate it to a huge problem. I am person, who have written own pass/passage implementation [0], just because I disliked how many steps I need to make to select the password for the form input, modify it or sync secrets. Initially, I had used the `gopass`. It is probably the most convenient way to start using the password-store. It is cross-platform, 100% compatible with pass & pass-otp. To copy the password, you basically type the part of the file you are looking for. If you type "gopass show github", it will display a TUI, where you can select the file you are looking for (let's say you have two files "personal/github.com.gpg" and "work/github.com.gpg"). Unfortunately, the search function was far from perfect, and it had a problem with typos like "gtihbu" at the time, when I was using it. To get rid of this issue, I decided to adapt pass/gopass to use `fzf` [2]. In the same time, my .password-store/ dir was rapidly growing that made me think about implementing pass from scratch. I improved the implementation to have better caching, synchronization between machines/mobile, but more importantly - a simple `secret [arg]` command that will execute `fzf` to list all known creds and simplify selection of the password. Of course, it accepted an argument that was limiting the results, which is great when you need to get back to the previous credential to retype something. The introduction of `fzf` made it really convenient, and I decided to add more commands with fuzzy search, such as: - `otp` - limits results files containing TOTP/HOTP token, calculates and copies it to the clipboard. - `secret-edit`, `secret-remove`, `secret-show`... aliases to sub-commands that open `fzf` command in multi-selection mode, so by utilizing space key I could select what files are meant to be modified, removed, displayed etc. Quite handy for mass-edit. - `secret-qr` - similar to the gopass' feature, but it made a simplified way to create and display QR codes dedicated to share contacts, WiFI SSID+password combination (etc.) to someone who was asking for creds from me. Awesome, but alt-tabbing to the terminal got me annoyed after a few years of using it that way. I started pursuing for more sophisticated interface. I decided to give `rofi` [3] a try. I managed to fork that repo and also adapt to my convention of using password-store, but I left i3 for a macOS. Currently, I have started working on a browser extension that takes care of suggesting password-store creds (based on the path, input parameters, location on the website etc.) similarly to what uBlock Origin does. That configuration is passed to my pass implementation, so on the github.com, my browser have only "work" and "personal" auto-suggestion, when I am focusing the text input. I plan to create a similar app to Shortcat [4], but it will preserve the information what credential has been asked for the focused app. I think, with VoiceOver assistance, it is more than possible to mitigate the need for alt-tabbing to the terminal for electron/native apps. [0]: It is a private repository, maybe when it will be polished enough I will open-source it. [1]: https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass [2]: https://github.com/junegunn/fzf https://github.com/junegunn/fzf [3]: https://github.com/alecdwm/pass-rofi-gui https://github.com/alecdwm/pass-rofi-gui [4]: https://shortcat.app/ https://shortcat.app/ Edit: About the AWS login form. I strongly recommend giving `aws-vault` (https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault) a try. It helps you skip the login form with a simple command e.g.: "aws-vault login acme-corp --duration 2h". I find it better than `aws-mfa` on my dev machine.
j3s 4y ago
for what it's worth, the pa -> browser input "integration" feels a lot better than you'd think, but takes a little bit of effort to setup. check out the contrib/ dir for some supported programs - get one of those in your $PATH, and set up a hotkey to launch it. now, whenever you press the hotkey, a list of your passwords will show up, which you may type to filter. when you press return, the password you selected will be automatically typed into whatever you have highlighted, whether it's a password field in a browser, or vim. the neat thing is that the password never touches your clipboard since it's typed directly by either wtype or xdotool. the workflow really only takes a second or two once you have it setup, and feels very nice, imo!
mahathu 4y ago
It would be nice if a password manager could take care of detecting a page reload/change and auto fill the rest of the form, but I guess the risk of skipping through pages without any user interaction is too large for users (including myself) to trust it. I think the problem rather lies in how difficult modern UI makes it to sign in sometimes ppppp,,,,,,,,,,,
cristoperb 4y ago
> The hard part of building a (good) password manager is ... correctly integrating it with every app and website that expects to take your passwords What's wrong with plain old copy-and-paste? (I know there are probably some security concerns under X11, but Keepass, for example, will automatically clear the clipboard after a few seconds at least.) I use Keepass and 1password.com, but I don't use any of their autofill features; I just copy a password when I need it and paste it to where I need it. I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager.
- deleted 4y ago
  [deleted]
- jonwinstanley 4y ago
  Copy and paste is fine, plus most usernames are your email, which should auto complete
- forty 4y ago
  The issue with copy pasting password is phishing, which for most real life users is a much bigger risk than most other risks
- deleted 4y ago
  [deleted]
- rollcat 4y ago
  > What's wrong with plain old copy-and-paste? Context awareness. I currently have 429 items in my PM (it happens to be 1Password, specifically because it's extremely good at figuring this crap out). I almost never have to search for anything; even if I do, I can easily update the entry, so that it understands the context, in which a given credential can be valid; e.g. I can use my Blizzard login both on "https://battle.net https://battle.net", and in "app://sc2" (StarCraft 2). If I have a main+alt account, it will allow me to choose from the two, not 400+. It's the same as with using contactless payments with a smartwatch, it saves you 10 seconds here, a minute there - and over the course of your day, day after day - it starts adding up. > I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager. CRDTs solve this problem quite generally. I've never tried actually implementing sync from scratch in a desktop/mobile app, but the theory behind CRDTs is quite easy to grasp and makes a lot of sense. I'd say it's quite a bit harder to sync plain, old files, because the only metadata you have available is things like names, access/modification times, etc and they tend to be huge binary blobs, like photos or music, so the problem of automatic conflict resolution gets quite interesting. BTW look up Apple's CloudKit. I've done a "let's pretend we're on a 1990s Internet" challenge[1] a while ago, and it's amazing how reliably everything syncs, even if the devices are online for maybe 1% of the day. [1]: https://www.rollc.at/tags/challenge/ https://www.rollc.at/tags/challenge/
deleted 4y ago
[deleted]

TedDoesntTalk 4y ago

> integrating it with every app and website Yes, and I would add password device sync for multiple operating systems and browser extensions. Without sync, hundreds of unique, unmemorable passwords are not much value.

TillE 4y ago

This is precisely why I stopped using KeePass, the browser extensions just weren't good enough. Bitwarden is significantly better, though it also occasionally does the thing where the prompt to save a new password disappears, because of redirects or something.

latchkey 4y ago
I've retrained myself to always just create the account first in BW instead of rely on that prompt mechanism. Once the account is created in BW, you can just auto-fill it into the u/p fields.

ricardobeat 4y ago

I've been using a homegrown solution that is very similar to this, for about three years now. The way I access it is via Blink app on iPad/iPhone, the terminal on mac, WSL on Windows. Copy and paste the password, clear the clipboard (done automatically when using the terminal). It takes a few extra seconds but works anywhere, and I can add password-specific notes for cases like your AWS example. Putting the password in the clipboard is the least safe part, but I definitely prefer this over giving some random app full access to my browser / system.

rollcat 4y ago
> It takes a few extra seconds That's specifically the part I was extremely unhappy with, as a former pass+dmenu user, who has migrated to 1Password. It's a cold, autumn evening, we're down from the mountain hike and running to catch the last train home to return from the trip, and I need to buy the ticket either before or as soon as I'm on board; my stiff fingers are trying to make things happen on a phone with a small screen, poor reception, and a slowly dying battery. I need that password *now*.

RamenJunkie_ 4y ago

I really don't understand this trend that has popped up int he last few years of putting the Password on a separate page from the username. The Password manager usually catches it but sometimes does not. It just needlessly adds an extra step/page to the log in process.

deathanatos 4y ago
This is sometimes for SSO. If your user logs in with some form of SSO, after the username entry, you get redirected to your IdP, instead of prompted for a password.
- projektfu 4y ago
  I think it's also fashion. Monkey see Google, monkey do Google.
deleted 4y ago
[deleted]
counttheforks 4y ago
It allows you to determine the authentication method based on username. Some users may need SSO, some may need email login, and yet others may simply use a password.
ipqk 4y ago
As others have said, it depends on the authentication method. Some users may not even have a password. They'll be sent an email or sms with an authenticated link. So to put a password box in front of them may be confusing. But it's definitely annoying to those of us with general passwords.

vbezhenar 4y ago

I've yet to see password manager I'd trust to mess my browser with. I don't want autocomplete. I want convenient and controlled access to my passwords and that's about it. Every password manager wants to run its non-opaque JavaScript on my login pages which I can't allow. What I need is: show button on top bar if current website has stored passwords. At this point no logins/passwords are requested from the password manager, only website URLs (or even hashes). After I click this button, request and show list of logins saved for this website. Let me choose login if there are multiple. Otherwise alter browser context menu. Now when I right-click on text input, add items like "Insert login: vbezhenar" and "Insert password for vbezhenar". And only when I choose "insert password" - actually request password from the password manager. That's the only sane UI. Until I find it or write it myself, I'll continue to copy-paste passwords around. It's a sad state of things where password managers are still not as usable as text file.

kadoban 4y ago
This seems _pretty_ close to how Bitwarden works. In fact, unless I'm missing some requirement, it's close enough that you can do that yourself if you just manually click the "copy username" and "copy password" buttons instead of the usual "just fill crap from this login" button. Those buttons aren't any harder to reach either, they're just smaller.
- remram 4y ago
  But are we sure they don't inject any JavaScript before you hit the "fill" button?
  - kadoban 4y ago
    Not entirely sure, to be honest. I guess you could just not even install the browser extension and just use the separate application. It'll probably be less secure (don't think it'll know what page you're on, so it can prevent phishing) and more annoying, but if that's a hard requirement it should work.
Jim_Heckler 4y ago

onionisafruit 4y ago

It would be nice if there was something like ad blocker filter lists for password managers so that every new password manager doesn't have to keep this up on its own. Maybe there is and I haven't run across it.

pqb 4y ago

That's true, the simple & fast UI (TUI/GUI) helps a lot. However, I would not extrapolate it to a huge problem. I am person, who have written own pass/passage implementation [0], just because I disliked how many steps I need to make to select the password for the form input, modify it or sync secrets. Initially, I had used the `gopass`. It is probably the most convenient way to start using the password-store. It is cross-platform, 100% compatible with pass & pass-otp. To copy the password, you basically type the part of the file you are looking for. If you type "gopass show github", it will display a TUI, where you can select the file you are looking for (let's say you have two files "personal/github.com.gpg" and "work/github.com.gpg"). Unfortunately, the search function was far from perfect, and it had a problem with typos like "gtihbu" at the time, when I was using it. To get rid of this issue, I decided to adapt pass/gopass to use `fzf` [2]. In the same time, my .password-store/ dir was rapidly growing that made me think about implementing pass from scratch. I improved the implementation to have better caching, synchronization between machines/mobile, but more importantly - a simple `secret [arg]` command that will execute `fzf` to list all known creds and simplify selection of the password. Of course, it accepted an argument that was limiting the results, which is great when you need to get back to the previous credential to retype something. The introduction of `fzf` made it really convenient, and I decided to add more commands with fuzzy search, such as: - `otp` - limits results files containing TOTP/HOTP token, calculates and copies it to the clipboard. - `secret-edit`, `secret-remove`, `secret-show`... aliases to sub-commands that open `fzf` command in multi-selection mode, so by utilizing space key I could select what files are meant to be modified, removed, displayed etc. Quite handy for mass-edit. - `secret-qr` - similar to the gopass' feature, but it made a simplified way to create and display QR codes dedicated to share contacts, WiFI SSID+password combination (etc.) to someone who was asking for creds from me. Awesome, but alt-tabbing to the terminal got me annoyed after a few years of using it that way. I started pursuing for more sophisticated interface. I decided to give `rofi` [3] a try. I managed to fork that repo and also adapt to my convention of using password-store, but I left i3 for a macOS. Currently, I have started working on a browser extension that takes care of suggesting password-store creds (based on the path, input parameters, location on the website etc.) similarly to what uBlock Origin does. That configuration is passed to my pass implementation, so on the github.com, my browser have only "work" and "personal" auto-suggestion, when I am focusing the text input. I plan to create a similar app to Shortcat [4], but it will preserve the information what credential has been asked for the focused app. I think, with VoiceOver assistance, it is more than possible to mitigate the need for alt-tabbing to the terminal for electron/native apps. [0]: It is a private repository, maybe when it will be polished enough I will open-source it. [1]: https://github.com/gopasspw/gopass https://github.com/gopasspw/gopass [2]: https://github.com/junegunn/fzf https://github.com/junegunn/fzf [3]: https://github.com/alecdwm/pass-rofi-gui https://github.com/alecdwm/pass-rofi-gui [4]: https://shortcat.app/ https://shortcat.app/ Edit: About the AWS login form. I strongly recommend giving `aws-vault` (https://github.com/99designs/aws-vault https://github.com/99designs/aws-vault) a try. It helps you skip the login form with a simple command e.g.: "aws-vault login acme-corp --duration 2h". I find it better than `aws-mfa` on my dev machine.

j3s 4y ago

for what it's worth, the pa -> browser input "integration" feels a lot better than you'd think, but takes a little bit of effort to setup. check out the contrib/ dir for some supported programs - get one of those in your $PATH, and set up a hotkey to launch it. now, whenever you press the hotkey, a list of your passwords will show up, which you may type to filter. when you press return, the password you selected will be automatically typed into whatever you have highlighted, whether it's a password field in a browser, or vim. the neat thing is that the password never touches your clipboard since it's typed directly by either wtype or xdotool. the workflow really only takes a second or two once you have it setup, and feels very nice, imo!

mahathu 4y ago

It would be nice if a password manager could take care of detecting a page reload/change and auto fill the rest of the form, but I guess the risk of skipping through pages without any user interaction is too large for users (including myself) to trust it. I think the problem rather lies in how difficult modern UI makes it to sign in sometimes ppppp,,,,,,,,,,,

cristoperb 4y ago

> The hard part of building a (good) password manager is ... correctly integrating it with every app and website that expects to take your passwords What's wrong with plain old copy-and-paste? (I know there are probably some security concerns under X11, but Keepass, for example, will automatically clear the clipboard after a few seconds at least.) I use Keepass and 1password.com, but I don't use any of their autofill features; I just copy a password when I need it and paste it to where I need it. I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager.

deleted 4y ago
[deleted]
jonwinstanley 4y ago
Copy and paste is fine, plus most usernames are your email, which should auto complete
forty 4y ago
The issue with copy pasting password is phishing, which for most real life users is a much bigger risk than most other risks
deleted 4y ago
[deleted]
rollcat 4y ago
> What's wrong with plain old copy-and-paste? Context awareness. I currently have 429 items in my PM (it happens to be 1Password, specifically because it's extremely good at figuring this crap out). I almost never have to search for anything; even if I do, I can easily update the entry, so that it understands the context, in which a given credential can be valid; e.g. I can use my Blizzard login both on "https://battle.net https://battle.net", and in "app://sc2" (StarCraft 2). If I have a main+alt account, it will allow me to choose from the two, not 400+. It's the same as with using contactless payments with a smartwatch, it saves you 10 seconds here, a minute there - and over the course of your day, day after day - it starts adding up. > I think a user-friendly, secure, and reliable sync is the much more difficult part of implementing a good password manager. CRDTs solve this problem quite generally. I've never tried actually implementing sync from scratch in a desktop/mobile app, but the theory behind CRDTs is quite easy to grasp and makes a lot of sense. I'd say it's quite a bit harder to sync plain, old files, because the only metadata you have available is things like names, access/modification times, etc and they tend to be huge binary blobs, like photos or music, so the problem of automatic conflict resolution gets quite interesting. BTW look up Apple's CloudKit. I've done a "let's pretend we're on a 1990s Internet" challenge[1] a while ago, and it's amazing how reliably everything syncs, even if the devices are online for maybe 1% of the day. [1]: https://www.rollc.at/tags/challenge/ https://www.rollc.at/tags/challenge/

deleted 4y ago

[deleted]