5 ms·

If you think it's ok to be putting all your passwords on some random server owned by a random company then I don't know if you care about any other design flaws

• mhluongo 4y ago
  There's a version of this sort of password manager that is safe. Not saying Bitwarden is it, just that strong, well-implemented cryptography can get us there.
• ilyt 4y ago
  You can self host bitwarden, using either their implementation or open source vaultwarden
  • siwatanejo 4y ago
    Exactly, BitWarden is not as shit as others like LastPass or 1Password.
    • dmak 4y ago
      Have you seen 1Passwords security design? I am not an expert, but wanted to hear from someone is.
      • knocte 4y ago
        It is not opensource, therefore you cannot self-host it, therefore you depend on a thirdparty.
        • dmak 4y ago
          Can one depend on a third party if it's end-to-end encrypted?
          • knocte 4y ago
            If it's not opensource, you cannot know if the claim of it being end2end encrypted is actually true or not. The thirdparty can disable the encryption with the click of a button.
    • skrowl 4y ago
      BitWarden - The least shitty password manager!
      • siwatanejo 4y ago
        Exactly.
• amarshall 4y ago
  From https://infosec.exchange/@epixoip/109585049354200263 https://infosec.exchange/@epixoip/109585049354200263 (found spelunking from OP): > consider the fact that the threat model for a cloud-based password management solution should start with the vault being compromised. In fact, if password management is done correctly, I should be able to host my vault anywhere, even openly downloadable (open S3 bucket, unauthenticated HTTPS, etc.) without concern. I wouldn't do that, of course, but the point is the vault should be just that -- a vault, not a lockbox.
  • TillE 4y ago
    I keep making this same point in various HN threads. It should be trivially obvious to anyone who understands cryptography, but I guess lots of people really just don't. Pick a good password, pick good algorithms, and you should feel very comfortable about hosting an encrypted blob of data anywhere. Maybe you should worry a little if you're at risk of being specifically targeted by the NSA, but I doubt they've seriously broken any state-of-the-art crypto. At that point OS exploits and trojans are your real concern.
• kadoban 4y ago
  Even a fairly middling password manager implementation is better than just about any other strategy that anyone is likely to use. Especially because for the vast majority, the other strategy is going to be reusing the same password ~everywhere and if you're lucky the might use a special password for their bank or something.
  • Aeolun 4y ago
    I guess for most people online, writing all their passwords down in a notebook is more secure than using a password manager. It’s just less convenient.
    • goodoldneon 4y ago
      The notebook is still less secure because of phishing
    • Someone1234 4y ago
      And less resilient. If your notebook is destroyed (e.g. dog eats it, fire, water damage, et al) then all your passwords are gone. With most good password managers you can actually backup and store a copy of your vault data locally.
      • jdeibele 4y ago
        I installed BackBlaze years ago for my 88-year-old mother-in-law. She has a binder besides her computer with a sheet for each account, some with 7 or 8 passwords scratched out and replaced. I really should have her write out a few key passwords and put them in an envelope for me to keep.
        • kadoban 4y ago
          The only one you usually really need is your email password. You can typically reset everything else from that if you really had to.
    • kadoban 4y ago
• deleted 4y ago
  [deleted]