3 ms·

OpenID actually solved this problem by letting you use your own domain. Much like email it was possible to have this delegate to a 3rd party provider while reta

OpenID actually solved this problem by letting you use your own domain. Much like email it was possible to have this delegate to a 3rd party provider while retaining full control to seamlessly switch providors. Unfortunately OpenID never saw widespread adoption, and the OAuth based ID we're left with doesn't allow this. But yes, in 2023 you probably shouldn't use 3rd party authentication. You're much better off combining email/password login with a password manager, which effectively allows you push authentication on a 3rd party while retaining full control.

sigmoid10 4y ago
...until someone breaks into LastPass and steals all vaults and you have to hope that your vault used the newer iteration settings. And those are just the cases we hear about because the attackers were careless. Cloud based password managers are simply an unimaginably attractive target for all kinds of threat actors, from individuals to groups all the way to nation states. I'd not be surprised if all the major ones already have backdoors installed - either on purpose with a gag order or even without the company's knowledge. Ironically, a simple text file on a well encrypted USB is probably one of the more secure ways to do this nowadays.
- hn_go_brrrrr 4y ago
  You should use a local-storage password manager, like KeePass.
  - stinkytaco 4y ago
    I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time. I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.
    - Brian_K_White 4y ago
      Same. keepass with the db on a cloud drive. keepass clients on both laptop and phone access the same cloud copy, and also each keep a local copy. I intentionally don't let the clients integrate with the browser. I let the browser itself cache the unimportant stuff for convenience, and anything important I always paste from the password manager and have to get a code from the totp app also anyway. I don't think anyone should use a fully 3rd party full featured password manager like lastpass or onepass. I would say it is NOT better that they use that vs nothing. 'anything is better than nothing' is not true here. Some things are better than nothing, and some are not.
      - theandrewbailey 4y ago
        KeePassXC supports TOTPs out of the box and its browser integrations fill TOTP fields just like they do with password fields. I love that the browser integrations check logins by domain, and shows a popup when it finds one. Manually copying and pasting logins is susceptible to phished domains, even the lookalikes with visually similar/identical Unicode characters.
        Brian_K_White 4y ago
        Maybe I will revisit this policy. Thanks.
    - pieter_mj 4y ago
      Also, you could add an extra key (can be any file, so you would need passphrase+key) and keep only the key offline on each device.
  - the_snooze 4y ago
    Don't let perfect be the enemy of the good. Many people won't use a password manager at all if it has no cross-device syncing, and that almost always means a cloud implementation. Sure, it's less secure than a pure local-only password manager, but it's way more secure than not using a password manager at all.
  - sigmoid10 4y ago
    That only works if you stick to a single device. If you use many devices or frequently switch between different devices, you'll want portability.
- Liquix 4y ago
  Bitwarden (and the Rust clone Vaultwarden) are both 100% open source and self-hostable. Vaultwarden runs great on an old raspberry pi or any low power SBC. All of the convenience of Bitwarden clients/extensions/integrations but the same tiny attack surface (encrypted db on one local machine) as keepassXC or a text file.
  - sigmoid10 4y ago
    If you know what you're doing, that is definitely an option. But self-hosting is not something I would recommend to the general public. I wouldn't even recommend it to the average person in IT to be honest. If the people at LastPass already manage to screw up the configuration so many times (and they really ought to know better than 99.99% of the population by now), then you can guess how safe it would be íf the average Joe sets something like that up.
- unethical_ban 4y ago
  KeePass on Google drive with local backup.
JohnFen 4y ago
> But yes, in 2023 you probably shouldn't use 3rd party authentication. You misspelled "definitely" as "probably" here.
gus_massa 4y ago
> ... by letting you use your own domain. Much like email ... It's getting harder and harder to send email from your domain without being send to spam, bouncing, or the server just discarding your email without notice.
- Godel_unicode 4y ago
  Sending it from your own domain isn’t hard, it’s self-hosting that domain which is hard. If you pay Microsoft or Google using your own domain works well.
- EVa5I7bHFq9mnYK 4y ago
  I use smtp2go for sending, it's easy to setup your domain with them, and they are free for low volume (1000 emails/month) senders. Emails never get rejected, guess they know their game.
  - justinclift 4y ago
    Co-incidentally, we (sqlitebrowser.org) switched most of our stuff to them over a year ago, and yeah they've been hassle free. Currently using their lowest paid tier US$10/month, as that's 10k emails a month which is far more than we send. At least at this stage. ;) Wish they'd occasionally look over the PR's submitted to their GitHub repo's though. ;) eg: https://github.com/smtp2go-oss/smtp2go-go https://github.com/smtp2go-oss/smtp2go-go
- nicoburns 4y ago
  It is, but OpenID didn't have this problem because requests were always initiated by the other party.

sigmoid10 4y ago

...until someone breaks into LastPass and steals all vaults and you have to hope that your vault used the newer iteration settings. And those are just the cases we hear about because the attackers were careless. Cloud based password managers are simply an unimaginably attractive target for all kinds of threat actors, from individuals to groups all the way to nation states. I'd not be surprised if all the major ones already have backdoors installed - either on purpose with a gag order or even without the company's knowledge. Ironically, a simple text file on a well encrypted USB is probably one of the more secure ways to do this nowadays.

hn_go_brrrrr 4y ago
You should use a local-storage password manager, like KeePass.
- stinkytaco 4y ago
  I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time. I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.
  - Brian_K_White 4y ago
    Same. keepass with the db on a cloud drive. keepass clients on both laptop and phone access the same cloud copy, and also each keep a local copy. I intentionally don't let the clients integrate with the browser. I let the browser itself cache the unimportant stuff for convenience, and anything important I always paste from the password manager and have to get a code from the totp app also anyway. I don't think anyone should use a fully 3rd party full featured password manager like lastpass or onepass. I would say it is NOT better that they use that vs nothing. 'anything is better than nothing' is not true here. Some things are better than nothing, and some are not.
    - theandrewbailey 4y ago
      KeePassXC supports TOTPs out of the box and its browser integrations fill TOTP fields just like they do with password fields. I love that the browser integrations check logins by domain, and shows a popup when it finds one. Manually copying and pasting logins is susceptible to phished domains, even the lookalikes with visually similar/identical Unicode characters.
      - Brian_K_White 4y ago
        Maybe I will revisit this policy. Thanks.
  - pieter_mj 4y ago
    Also, you could add an extra key (can be any file, so you would need passphrase+key) and keep only the key offline on each device.
- the_snooze 4y ago
  Don't let perfect be the enemy of the good. Many people won't use a password manager at all if it has no cross-device syncing, and that almost always means a cloud implementation. Sure, it's less secure than a pure local-only password manager, but it's way more secure than not using a password manager at all.
- sigmoid10 4y ago
  That only works if you stick to a single device. If you use many devices or frequently switch between different devices, you'll want portability.
Liquix 4y ago
Bitwarden (and the Rust clone Vaultwarden) are both 100% open source and self-hostable. Vaultwarden runs great on an old raspberry pi or any low power SBC. All of the convenience of Bitwarden clients/extensions/integrations but the same tiny attack surface (encrypted db on one local machine) as keepassXC or a text file.
- sigmoid10 4y ago
  If you know what you're doing, that is definitely an option. But self-hosting is not something I would recommend to the general public. I wouldn't even recommend it to the average person in IT to be honest. If the people at LastPass already manage to screw up the configuration so many times (and they really ought to know better than 99.99% of the population by now), then you can guess how safe it would be íf the average Joe sets something like that up.
unethical_ban 4y ago
KeePass on Google drive with local backup.

JohnFen 4y ago

> But yes, in 2023 you probably shouldn't use 3rd party authentication. You misspelled "definitely" as "probably" here.

gus_massa 4y ago

> ... by letting you use your own domain. Much like email ... It's getting harder and harder to send email from your domain without being send to spam, bouncing, or the server just discarding your email without notice.

Godel_unicode 4y ago
Sending it from your own domain isn’t hard, it’s self-hosting that domain which is hard. If you pay Microsoft or Google using your own domain works well.
EVa5I7bHFq9mnYK 4y ago
I use smtp2go for sending, it's easy to setup your domain with them, and they are free for low volume (1000 emails/month) senders. Emails never get rejected, guess they know their game.
- justinclift 4y ago
  Co-incidentally, we (sqlitebrowser.org) switched most of our stuff to them over a year ago, and yeah they've been hassle free. Currently using their lowest paid tier US$10/month, as that's 10k emails a month which is far more than we send. At least at this stage. ;) Wish they'd occasionally look over the PR's submitted to their GitHub repo's though. ;) eg: https://github.com/smtp2go-oss/smtp2go-go https://github.com/smtp2go-oss/smtp2go-go
nicoburns 4y ago
It is, but OpenID didn't have this problem because requests were always initiated by the other party.