3 ms·

Until someone suggests to me otherwise, I'm going to keep saying the following: By default, third-party password managers are stupid. Before - two people had t

by jrm4 3y ago

Until someone suggests to me otherwise, I'm going to keep saying the following: By default, third-party password managers are stupid. Before - two people had the secret, now three of them do, one of whom is a juicy central target that has the secrets. I'm aware that this is an extreme oversimplification of e.g. hashes and whatnot, but it seems true enough for laypeople such that it's better advice than most, especially for individual and personal accounts.

Nexxxeh 3y ago
No, I think this is awful advice. It's not a case of 1st party or 3rd party for most users. Especially laypeople. It's a case of 3rd party or none. Most users are not going to piss around manually syncing KeePassXC or whatever. 3rd party makes it easy to use secure passwords. The alternative for laypeople is going back to what they do otherwise. Password re-use.
- lelandbatey 3y ago
  You don't have to manually sync, the phone app has a Dropbox/SyncThing/whatever integration so everything's synced automatically. On desktop, it's a file that you sync via Dropbox/SyncThing/whatever. Harder than a third party app, but if you're comfortable syncing files, then you can very comfortably use an offline password manager (I have for 10 years on my phone and the UX is basically the exact same as using my work appointed password manager).
  - Octabrain 3y ago
    I used to use a similar approach, in my case: KeepassXC + Google Drive. My problem though is that I got tired of the issues KeepassXC had when saving the database into the mounted Google Drive filesystem provided by Gnome (GVFS, from the top of my head). Basically, sometimes it failed, other times the database would be saved with a different name which was annoying, because then, when using Keepass on my phone or my other computer, I had to be searching for the most recent database file. After months of internal debate and research, I ended up migrating everything into Bitwarden. Despite the paranoid in me has days of "what the hell did you do!", everything has been great so far and it has simplified my workflow nicely.
- jrm4 3y ago
  "Makes it easy" Yup, and ALSO makes it easy to SCREW UP. That's the point. This paternalistic garbage helps no one. Right now, the smarter thing is to be like: "Look, passwords are hard. Security is hard, but individuals have to take responsibility" because entirely too many companies are bad at this. There's also another simple solution, but no company is yet good enough to do this. Provide indemnity.
  - Nexxxeh 3y ago
    Practical security is the balance of security against convenience. Being ignorant of convenience required and capability available of the target audience isn't going to help anyone. Don't let perfect be the enemy of good. A 3rd party password wallet from one of the majors is vastly more secure than someone's nan using the same password for everything. Which is the alternative in practice. You seem to think that normal people are going to learn IT security to a reasonable degree, and be personally responsible. Many people literally aren't capable of being what you want them to be. Yours is a beautiful dream that clashes strongly with observable reality.
    - jrm4 3y ago
      Observable reality today, right now, is trash cybersecurity everywhere. If people don't learn -- and maybe they won't, then, the only real solution is actual liability. These companies promise safety and don't deliver; time to sue or regulate or both. But we need to stop pretending that "third-party," in all its present crappiness, is an acceptable option, even if sometimes it's better than what people do on their own.
CJefferson 3y ago
What do you advise instead for non-technical people? No password manager sounds like an awful idea, who can memorize all their passwords? How can I keep passwords on 2 computers, an iPhone and iPad all in sync?
- christophilus 3y ago
  You can keep a physical password book. For someone to get it, they need to physically steal it. If you keep it at home in a fairly safe location, it seems fine to me. If someone breaks into my home, they’ve got it. But that’s not a threat model that scales, so it’s not a major concern to me.
  - jasode 3y ago
    >You can keep a physical password book. [...] If you keep it at home in a fairly safe location, But people are often away from home and want to log into websites and apps from their smartphone. A physical password book sitting at home is useless for that very common scenario. That "login from anywhere" is the typical motivation of gp's comment: "How can I keep passwords on 2 computers, an iPhone and iPad all in sync?"
    - jrm4 3y ago
      Right, and instead of companies promising safety they can't deliver, it would be better to just be honest about the fact that it is hard. And again, to take it a level further -- I would absolutely use a company's software under one, and only one condition -- indemnity/warranty. Any company that is willing to go "If you get breached, we will pay for the harm" can absolutely take my money.
- throw__away7391 3y ago
  I have a system known only to me for assigning passwords based on things like the color of the company's logo and the number of vowels in their name. I have a complex and unique password for every site, I don't have to "remember" them because I can recreate them on the fly. This works really well imo, the main hiccup is companies that force you to change your password every x days and don't let you reuse old passwords.

by jrm4 3y ago

Nexxxeh 3y ago

No, I think this is awful advice. It's not a case of 1st party or 3rd party for most users. Especially laypeople. It's a case of 3rd party or none. Most users are not going to piss around manually syncing KeePassXC or whatever. 3rd party makes it easy to use secure passwords. The alternative for laypeople is going back to what they do otherwise. Password re-use.

lelandbatey 3y ago
You don't have to manually sync, the phone app has a Dropbox/SyncThing/whatever integration so everything's synced automatically. On desktop, it's a file that you sync via Dropbox/SyncThing/whatever. Harder than a third party app, but if you're comfortable syncing files, then you can very comfortably use an offline password manager (I have for 10 years on my phone and the UX is basically the exact same as using my work appointed password manager).
- Octabrain 3y ago
  I used to use a similar approach, in my case: KeepassXC + Google Drive. My problem though is that I got tired of the issues KeepassXC had when saving the database into the mounted Google Drive filesystem provided by Gnome (GVFS, from the top of my head). Basically, sometimes it failed, other times the database would be saved with a different name which was annoying, because then, when using Keepass on my phone or my other computer, I had to be searching for the most recent database file. After months of internal debate and research, I ended up migrating everything into Bitwarden. Despite the paranoid in me has days of "what the hell did you do!", everything has been great so far and it has simplified my workflow nicely.
jrm4 3y ago
"Makes it easy" Yup, and ALSO makes it easy to SCREW UP. That's the point. This paternalistic garbage helps no one. Right now, the smarter thing is to be like: "Look, passwords are hard. Security is hard, but individuals have to take responsibility" because entirely too many companies are bad at this. There's also another simple solution, but no company is yet good enough to do this. Provide indemnity.
- Nexxxeh 3y ago
  Practical security is the balance of security against convenience. Being ignorant of convenience required and capability available of the target audience isn't going to help anyone. Don't let perfect be the enemy of good. A 3rd party password wallet from one of the majors is vastly more secure than someone's nan using the same password for everything. Which is the alternative in practice. You seem to think that normal people are going to learn IT security to a reasonable degree, and be personally responsible. Many people literally aren't capable of being what you want them to be. Yours is a beautiful dream that clashes strongly with observable reality.
  - jrm4 3y ago
    Observable reality today, right now, is trash cybersecurity everywhere. If people don't learn -- and maybe they won't, then, the only real solution is actual liability. These companies promise safety and don't deliver; time to sue or regulate or both. But we need to stop pretending that "third-party," in all its present crappiness, is an acceptable option, even if sometimes it's better than what people do on their own.

CJefferson 3y ago

What do you advise instead for non-technical people? No password manager sounds like an awful idea, who can memorize all their passwords? How can I keep passwords on 2 computers, an iPhone and iPad all in sync?

christophilus 3y ago
You can keep a physical password book. For someone to get it, they need to physically steal it. If you keep it at home in a fairly safe location, it seems fine to me. If someone breaks into my home, they’ve got it. But that’s not a threat model that scales, so it’s not a major concern to me.
- jasode 3y ago
  >You can keep a physical password book. [...] If you keep it at home in a fairly safe location, But people are often away from home and want to log into websites and apps from their smartphone. A physical password book sitting at home is useless for that very common scenario. That "login from anywhere" is the typical motivation of gp's comment: "How can I keep passwords on 2 computers, an iPhone and iPad all in sync?"
  - jrm4 3y ago
    Right, and instead of companies promising safety they can't deliver, it would be better to just be honest about the fact that it is hard. And again, to take it a level further -- I would absolutely use a company's software under one, and only one condition -- indemnity/warranty. Any company that is willing to go "If you get breached, we will pay for the harm" can absolutely take my money.
throw__away7391 3y ago
I have a system known only to me for assigning passwords based on things like the color of the company's logo and the number of vowels in their name. I have a complex and unique password for every site, I don't have to "remember" them because I can recreate them on the fly. This works really well imo, the main hiccup is companies that force you to change your password every x days and don't let you reuse old passwords.