3 ms·

Any "password manager" system from a service which disclaims responsibility for security or which can cancel the account is worse than useless. It's dangerous.

Any "password manager" system from a service which disclaims responsibility for security or which can cancel the account is worse than useless. It's dangerous. A password manager run by a bank, with the bank standing behind it, might be worth something.

skybrian 2y ago
Yes, a password manager is a single point of failure, but I don’t see it as particularly dangerous, provided you have more than one. For any locked door, you need more than one key and they should be independent. If you have independence, they serve as backups for each other.
- NoMoreNicksLeft 2y ago
  How is a password manager a single point of failure? Mine syncs between multiple devices. I've had the same primary password for a decade now, and I've already forgotten it... I can't reproduce it without putting fingers to keyboard. It's the one human-chosen password that I ever made strong... 30-some characters, pretty fucking random. My wife knows it too. But now you'll tell me that Google is more trustworthy than her.
  - skybrian 2y ago
    It depends on the password manager you use. If you’re using Google or Apple’s password manager, you’re probably okay if you lose a device, but the one risk you can’t fix without having another password manager is if they cancel your account. If you use both of them, though, that covers it. Passkey syncing across password managers isn’t implemented yet, so it means manually adding an account in both places if you go that route. Hopefully that will be fixed by a new standard.
    - NoMoreNicksLeft 2y ago
      > It depends on the password manager you use. If you’re using Google or Apple’s password manager, Are those even really password managers? I used to use 1Password, but got tired of only being able to sync through iCloud. About a year in, I switched to Enpass since it did webdav. Biggest gripe is that there is no native Xbox app with it, make it a pain to track some of the kid's game passwords.
      - skybrian 2y ago
        They store passwords, and now also passkeys. How are they not password managers? They’re probably the most-used password managers, since people use them without necessarily realizing that they’re using a password manager. The thing about passkeys is that they make everyone use a password manager whether they want to or not. It’s a protocol that requires a password manager - there is no manual way to do it.
        NoMoreNicksLeft 2y ago
        > They store passwords, But if they hide the "management" part from you, they're just password storage. In someone else's control.
- TeMPOraL 2y ago
  > For any locked door, you need more than one key and they should be independent. If you have independence, they serve as backups for each other. For any locked door, you need a key for day-to-day use; beyond that, you need to know a way to contact a locksmith or how to use a crowbar yourself, and have a way to eventually prove you're authorized to access what's behind those doors. All those real-world analogies in crypto tend to miss one critical thing: in real world, things break, and people make mistakes, so for any security system, there exist ways to recover from failure or mistakes, and ways to recover from failures to recover, and so on. Yes, this means you may spend a couple hours talking to the police afterwards, but you won't be forced to camp outside of your apartment on a cold winter night, because you've left your keys at work.
  - skybrian 2y ago
    There are real-world situations, particularly in remote areas, where you can't rely on someone else to bail you out if you screw up. But they're not typical, and yeah, the analogy breaks down if you push it too far. I think the advice of having multiple independent ways to log into an account is still good. Unfortunately, Google doesn't provide backups for the threat model of "Google locks you out due to an automatic policy decision" so you have to figure it out on your own. Similarly for other services.
arccy 2y ago
banks aren't particularly well known for tech security, they rely more on law to ensure nothing goes wrong...
- TeMPOraL 2y ago
  Because that's an important part of security in the real world. Crypto is cool and all, but also creates plenty of footguns and is overall annoying to deal with. Legal solutions plug into the wider system of how adults deal with the world - courts, insurance, and yes, men with guns. It's not as solid as purely mathematical solutions, but it is flexible in ways that matter to real people in real-life situations. Anyway, GP's point was more that banks are known to be subject to regulation wrt. accounts, they can't just shut you out and pretend you were never there (in contrast to e.g. Google which can, and does). They're not allowed to be too big to care.
  - Animats 2y ago
    > banks are known to be subject to regulation wrt. accounts, they can't just shut you out and pretend you were never there (in contrast to e.g. Google which can, and does) Exactly. Banks are required to have what's called fiduciary responsibility. They have legal obligations to fix their mistakes. They can't provide their services "as is, with no warranty". A friend who runs a bank branch for a major bank says that about a quarter of her day is spent dealing with people who had some kind of error or scam problem. All routine transactions are automated, and there are only about two teller windows in a branch now. What bank branch staff actually do is sell loans, and customer support. That customer support is not optional. There are bank regulators who will punish banks if they don't do it.
  - arccy 2y ago
    that's fine for a bank now, because they more or less control have full control over the thing you're trusting them with (your money). password managers are keys to all sorts of third party systems, in a sense they're more like safe deposit boxes, and you don't hear of many banks offering them these days, and they cap their liability quite a bit. Also, a financial transaction is relatively easy to rewind by the bank, everything else your passwords give access to, not so much. So sure, you might not be locked out of your passwords, but you run a much higher risk of someone else also gaining access to them.
jopsen 2y ago
Yeah, I've been very disappointed that bitwarden haven't implemented passkey and OTP storage using a KMS. Sure, I'd have to be online then to use a passkey stored in bitwarden. But it wouldn't something that could be stolen off bitwarden. And I could reasonably protect bitwarden with a physical passkey.
- cyberax 2y ago
  > But it wouldn't something that could be stolen off bitwarden. Hah. I'm not the only one thinking about ways to use AWS KMS for it! But the attacker can still impersonate you and ask the HSM service to sign data for them. Ideally, I really want a system with a proof of physical interaction. The existing HSM APIs are not well-suited for that. But if you can trust the software that runs on the service that provides the HSM access, then this can be done with minor caveats on macOS.
  - jopsen 2y ago
    If the passkeys were stored in some cloud KMS, then yes someone could still impersonate me. Ideally, but they wouldn't be able to steal the keys, it would only be temporary. That said, yes, we'd have to trust the server side software that grants access to the keys in KMS. In the end this level of indirection would sort of defeat the point. It wouldn't really be better than OIDC using a provider where you have a passkey. Incidentally, I have 2FA on important accounts, and prefer to use Google/GitHub/Facebook for sign-in on other sites whenever possible.

skybrian 2y ago

Yes, a password manager is a single point of failure, but I don’t see it as particularly dangerous, provided you have more than one. For any locked door, you need more than one key and they should be independent. If you have independence, they serve as backups for each other.

NoMoreNicksLeft 2y ago
How is a password manager a single point of failure? Mine syncs between multiple devices. I've had the same primary password for a decade now, and I've already forgotten it... I can't reproduce it without putting fingers to keyboard. It's the one human-chosen password that I ever made strong... 30-some characters, pretty fucking random. My wife knows it too. But now you'll tell me that Google is more trustworthy than her.
- skybrian 2y ago
  It depends on the password manager you use. If you’re using Google or Apple’s password manager, you’re probably okay if you lose a device, but the one risk you can’t fix without having another password manager is if they cancel your account. If you use both of them, though, that covers it. Passkey syncing across password managers isn’t implemented yet, so it means manually adding an account in both places if you go that route. Hopefully that will be fixed by a new standard.
  - NoMoreNicksLeft 2y ago
    > It depends on the password manager you use. If you’re using Google or Apple’s password manager, Are those even really password managers? I used to use 1Password, but got tired of only being able to sync through iCloud. About a year in, I switched to Enpass since it did webdav. Biggest gripe is that there is no native Xbox app with it, make it a pain to track some of the kid's game passwords.
    - skybrian 2y ago
      They store passwords, and now also passkeys. How are they not password managers? They’re probably the most-used password managers, since people use them without necessarily realizing that they’re using a password manager. The thing about passkeys is that they make everyone use a password manager whether they want to or not. It’s a protocol that requires a password manager - there is no manual way to do it.
      - NoMoreNicksLeft 2y ago
        > They store passwords, But if they hide the "management" part from you, they're just password storage. In someone else's control.
TeMPOraL 2y ago
> For any locked door, you need more than one key and they should be independent. If you have independence, they serve as backups for each other. For any locked door, you need a key for day-to-day use; beyond that, you need to know a way to contact a locksmith or how to use a crowbar yourself, and have a way to eventually prove you're authorized to access what's behind those doors. All those real-world analogies in crypto tend to miss one critical thing: in real world, things break, and people make mistakes, so for any security system, there exist ways to recover from failure or mistakes, and ways to recover from failures to recover, and so on. Yes, this means you may spend a couple hours talking to the police afterwards, but you won't be forced to camp outside of your apartment on a cold winter night, because you've left your keys at work.
- skybrian 2y ago
  There are real-world situations, particularly in remote areas, where you can't rely on someone else to bail you out if you screw up. But they're not typical, and yeah, the analogy breaks down if you push it too far. I think the advice of having multiple independent ways to log into an account is still good. Unfortunately, Google doesn't provide backups for the threat model of "Google locks you out due to an automatic policy decision" so you have to figure it out on your own. Similarly for other services.

arccy 2y ago

banks aren't particularly well known for tech security, they rely more on law to ensure nothing goes wrong...

TeMPOraL 2y ago
Because that's an important part of security in the real world. Crypto is cool and all, but also creates plenty of footguns and is overall annoying to deal with. Legal solutions plug into the wider system of how adults deal with the world - courts, insurance, and yes, men with guns. It's not as solid as purely mathematical solutions, but it is flexible in ways that matter to real people in real-life situations. Anyway, GP's point was more that banks are known to be subject to regulation wrt. accounts, they can't just shut you out and pretend you were never there (in contrast to e.g. Google which can, and does). They're not allowed to be too big to care.
- Animats 2y ago
  > banks are known to be subject to regulation wrt. accounts, they can't just shut you out and pretend you were never there (in contrast to e.g. Google which can, and does) Exactly. Banks are required to have what's called fiduciary responsibility. They have legal obligations to fix their mistakes. They can't provide their services "as is, with no warranty". A friend who runs a bank branch for a major bank says that about a quarter of her day is spent dealing with people who had some kind of error or scam problem. All routine transactions are automated, and there are only about two teller windows in a branch now. What bank branch staff actually do is sell loans, and customer support. That customer support is not optional. There are bank regulators who will punish banks if they don't do it.
- arccy 2y ago
  that's fine for a bank now, because they more or less control have full control over the thing you're trusting them with (your money). password managers are keys to all sorts of third party systems, in a sense they're more like safe deposit boxes, and you don't hear of many banks offering them these days, and they cap their liability quite a bit. Also, a financial transaction is relatively easy to rewind by the bank, everything else your passwords give access to, not so much. So sure, you might not be locked out of your passwords, but you run a much higher risk of someone else also gaining access to them.

jopsen 2y ago

Yeah, I've been very disappointed that bitwarden haven't implemented passkey and OTP storage using a KMS. Sure, I'd have to be online then to use a passkey stored in bitwarden. But it wouldn't something that could be stolen off bitwarden. And I could reasonably protect bitwarden with a physical passkey.

cyberax 2y ago
> But it wouldn't something that could be stolen off bitwarden. Hah. I'm not the only one thinking about ways to use AWS KMS for it! But the attacker can still impersonate you and ask the HSM service to sign data for them. Ideally, I really want a system with a proof of physical interaction. The existing HSM APIs are not well-suited for that. But if you can trust the software that runs on the service that provides the HSM access, then this can be done with minor caveats on macOS.
- jopsen 2y ago
  If the passkeys were stored in some cloud KMS, then yes someone could still impersonate me. Ideally, but they wouldn't be able to steal the keys, it would only be temporary. That said, yes, we'd have to trust the server side software that grants access to the keys in KMS. In the end this level of indirection would sort of defeat the point. It wouldn't really be better than OIDC using a provider where you have a passkey. Incidentally, I have 2FA on important accounts, and prefer to use Google/GitHub/Facebook for sign-in on other sites whenever possible.