4 ms·

I've repeated over and over that password manager services are a horrible idea. Trusting a single service with all your passwords is worse than using the same p

I've repeated over and over that password manager services are a horrible idea. Trusting a single service with all your passwords is worse than using the same password for all services (of the same sensitivity level) IMO. The ideal solution is to come up with a secret heuristic to come up with different passwords for different services. I kept getting downvoted for this. Well, IMO, these people deserved to be hacked. I've never been hacked, never been locked out of any accounts. I'm getting tired of being proven right about everything over and over after being downvoted. It's a very common pattern for me.

gblargg 2y ago
What if you used a password service, but modified the password it puts in manually (and didn't let it update when you log in)? Would an attacker try variations, or just move on when your password manager-provided login doesn't work?
- jongjong 2y ago
  This would probably help a little bit in terms of security but you would still depend fully on your password manager for access to various services. Personally, I don't like the dependency aspect of password managers. I hate having to log into my password manager first before I can log into the service... And I don't like having to adhere to the whims of the password manager about things like changing my password every 6 months or using certain characters... It's really none of their business to determine what level of security is appropriate for me when trying to access my Instagram account which I barely care about anyway. I'm not some billionaire with teams of hackers trying to crack into my account 24/7. I hate it when I can't use certain passwords because the password manager thinks it should contain certain characters which I simply won't remember. I hate when trying to log into LastPass with my master password and I can't remember my password and have to try like 10 permutations to find the one in the format that it forced me to use last time that it forced me to change my password. I hate getting locked out of LastPass and having to go through its 'Forgot my password' flow only to find out that the password for my email account which receives the email password reset link is also controlled by LastPass... And it's only by the grace of god that I had not trusted LastPass to generate my email password for me and I was able to guess it and didn't end up fully locked out of all my services which I need for my work. That last experience was so scary, I actually wrote down my LastPass master password on a piece of paper and put it in my desk drawers so that I would not forget it. I know this is insecure but that sort of risk profile is aligned with my current non-billionaire status. Somehow, I don't think North Korea is going to send spies to my house to peak into my desk drawers to break into my work accounts...
  - commandersaki 2y ago
    Sounds like you don't understand how a password manager works and what it is trying to solve. Also how is remembering a master password any different to remembering a secret heuristic.
    - Rury 2y ago
      A master password (e.g. to access a password manager) needs to be both remembered and stored somewhere (ie the password manager, not your brain). A secret heuristic doesn't and so is more secure by simply not also being stored somewhere outside your brain.
      - commandersaki 2y ago
        Depends on the implementation. For example with 1Password it is not stored anywhere unencrypted, it is derived with a slow password hash and mixed with a secret key (this part is stored) to unlock your vaults. You can't access your vault without both.
        Rury 2y ago
        You asked what the difference was. Simply put, you can't hack what does not exist. LastPass also stores passwords encrypted and was hacked. In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic.
        commandersaki 2y ago
        LastPass didn't properly implement E2EE and because they used a weak password hash which affected low entropy passwords. > In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic. When I say 1P stores your master password encrypted, it usually does it as an item in the vault. You can easily remove it from the vault and therefore doesn't store it anymore, and you can have the same security as your secret heuristic. Storing it in your vault is of negligible concern.
9x39 2y ago
>The ideal solution is to come up with a secret heuristic to come up with different passwords for different services. How long does it take you to enter several keys of 16+ length for a few sites you might to access? A password manager can autofill, retrieve and input keys, provide an OTP in a few seconds. Where would you store your emergency codes and other secret-like artifacts? It just seems impractical for a person, let alone edge cases like sharing, or usability concerns like working with secrets frequently throughout the day. >I've never been hacked, never been locked out of any accounts. Due to the strength of your system, general digital hygiene, or simple odds? If we're getting really contrived, how do you maintain confidence your heuristic can't be guessed from X plaintexts obtained from breached sites (highly common)? That's kind of like rolling your crypto, isn't it? -- doing it correctly is beyond almost all of us.
commandersaki 2y ago
I feel like anyone with a visceral reaction to password managers that sync/store on cloud storage do not really understand E2EE. LastPass is really the only exception that didn't implement it properly.

gblargg 2y ago

What if you used a password service, but modified the password it puts in manually (and didn't let it update when you log in)? Would an attacker try variations, or just move on when your password manager-provided login doesn't work?

jongjong 2y ago
This would probably help a little bit in terms of security but you would still depend fully on your password manager for access to various services. Personally, I don't like the dependency aspect of password managers. I hate having to log into my password manager first before I can log into the service... And I don't like having to adhere to the whims of the password manager about things like changing my password every 6 months or using certain characters... It's really none of their business to determine what level of security is appropriate for me when trying to access my Instagram account which I barely care about anyway. I'm not some billionaire with teams of hackers trying to crack into my account 24/7. I hate it when I can't use certain passwords because the password manager thinks it should contain certain characters which I simply won't remember. I hate when trying to log into LastPass with my master password and I can't remember my password and have to try like 10 permutations to find the one in the format that it forced me to use last time that it forced me to change my password. I hate getting locked out of LastPass and having to go through its 'Forgot my password' flow only to find out that the password for my email account which receives the email password reset link is also controlled by LastPass... And it's only by the grace of god that I had not trusted LastPass to generate my email password for me and I was able to guess it and didn't end up fully locked out of all my services which I need for my work. That last experience was so scary, I actually wrote down my LastPass master password on a piece of paper and put it in my desk drawers so that I would not forget it. I know this is insecure but that sort of risk profile is aligned with my current non-billionaire status. Somehow, I don't think North Korea is going to send spies to my house to peak into my desk drawers to break into my work accounts...
- commandersaki 2y ago
  Sounds like you don't understand how a password manager works and what it is trying to solve. Also how is remembering a master password any different to remembering a secret heuristic.
  - Rury 2y ago
    A master password (e.g. to access a password manager) needs to be both remembered and stored somewhere (ie the password manager, not your brain). A secret heuristic doesn't and so is more secure by simply not also being stored somewhere outside your brain.
    - commandersaki 2y ago
      Depends on the implementation. For example with 1Password it is not stored anywhere unencrypted, it is derived with a slow password hash and mixed with a secret key (this part is stored) to unlock your vaults. You can't access your vault without both.
      - Rury 2y ago
        You asked what the difference was. Simply put, you can't hack what does not exist. LastPass also stores passwords encrypted and was hacked. In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic.
        commandersaki 2y ago
        LastPass didn't properly implement E2EE and because they used a weak password hash which affected low entropy passwords. > In other words, no matter of how well 1Password handles the storing of your master password (encrypted/decentralized or what not), the fact that it does is inherently less secure than something that doesn't store anything at all, such as the case with a secret heuristic. When I say 1P stores your master password encrypted, it usually does it as an item in the vault. You can easily remove it from the vault and therefore doesn't store it anymore, and you can have the same security as your secret heuristic. Storing it in your vault is of negligible concern.

9x39 2y ago

>The ideal solution is to come up with a secret heuristic to come up with different passwords for different services. How long does it take you to enter several keys of 16+ length for a few sites you might to access? A password manager can autofill, retrieve and input keys, provide an OTP in a few seconds. Where would you store your emergency codes and other secret-like artifacts? It just seems impractical for a person, let alone edge cases like sharing, or usability concerns like working with secrets frequently throughout the day. >I've never been hacked, never been locked out of any accounts. Due to the strength of your system, general digital hygiene, or simple odds? If we're getting really contrived, how do you maintain confidence your heuristic can't be guessed from X plaintexts obtained from breached sites (highly common)? That's kind of like rolling your crypto, isn't it? -- doing it correctly is beyond almost all of us.

commandersaki 2y ago

I feel like anyone with a visceral reaction to password managers that sync/store on cloud storage do not really understand E2EE. LastPass is really the only exception that didn't implement it properly.