3 ms·

Probably my biggest tech hill-i'll-die-on is: Password management involving a 3rd party is dumb and should never ever have been a thing. Before two parties had

by jrm4 5mo ago

Probably my biggest tech hill-i'll-die-on is: Password management involving a 3rd party is dumb and should never ever have been a thing. Before two parties had the secret (or something related to it) and now three parties have it and that's objectively worse -- even taking into account "the lazy user" or whatever. I know we're past that in a lot of places for a lot of people, but nope, my dad and his printed out sheet of password next to his desk is still beating every company out there.

baal80spam 5mo ago
KeePass is a great middle-ground, which I've been using for the last decade (at least). Storing the vault is on you, it just makes it easy to keep stuff organised.
- muppetman 5mo ago
  I did this for years too until mobile devices became popular. I have ~4 mobile phones for various things (yes this isn't normal) and ~4 different computers/laptops I use. Trying to keep a Keypass in sync between them is a nightmare. A proper password manager (Bitwarden or other) removes all that hassle. I have fingerprint unlock on the the mobiles that support fingerprint, face unlock on the devices that support that etc. I have browser addons to make password entry quick and easy while remaining secure. Once I moved to a password manager I realised how clunky and poor dragging a Keypass vault around was.
  - baal80spam 5mo ago
    Fair enough. I don't use it on mobile (I try to do the fewest things possible on mobile so I manage without a password manager).
- mbirth 5mo ago
  This! I’m using Strongbox on macOS and iOS and it’s just sooo good. It integrates with Apple’s AutoFill API and feels native - just like Apple’s Passwords app. But all the entries are in a KeePass database which I can sync via SyncThing, iCloud, Dropbox, whatever. And if the application should fail, I can use any other KeePass-compatible app or KeePass itself to get to my secrets.
SV_BubbleTime 5mo ago
Are you aware that the goal of these password managers is that they do not ever have your decrypted vault?
- jrm4 5mo ago
  I am. I'm also aware that *they don't always meet that goal". That's why I said "something related to it." As mullvad and others correctly note, however -- they can't leak something they never had in the first place. Third parties make for juicy targets.
muppetman 5mo ago
But it's not that though. They're hosting an encrypted version that they don't have the keys for. They are doing the backend sync for you, and writing the clients that YOU run, that sync yuur passwords everywhere. To suggest they have a copy of your passwords is to misunderstand what they're doing. It's the same as saying you host your Keypass on Dropbox so now Dropbox have a copy of your passwords/secrets. The value they are providing is seamless sync between a huge range of platforms/devices and making it as frictionless as possible to entry your password when you need to (biometrics to unlock the vault, browser addons to seemlessly enter the passwords etc) Your Dad has a single point of failure for all his accounts. That's not a win.
- jrm4 5mo ago
  All of you keep missing the "something related to it." They have something that could end up being a juicy point-of-failure that does not need to exist.
jasode 5mo ago
>3rd party is dumb and should never ever have been a thing. Before two parties had the secret (or something related to it) and now three parties have it and that's objectively worse There seems to be a misunderstanding of how typical cloud password vaults work. The 3rd parties like Bitwarden, 1Password, Apple iCloud Keychain, etc don't have access to the users' passwords. The scheme is based on Zero-Knowledge End-2-End-Encryption. The 3rd-party cloud is just a mechanism to store an encrypted blob and sync them to various devices. The client devices (users' desktop, users' smartphone) are the only ones that can decrypt the passwords. There are still only 2 parties with knowledge of the actual passwords. In contrast, the type of 3rd parties that do have knowledge/access to unencrypted plain text passwords would be Amazon storing users' wi-fi passwords, and Plaid storing users' bank account credentials & passwords. Gmail and MS Outlook.com would also be a 3rd party having a copy of users' passwords when they act as web clients to fetch email from other IMAP servers. >, my dad and his printed out sheet of password next to his desk is still beating every company out there. That doesn't work for users when they're not sitting at their desk and need passwords. Printing out a hardcopy sheet of passwords and carrying it the wallet or purse is a massive security risk.
- jrm4 5mo ago
  I absolutely understand how it works, which is why I said something like it. You still have an extra party involved; and you can't fully guarantee that Apple et al is doing things perfectly, and again, in this scenario you've created a 3rd very juicy target.
xigoi 5mo ago
> my dad and his printed out sheet of password next to his desk is still beating every company out there. Until your house gets flooded or burns down or you hire a really curious janitor.

by jrm4 5mo ago

baal80spam 5mo ago

KeePass is a great middle-ground, which I've been using for the last decade (at least). Storing the vault is on you, it just makes it easy to keep stuff organised.

muppetman 5mo ago
I did this for years too until mobile devices became popular. I have ~4 mobile phones for various things (yes this isn't normal) and ~4 different computers/laptops I use. Trying to keep a Keypass in sync between them is a nightmare. A proper password manager (Bitwarden or other) removes all that hassle. I have fingerprint unlock on the the mobiles that support fingerprint, face unlock on the devices that support that etc. I have browser addons to make password entry quick and easy while remaining secure. Once I moved to a password manager I realised how clunky and poor dragging a Keypass vault around was.
- baal80spam 5mo ago
  Fair enough. I don't use it on mobile (I try to do the fewest things possible on mobile so I manage without a password manager).
mbirth 5mo ago
This! I’m using Strongbox on macOS and iOS and it’s just sooo good. It integrates with Apple’s AutoFill API and feels native - just like Apple’s Passwords app. But all the entries are in a KeePass database which I can sync via SyncThing, iCloud, Dropbox, whatever. And if the application should fail, I can use any other KeePass-compatible app or KeePass itself to get to my secrets.

SV_BubbleTime 5mo ago

Are you aware that the goal of these password managers is that they do not ever have your decrypted vault?

jrm4 5mo ago
I am. I'm also aware that *they don't always meet that goal". That's why I said "something related to it." As mullvad and others correctly note, however -- they can't leak something they never had in the first place. Third parties make for juicy targets.

muppetman 5mo ago

But it's not that though. They're hosting an encrypted version that they don't have the keys for. They are doing the backend sync for you, and writing the clients that YOU run, that sync yuur passwords everywhere. To suggest they have a copy of your passwords is to misunderstand what they're doing. It's the same as saying you host your Keypass on Dropbox so now Dropbox have a copy of your passwords/secrets. The value they are providing is seamless sync between a huge range of platforms/devices and making it as frictionless as possible to entry your password when you need to (biometrics to unlock the vault, browser addons to seemlessly enter the passwords etc) Your Dad has a single point of failure for all his accounts. That's not a win.

jrm4 5mo ago
All of you keep missing the "something related to it." They have something that could end up being a juicy point-of-failure that does not need to exist.

jasode 5mo ago

>3rd party is dumb and should never ever have been a thing. Before two parties had the secret (or something related to it) and now three parties have it and that's objectively worse There seems to be a misunderstanding of how typical cloud password vaults work. The 3rd parties like Bitwarden, 1Password, Apple iCloud Keychain, etc don't have access to the users' passwords. The scheme is based on Zero-Knowledge End-2-End-Encryption. The 3rd-party cloud is just a mechanism to store an encrypted blob and sync them to various devices. The client devices (users' desktop, users' smartphone) are the only ones that can decrypt the passwords. There are still only 2 parties with knowledge of the actual passwords. In contrast, the type of 3rd parties that do have knowledge/access to unencrypted plain text passwords would be Amazon storing users' wi-fi passwords, and Plaid storing users' bank account credentials & passwords. Gmail and MS Outlook.com would also be a 3rd party having a copy of users' passwords when they act as web clients to fetch email from other IMAP servers. >, my dad and his printed out sheet of password next to his desk is still beating every company out there. That doesn't work for users when they're not sitting at their desk and need passwords. Printing out a hardcopy sheet of passwords and carrying it the wallet or purse is a massive security risk.

jrm4 5mo ago
I absolutely understand how it works, which is why I said something like it. You still have an extra party involved; and you can't fully guarantee that Apple et al is doing things perfectly, and again, in this scenario you've created a 3rd very juicy target.

xigoi 5mo ago

> my dad and his printed out sheet of password next to his desk is still beating every company out there. Until your house gets flooded or burns down or you hire a really curious janitor.