4 ms·

>For additional help with password security, we recommend tools like 1Password and LastPass. It's really too bad that they are recommending expensive, propriet

>For additional help with password security, we recommend tools like 1Password and LastPass. It's really too bad that they are recommending expensive, proprietary, commercial apps for this when free, open source alternatives like KeePass exist. If users are unconvinced on the value of a password vault, charging money for it certainly isn't going to encourage adoption.

Houshalter 13y ago
How secure is that? Couldn't they just as easily figure out your KeePass password (providing they know you are using it, and that reversing the KeePass hash isn't any more difficult than reversing the normal one.)
- dublinben 13y ago
  Who is they? How are they going to access your encrypted password vault?
  - Houshalter 13y ago
    See the comment I made above. I mean if a site like kickstarter has compromised your password even if it was from KeePass.
- euank 13y ago
  No, they can't. The websites allow anyone in the world to make a guess at a password. Keepass doesn't since it requires having the private database file which you store locally. The websites allow for a vulnerability in third party code to expose you. Keepass, even if it has a vulnerability, can't be exploited remotely since the database is stored only locally. The websites are in the browser and encourage browser extensions. Browsers suck for security... that's a massive attack surface and they are, by their nature, integrated with the network. Keepass is a dedicated application with a tiny surface that barely communicates with the internet at all and has no need to. A whole class of attacks miss it. Keepass is leaps and bounds more secure.
  - Houshalter 13y ago
    Yes it is secure in that area, I mean for the specific attack this post is about where a hash of your password is hacked. All keepass would do is make your password the product of two hashes instead of one. I wasn't sure if that was that significantly more secure (if it was why aren't websites doing it automatically?) Of course that implies the attacker knows you used KeePass, security through obscurity and being in the minority should protect you.
    - mpeg 13y ago
      No, the point is not to make your password more secure in case of a data breach like this (although it can, since you can store a password that is very long and composed of random characters) The idea is that even if your password for kickstarter gets compromised, since you are using a password manager that password should only ever be used in kickstarter, so you can just change your password there and carry on
- 6d0debc071 13y ago
  Depends what you're asking about. In case 1) If you mean could they crack your keypass file where you keep all your passwords: Presuming you're using the program well, that's possible but very unlikely. There are reasons to believe this would be more difficult than attacking any of your normal passwords individually though: - The database for your passwords is not stored on a server they're likely to have been compromised, (it's a local file on your machine unless you place it somewhere else or your machine itself is compromised.) - By having only one database, you can use an approach like a long diceware pass phrase. Which would allow you to generate a password for the database that's likely to be far harder to guess than any individual password that you might otherwise have used for the sites in the database. - It's plausible to direct more processing towards making dictionary and guessing attacks against your database's password harder than a server would be likely to direct towards each individual user's password. In case 2) If you mean could they crack the password for the website that you keep in the keypass file, by attacking the hash that they got from the server attack: Theoretically, yes. However, again, there are several qualities in favour of the keepass approach: - Generation is automated. People are usually bad at generating hard to guess passwords. We think that we're making something hard to guess by inserting letters and numbers into a few words and then going 'presto!' but in reality we tend to follow fairly common patterns in what words we pick, what letters we replace, and so on. We also tend to duplicate them across sites. - Remembering and entry are automated. (We tend to be bad at remembering things that don't follow common patterns.) Thus making these generated passwords more practical to use. Those two factors combined address the main weaknesses of passwords. It's not something innate about the database that does this, mind. You could do much the same yourself if you had a perfect memory, or a notebook, and were willing to sit there throwing dice to get a good entropy source. However, I've yet to meet a human who remembers a significant number of dice-generated pass-phrases for all their accounts, and writing your passwords down represents its own potential problems (loss, compromise, speed of entry when reading the things.) The way to bet is that this is going to give you a harder to attack password than you'd come up with by yourself. They also reduce the impact of a compromise. If a password for a site is compromised, then that compromise is limited to that website, and relatively easily rectified as compared to a more general breach if you reused your passwords. For instance, my hacker news password until shortly before this post was: 4ea3a70a8361ab5d2006fbe0f98b52f2bcc6512a866e9ddaf2e9ea951d01dbed But that's worthless information now. I told my password prog to generate another string, and now it's something else. Took less than a minute. # Of course, if your keepass vault itself is compromised, then you may be dealing with a worse situation. However, considering the general weakness of passwords, and the degree to which they get duplicated, and the additional security features around things like banks that protect some of the more vital stuff, I'm not sure that even putting all your eggs in one really well guarded basket makes you significantly more vulnerable if it is broken into. But regardless, the cost of attacking an individual user goes up dramatically, whereas the rewards don't seem to scale in line with that. If someone thinks you're interesting enough to attempt to compromise your computer, get the database, and then invest resources in guessing your database password... you've probably got more serious problems anyway.
theboss 13y ago
lastpass is free or at maximum $1 per month. 1pw is pretty expensive though.... Also they run in your browser which mean the client side and crypto code is easily recoverable
- dror 13y ago
  I have used lastpass for years, and recommend it to my friends. It's easy to use, has a free options, though I opt to pay, and is a good combination of friendly and secure.
- deleted 13y ago
  [deleted]
tptacek 13y ago
I recommend 1Password as well, and am glad that's the first solution they named.
- mannkind 13y ago
  Seriously. LastPass and 1Password are light years ahead for the non-technical people. God KeePass is terrible.
  - cpach 13y ago
    I guess many people think it’s too expensive, but I have found the price for 1Password (~USD 20 IIRC) to be very reasonable for all the value it provides.
- dctoedt 13y ago
  > I recommend 1Password as well Tell us more? Should I switch from LastPass?
mannkind 13y ago
It's really too bad that you recommend an app that is practically garbage user-experience-wise compared to LastPass and 1Password. If users aren't convinced of the value of a password vault, a god-awful piece of software certainly isn't going to encourage adoption even if it's "free" "free" if your time is worth nothing
- obstacle1 13y ago
  If users "aren't convinced" of the value of a password vault after seeing all these breaches they don't deserve security. KeePass is perfectly usable if you spend 5 minutes figuring it out. It's also open source and thus analyzable for flaws, leaving one fewer vulnerability (proprietary code) for those who actually care about security.

Houshalter 13y ago

How secure is that? Couldn't they just as easily figure out your KeePass password (providing they know you are using it, and that reversing the KeePass hash isn't any more difficult than reversing the normal one.)

dublinben 13y ago
Who is they? How are they going to access your encrypted password vault?
- Houshalter 13y ago
  See the comment I made above. I mean if a site like kickstarter has compromised your password even if it was from KeePass.
euank 13y ago
No, they can't. The websites allow anyone in the world to make a guess at a password. Keepass doesn't since it requires having the private database file which you store locally. The websites allow for a vulnerability in third party code to expose you. Keepass, even if it has a vulnerability, can't be exploited remotely since the database is stored only locally. The websites are in the browser and encourage browser extensions. Browsers suck for security... that's a massive attack surface and they are, by their nature, integrated with the network. Keepass is a dedicated application with a tiny surface that barely communicates with the internet at all and has no need to. A whole class of attacks miss it. Keepass is leaps and bounds more secure.
- Houshalter 13y ago
  Yes it is secure in that area, I mean for the specific attack this post is about where a hash of your password is hacked. All keepass would do is make your password the product of two hashes instead of one. I wasn't sure if that was that significantly more secure (if it was why aren't websites doing it automatically?) Of course that implies the attacker knows you used KeePass, security through obscurity and being in the minority should protect you.
  - mpeg 13y ago
    No, the point is not to make your password more secure in case of a data breach like this (although it can, since you can store a password that is very long and composed of random characters) The idea is that even if your password for kickstarter gets compromised, since you are using a password manager that password should only ever be used in kickstarter, so you can just change your password there and carry on
6d0debc071 13y ago
Depends what you're asking about. In case 1) If you mean could they crack your keypass file where you keep all your passwords: Presuming you're using the program well, that's possible but very unlikely. There are reasons to believe this would be more difficult than attacking any of your normal passwords individually though: - The database for your passwords is not stored on a server they're likely to have been compromised, (it's a local file on your machine unless you place it somewhere else or your machine itself is compromised.) - By having only one database, you can use an approach like a long diceware pass phrase. Which would allow you to generate a password for the database that's likely to be far harder to guess than any individual password that you might otherwise have used for the sites in the database. - It's plausible to direct more processing towards making dictionary and guessing attacks against your database's password harder than a server would be likely to direct towards each individual user's password. In case 2) If you mean could they crack the password for the website that you keep in the keypass file, by attacking the hash that they got from the server attack: Theoretically, yes. However, again, there are several qualities in favour of the keepass approach: - Generation is automated. People are usually bad at generating hard to guess passwords. We think that we're making something hard to guess by inserting letters and numbers into a few words and then going 'presto!' but in reality we tend to follow fairly common patterns in what words we pick, what letters we replace, and so on. We also tend to duplicate them across sites. - Remembering and entry are automated. (We tend to be bad at remembering things that don't follow common patterns.) Thus making these generated passwords more practical to use. Those two factors combined address the main weaknesses of passwords. It's not something innate about the database that does this, mind. You could do much the same yourself if you had a perfect memory, or a notebook, and were willing to sit there throwing dice to get a good entropy source. However, I've yet to meet a human who remembers a significant number of dice-generated pass-phrases for all their accounts, and writing your passwords down represents its own potential problems (loss, compromise, speed of entry when reading the things.) The way to bet is that this is going to give you a harder to attack password than you'd come up with by yourself. They also reduce the impact of a compromise. If a password for a site is compromised, then that compromise is limited to that website, and relatively easily rectified as compared to a more general breach if you reused your passwords. For instance, my hacker news password until shortly before this post was: 4ea3a70a8361ab5d2006fbe0f98b52f2bcc6512a866e9ddaf2e9ea951d01dbed But that's worthless information now. I told my password prog to generate another string, and now it's something else. Took less than a minute. # Of course, if your keepass vault itself is compromised, then you may be dealing with a worse situation. However, considering the general weakness of passwords, and the degree to which they get duplicated, and the additional security features around things like banks that protect some of the more vital stuff, I'm not sure that even putting all your eggs in one really well guarded basket makes you significantly more vulnerable if it is broken into. But regardless, the cost of attacking an individual user goes up dramatically, whereas the rewards don't seem to scale in line with that. If someone thinks you're interesting enough to attempt to compromise your computer, get the database, and then invest resources in guessing your database password... you've probably got more serious problems anyway.

theboss 13y ago

lastpass is free or at maximum $1 per month. 1pw is pretty expensive though.... Also they run in your browser which mean the client side and crypto code is easily recoverable

dror 13y ago
I have used lastpass for years, and recommend it to my friends. It's easy to use, has a free options, though I opt to pay, and is a good combination of friendly and secure.
deleted 13y ago
[deleted]

tptacek 13y ago

I recommend 1Password as well, and am glad that's the first solution they named.

mannkind 13y ago
Seriously. LastPass and 1Password are light years ahead for the non-technical people. God KeePass is terrible.
- cpach 13y ago
  I guess many people think it’s too expensive, but I have found the price for 1Password (~USD 20 IIRC) to be very reasonable for all the value it provides.
dctoedt 13y ago
> I recommend 1Password as well Tell us more? Should I switch from LastPass?

mannkind 13y ago

It's really too bad that you recommend an app that is practically garbage user-experience-wise compared to LastPass and 1Password. If users aren't convinced of the value of a password vault, a god-awful piece of software certainly isn't going to encourage adoption even if it's "free" "free" if your time is worth nothing

obstacle1 13y ago
If users "aren't convinced" of the value of a password vault after seeing all these breaches they don't deserve security. KeePass is perfectly usable if you spend 5 minutes figuring it out. It's also open source and thus analyzable for flaws, leaving one fewer vulnerability (proprietary code) for those who actually care about security.