8 ms·

Considering your background and experience, do you have a recommendation for personal level password management?

by mey 11y ago

tptacek 11y ago
I use and like 1Password.
- sdrapkin 11y ago
  Please remember that just because tptacek likes and uses something, do not mean that it has great security. The PDF linked below states that there is zero integrity in 1Password file format. I happen to like and use KeePass, but that is not a secure-software guarantee.
  - tptacek 11y ago
    I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/you-have-secrets-we-dont-why-our-data-format-is-public/ https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... Members of the 1Password team are vocal participants in the ongoing conversation about secure software and cryptography. For instance, Jeffrey Goldberg frequently gets involved in discussions of crypto vulnerabilities on Twitter. I don't have a formal recommendation to offer you regarding their team, but I can offer the same "I've talked to these people and feel like they know what they're doing" vibe that Schneier tried to offer for BestCrypt. Anyways: that's one of the reasons I like 1Password.
    - sdrapkin 11y ago
      Fair enough. I do note that the very blog you linked mentions that there are two 1Password formats: 1. The "Agile Keychain Format" (versions 2 and 3, which lack integrity). 2. The "Cloud Keychain Format" (versions 4+, which have integrity). You didn't specify which version you use & like. I also note that the 1Password team had been selling security software which was not designed well - see (1) above. And it's not like HMAC wasn't invented when 1Pass got started. Mr. Goldberg learns as he goes. There is nothing wrong with that. Or is there - when it comes to selling security software? Rhetorical question for all to ponder...
      - tptacek 11y ago
        If there was a password storage tool designed from the jump by a full-time cryptographic engineer, that'd be the one I'd talk about. Let me know if you find one?
        phlo 11y ago
        Password Safe [1] was designed by Bruce Schneier, that could fit the bill. It seems to have done quite well in the paper cited by xenophonf in [2], too. [1] http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ [2] https://news.ycombinator.com/item?id=9727522 https://news.ycombinator.com/item?id=9727522
        tptacek 11y ago
        Looking the C++ code for this project, this appears to be unauthenticated TwoFish in ECB mode. (I thought, no, no way is this actually ECB mode, maybe they just did the XOR'ing for CBC mode outside the TwoFish class, but no: they appear to pad blocks explicitly to block boundaries and then ECB them.) I looked for a total of 4 minutes, so if someone wants to correct me...
        pwg 11y ago
        You need to look at the PasswordSafe file format. It can be found here (among other places): http://sourceforge.net/p/passwordsafe/git-code/ci/333dd9f23a3bdee81786750a760699e7dc865102/tree/docs/formatV3.txt http://sourceforge.net/p/passwordsafe/git-code/ci/333dd9f23a... ECB mode is only used for the internal keys. The database records are encrypted in CBC mode, and there is an integrity authenticator HMAC as well. However, the format was designed in the days when Mac-then-encrypt was considered proper. So the authentication HMAC is over the plaintext prior to encrypting.
        tptacek 11y ago
        Yes, @tehjh on Twitter pointed this out. The CBC code is in Util.cpp, _readcbc; it appears to be length-delimited instead of padded, so there's probably another error oracle in the decoding of the length/type block. Also: in PWSfileV3.cpp, are they HMAC'ing the IV? This is interesting; we might be able to make an exercise out of it.
    - newman314 11y ago
      I like and use 1Password too. But maybe someone smarter than I can explain what Goldberg is trying to say re 1Password and the paper "On the Security of Password Manager Database Formats" [1] [1] https://discussions.agilebits.com/discussion/comment/127847/#Comment_127847 https://discussions.agilebits.com/discussion/comment/127847/... One thing, I never liked about the 1Password file format was it's insistence on leaving certain fields unencrypted in order to allow the app to search using those fields. I've pushed for a "high security" preference option were all fields are encrypted to not avail. I'm willing to trade off the search convenience but that's a choice that Agilebits should allow me to make.
      - tptacek 11y ago
        I don't know. I skimmed Gasti & Rasmussen 2012, and reread Goldberg's comment; unfortunately, I also just skimmed the source for for PasswordSafe V3, the "only one" that achieved "MAL-CDBA"; it appears to be cryptographically unsound (MAC-then-encrypt of an idiosyncratic AES-CBC).
      - pvg 11y ago
        Their newer format 'opvault' claims to address it as well as authentication - you're probably best off just googling 'opvault' for the various forum and blog posts about it. You can enable opvault in almost all the platform/sync combinations if you download the current v5 beta.
        newman314 11y ago
        Everything I've found so far says that opvault is still buggy. I didn't think v5 was still in beta as I've been happily using 1Password 5.
- karussell 11y ago
  Is that open source too or how would you know about their security? Cannot find it: https://github.com/AgileBits https://github.com/AgileBits
  - tptacek 11y ago
    When you went looking for it, did you try Googling for [1password file format]?
    - karussell 11y ago
      No, didn't know that looking just at the file format is sufficient. BTW: I'm no security specialist so excuse me any stupidity here ;) But couldn't the implementation of parts of the service being flawed? (and you cannot know as it is closed source)
- secstate 11y ago
  Too bad the only way to use 1Password with linux or a BSD is some jaxy browser extension.
  - linuskendall 11y ago
    Windows version works perfectly well under Wine, though you won't get official browser extension to work for autofill.
  - billrobertson42 11y ago
    jaxy?
    - secstate 11y ago
      http://www.letters4words.com/jaxy.htm http://www.letters4words.com/jaxy.htm i.e. ass, poorly implemented, bad
- sinatra 11y ago
  And how do you save and sync the passwords across various machines? Edit: The reason I asked is because I wanted to see if 1Password can be more secure than LastPass. However, if you're using 1Password with Dropbox, I'd say this combination doesn't feel any more secure than LastPass. Other more secure options like WiFi sync aren't convenient enough. So, it appears there's no strong reason for me to consider switching from LastPass.
  - tptacek 11y ago
    With the 1Password syncing feature.
  - diddeb 11y ago
    I tend to use Dropbox. But there are a multitude of options available to users.
  - newman314 11y ago
    BTSync + 1Password works fine.
  - kijin 11y ago
    With LastPass, your account password is your master password. Its hash is stored on their servers, and they have an opportunity to intercept the plaintext whenever you log in. With 1Password+Dropbox, Dropbox doesn't know your master password. It only ever sees the encrypted vault, and doesn't have any opportunity to intercept any plaintext. (If your password is strong enough, you could probably even get away with posting your vault on a public website.)
    - sinatra 11y ago
      I use 2-step auth with LastPass. Although passwords are encrypted on client-side for LastPass too, I understand that if LastPass wants, they can get the master password or password for any specific site. All they need to do is change their client. However, considering 1Password is closed-sourced, if they want, they can do so too. Right? And if I think about "What is harder for hackers to get to: My encrypted password file on Dropbox or my encrypted passwords on LastPass," I feel I'll have more confidence in LastPass. Anything very obviously wrong with this thinking?
- nivla 11y ago
  Just to be clear this is not directed at you tptacek. However, I am genuinely confused at HN, whenever it comes to security/privacy most yell "Open Source Only" and yet a good chuck of them use 1Password, which I believe is closed source. It really doesn't make any sense. Why trust one over all the others? Obviously given that open source does not equate to security and closed source does not equate to vulnerabilities. It make it even more disconcerting when you see a security or privacy related "Show HN:" being immediately dismissed for choosing closed source.
  - tptacek 11y ago
    I like open source but certainly do not believe that it is always the best choice when it comes to security.
    - jc123 11y ago
      Why? Interested in your reasons. One plausible one is that trusting an author you know can be more practical than examining every line of a massive open source code base. Could that be a reason? Others?
      - tptacek 11y ago
        Shotgun blast: open source software is easier to read. Is the quality higher? Depends: there are some terrible vendors, and there are some very shoddy open source security projects. Open source software, with a couple of exceptions, are rarely audited professionally. Widely used open source projects get shaken out for memory corruption and XSS. They do not as a rule get thoroughly evaluated for cryptographic flaws. A more precise way to state my preferences: I trust _crypto_ from Microsoft, Apple, or (especially) Google more than I trust _crypto_ from a developer I've never heard of before. I do not as a rule trust rando closed-source projects.
  - lewisl9029 11y ago
    In the end, choosing software for privacy/security is a matter of trust: How much do you trust a piece of software to protect your privacy/security? We determine how much we trust a piece of software based on countless different social/technical factors. Being open-source is definitely a positive trust factor, but some people may place more weight on other factors such as pedigree of the developers, availability of corporate backing/funding (guaranteed continued development/support), or maturity/stability of the software itself. I personally consider being open-source paramount when it comes to security/privacy software (and am one of those people who tend to dismiss anything privacy/security related that's not open-source, although I don't usually feel the urge to broadcast my dismissal to the world), but I respect that other people may not share the same set of priorities.
- vially 11y ago
  What do you think about pass [1]? [1] - http://www.passwordstore.org/ http://www.passwordstore.org/
  - lez 11y ago
    This one looks really great. Properly following the UNIX philosophy, at last.
- JoachimS 11y ago
  User of 1password here too. One thing I don't like with it is the cleartext metadata. You may not see the secrets, but you can see the category/type of the secret. And things like the URL to where the secret may be used. Given the type and link to 'hamsterporn.net' I can guess you are a user of some site which may be embarrassing if exposed.
- ElliotNess 11y ago
  AgileBits comment on the latest Apple iOS/Mac shenanigans. http://www.theregister.co.uk/2015/06/17/apple_hosed_boffins_drop_0day_mac_ios_research_blitzkrieg/ http://www.theregister.co.uk/2015/06/17/apple_hosed_boffins_... - AgileBits, owner of popular software 1Password, said it could not find a way to ward off the attacks or make the malware "work harder" some four months after disclosure. - Doesn't appear to matter what password manager you use, if the underlying software is broken.

Considering your background and experience, do you have a recommendation for personal level password management?

by mey 11y ago

Considering your background and experience, do you have a recommendation for personal level password management?

tptacek 11y ago

I use and like 1Password.

sdrapkin 11y ago
Please remember that just because tptacek likes and uses something, do not mean that it has great security. The PDF linked below states that there is zero integrity in 1Password file format. I happen to like and use KeePass, but that is not a secure-software guarantee.
- tptacek 11y ago
  I agree with your first sentence. But, regarding the rest of your comment: We use Encrypt-then-MAC authenticated encryption everywhere we use encryption. The MAC is HMAC-SHA256 and encryption is AES-CBC using 256-bit keys. Key derivation is uses PBKDF2-HMAC-SHA512. More detail about these choices will be presented in the relevant sections on key derivation and item encryption. https://blog.agilebits.com/2013/03/06/you-have-secrets-we-dont-why-our-data-format-is-public/ https://blog.agilebits.com/2013/03/06/you-have-secrets-we-do... Members of the 1Password team are vocal participants in the ongoing conversation about secure software and cryptography. For instance, Jeffrey Goldberg frequently gets involved in discussions of crypto vulnerabilities on Twitter. I don't have a formal recommendation to offer you regarding their team, but I can offer the same "I've talked to these people and feel like they know what they're doing" vibe that Schneier tried to offer for BestCrypt. Anyways: that's one of the reasons I like 1Password.
  - sdrapkin 11y ago
    Fair enough. I do note that the very blog you linked mentions that there are two 1Password formats: 1. The "Agile Keychain Format" (versions 2 and 3, which lack integrity). 2. The "Cloud Keychain Format" (versions 4+, which have integrity). You didn't specify which version you use & like. I also note that the 1Password team had been selling security software which was not designed well - see (1) above. And it's not like HMAC wasn't invented when 1Pass got started. Mr. Goldberg learns as he goes. There is nothing wrong with that. Or is there - when it comes to selling security software? Rhetorical question for all to ponder...
    - tptacek 11y ago
      If there was a password storage tool designed from the jump by a full-time cryptographic engineer, that'd be the one I'd talk about. Let me know if you find one?
      - phlo 11y ago
        Password Safe [1] was designed by Bruce Schneier, that could fit the bill. It seems to have done quite well in the paper cited by xenophonf in [2], too. [1] http://passwordsafe.sourceforge.net/ http://passwordsafe.sourceforge.net/ [2] https://news.ycombinator.com/item?id=9727522 https://news.ycombinator.com/item?id=9727522
        tptacek 11y ago
        Looking the C++ code for this project, this appears to be unauthenticated TwoFish in ECB mode. (I thought, no, no way is this actually ECB mode, maybe they just did the XOR'ing for CBC mode outside the TwoFish class, but no: they appear to pad blocks explicitly to block boundaries and then ECB them.) I looked for a total of 4 minutes, so if someone wants to correct me...
        pwg 11y ago
        You need to look at the PasswordSafe file format. It can be found here (among other places): http://sourceforge.net/p/passwordsafe/git-code/ci/333dd9f23a3bdee81786750a760699e7dc865102/tree/docs/formatV3.txt http://sourceforge.net/p/passwordsafe/git-code/ci/333dd9f23a... ECB mode is only used for the internal keys. The database records are encrypted in CBC mode, and there is an integrity authenticator HMAC as well. However, the format was designed in the days when Mac-then-encrypt was considered proper. So the authentication HMAC is over the plaintext prior to encrypting.
        tptacek 11y ago
        Yes, @tehjh on Twitter pointed this out. The CBC code is in Util.cpp, _readcbc; it appears to be length-delimited instead of padded, so there's probably another error oracle in the decoding of the length/type block. Also: in PWSfileV3.cpp, are they HMAC'ing the IV? This is interesting; we might be able to make an exercise out of it.
  - newman314 11y ago
    I like and use 1Password too. But maybe someone smarter than I can explain what Goldberg is trying to say re 1Password and the paper "On the Security of Password Manager Database Formats" [1] [1] https://discussions.agilebits.com/discussion/comment/127847/#Comment_127847 https://discussions.agilebits.com/discussion/comment/127847/... One thing, I never liked about the 1Password file format was it's insistence on leaving certain fields unencrypted in order to allow the app to search using those fields. I've pushed for a "high security" preference option were all fields are encrypted to not avail. I'm willing to trade off the search convenience but that's a choice that Agilebits should allow me to make.
    - tptacek 11y ago
      I don't know. I skimmed Gasti & Rasmussen 2012, and reread Goldberg's comment; unfortunately, I also just skimmed the source for for PasswordSafe V3, the "only one" that achieved "MAL-CDBA"; it appears to be cryptographically unsound (MAC-then-encrypt of an idiosyncratic AES-CBC).
    - pvg 11y ago
      Their newer format 'opvault' claims to address it as well as authentication - you're probably best off just googling 'opvault' for the various forum and blog posts about it. You can enable opvault in almost all the platform/sync combinations if you download the current v5 beta.
      - newman314 11y ago
        Everything I've found so far says that opvault is still buggy. I didn't think v5 was still in beta as I've been happily using 1Password 5.
karussell 11y ago
Is that open source too or how would you know about their security? Cannot find it: https://github.com/AgileBits https://github.com/AgileBits
- tptacek 11y ago
  When you went looking for it, did you try Googling for [1password file format]?
  - karussell 11y ago
    No, didn't know that looking just at the file format is sufficient. BTW: I'm no security specialist so excuse me any stupidity here ;) But couldn't the implementation of parts of the service being flawed? (and you cannot know as it is closed source)
secstate 11y ago
Too bad the only way to use 1Password with linux or a BSD is some jaxy browser extension.
- linuskendall 11y ago
  Windows version works perfectly well under Wine, though you won't get official browser extension to work for autofill.
- billrobertson42 11y ago
  jaxy?
  - secstate 11y ago
    http://www.letters4words.com/jaxy.htm http://www.letters4words.com/jaxy.htm i.e. ass, poorly implemented, bad
sinatra 11y ago
And how do you save and sync the passwords across various machines? Edit: The reason I asked is because I wanted to see if 1Password can be more secure than LastPass. However, if you're using 1Password with Dropbox, I'd say this combination doesn't feel any more secure than LastPass. Other more secure options like WiFi sync aren't convenient enough. So, it appears there's no strong reason for me to consider switching from LastPass.
- tptacek 11y ago
  With the 1Password syncing feature.
- diddeb 11y ago
  I tend to use Dropbox. But there are a multitude of options available to users.
- newman314 11y ago
  BTSync + 1Password works fine.
- kijin 11y ago
  With LastPass, your account password is your master password. Its hash is stored on their servers, and they have an opportunity to intercept the plaintext whenever you log in. With 1Password+Dropbox, Dropbox doesn't know your master password. It only ever sees the encrypted vault, and doesn't have any opportunity to intercept any plaintext. (If your password is strong enough, you could probably even get away with posting your vault on a public website.)
  - sinatra 11y ago
    I use 2-step auth with LastPass. Although passwords are encrypted on client-side for LastPass too, I understand that if LastPass wants, they can get the master password or password for any specific site. All they need to do is change their client. However, considering 1Password is closed-sourced, if they want, they can do so too. Right? And if I think about "What is harder for hackers to get to: My encrypted password file on Dropbox or my encrypted passwords on LastPass," I feel I'll have more confidence in LastPass. Anything very obviously wrong with this thinking?
nivla 11y ago
Just to be clear this is not directed at you tptacek. However, I am genuinely confused at HN, whenever it comes to security/privacy most yell "Open Source Only" and yet a good chuck of them use 1Password, which I believe is closed source. It really doesn't make any sense. Why trust one over all the others? Obviously given that open source does not equate to security and closed source does not equate to vulnerabilities. It make it even more disconcerting when you see a security or privacy related "Show HN:" being immediately dismissed for choosing closed source.
- tptacek 11y ago
  I like open source but certainly do not believe that it is always the best choice when it comes to security.
  - jc123 11y ago
    Why? Interested in your reasons. One plausible one is that trusting an author you know can be more practical than examining every line of a massive open source code base. Could that be a reason? Others?
    - tptacek 11y ago
      Shotgun blast: open source software is easier to read. Is the quality higher? Depends: there are some terrible vendors, and there are some very shoddy open source security projects. Open source software, with a couple of exceptions, are rarely audited professionally. Widely used open source projects get shaken out for memory corruption and XSS. They do not as a rule get thoroughly evaluated for cryptographic flaws. A more precise way to state my preferences: I trust _crypto_ from Microsoft, Apple, or (especially) Google more than I trust _crypto_ from a developer I've never heard of before. I do not as a rule trust rando closed-source projects.
- lewisl9029 11y ago
  In the end, choosing software for privacy/security is a matter of trust: How much do you trust a piece of software to protect your privacy/security? We determine how much we trust a piece of software based on countless different social/technical factors. Being open-source is definitely a positive trust factor, but some people may place more weight on other factors such as pedigree of the developers, availability of corporate backing/funding (guaranteed continued development/support), or maturity/stability of the software itself. I personally consider being open-source paramount when it comes to security/privacy software (and am one of those people who tend to dismiss anything privacy/security related that's not open-source, although I don't usually feel the urge to broadcast my dismissal to the world), but I respect that other people may not share the same set of priorities.
vially 11y ago
What do you think about pass [1]? [1] - http://www.passwordstore.org/ http://www.passwordstore.org/
- lez 11y ago
  This one looks really great. Properly following the UNIX philosophy, at last.
JoachimS 11y ago
User of 1password here too. One thing I don't like with it is the cleartext metadata. You may not see the secrets, but you can see the category/type of the secret. And things like the URL to where the secret may be used. Given the type and link to 'hamsterporn.net' I can guess you are a user of some site which may be embarrassing if exposed.
ElliotNess 11y ago
AgileBits comment on the latest Apple iOS/Mac shenanigans. http://www.theregister.co.uk/2015/06/17/apple_hosed_boffins_drop_0day_mac_ios_research_blitzkrieg/ http://www.theregister.co.uk/2015/06/17/apple_hosed_boffins_... - AgileBits, owner of popular software 1Password, said it could not find a way to ward off the attacks or make the malware "work harder" some four months after disclosure. - Doesn't appear to matter what password manager you use, if the underlying software is broken.