Hacker News Reader

Comment by kevin_thibedeau | Hacker News Reader

Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.

View on HN

Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what you have after you entered something you know, since the whole point of a password manager is to have one strong password that you need to remember, instead of tens or hundreds probably-not-so-strong individual passwords), would also be a game-over scenario if you keep all your passwords in your head, since the attacker could just run a keylogger and take the passwords as you type them during regular use instead of getting your unencrypted password database after you unlock it.

Yes, exactly. I have never understood the prevalence of threat models of the form "if an attacker gets full, unrestricted access to my running session, they still won't be able to ..." or "if an attacker gets me to run code, they won't figure out ...". They make no sense, unless the attacker is stupid.

To be fair, there are a lot of script kiddies in the world.

But the point of failure is not likely to be your database of unencrypted passwords. Also if an attacker can get their hands on a password database which is stored locally you probably have more problems than just that.

Simply using the browsers built-in password saving capability with random passwords is still better than nothing (Chrome can even generate random passwords for you). Changing the password for one compromised site is better than having to change it for every site because of password reuse.

I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.

I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password.

In fact, I'd go further and say that you can do this with your login name. So for example:

myemail+by@gmail.com for eBaY

This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your info and even stealing your account:

https://medium.com/@espringe/amazon-s-customer-service-backd...

If you are hosting with AWS you should really consider doing that http://www.techinsider.io/hacker-social-engineer-2016-2

This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.

Do you realize that your AWS account can be compromised without something like this?

Using different usernames/emails for different services is not a bad idea (particularly as a defense against untargeted attacks). But using a simple algorithm for generating passwords (ie pretty much any algorithm a human can remember) is playing with fire -- if an attacker can recover your generated passwords from just a few different services (via lucky crack from a db dump, or some site stored or transmitted or logged it in plaintext, or you were phished, or you created an account to try out someone's random mvp on a slapdash server that was already pwnd, etc), a human attacker will be able to figure out your username/password for all of your services. (And if we're not there already, it won't be too long before automated password crackers can do the same.)

Plus, from a practical standpoint, what do you do when a site forces you to change your password because they fear their password db has been compromised (or has asinine rules about your password being too long, or make you rotate your password every 90 days, or they change their domain name 5 times in 3 years)?

I imagine password cracking apps are also smart enough to try letters from the site domain combined with other known base passwords (dictionary words, common substrings from other password leaks, etc.).

99.999% of users will never experience a "well-planned targeted attack." Making us jump through the same security hoops that can protect high-value targets is annoying.

Anyone could become a target anytime. An attacker would just have to attack one person at a time.

This assumes that your password is never leaked, changed, or reset. What happens if Ebay's password database were exfiltrated? You now have the following problems:

1) If your password is cracked, a hacker seeing it might deduce your algorithm and then deduce that your Amazon password would be 'myemail+mo', etc. Now your scheme is out the window.

2) Even assuming your password is salted and hashed securely such that it can't be decrypted, Ebay would probably reset it as a precaution. So now you've got to change this password. Maybe you decide to do the 3rd and 5th letters of the domain name instead. So now your scheme is 2nd-and-5th for all but Ebay, and you've got to remember that the Ebay one is unique. For now. As more leaks or resets occur down the line, however, you'll have more exceptions, to the point that you'll be forced to maintain a list of what KIND of passwords each site uses. In which case, why not just use a password manager?

Password managers exchange too many strong secrets to remember, for one strong secret you can remember.

You just have to turn off any automatic / integration features. I do. Unlock with master password for every use. Really, how often is that, since most sites keep you logged in? Just a couple times a day for me.

Ugh, seriously? I think the vast majority of people wouldn't use a password manager if it were that difficult to use, especially on mobile where typing a truly secure password with different casing and special chars is a PITA. Getting a phone with a fingerprint scanner to unlock my password manager has been the mobile feature that has had the most valuable impact on me in the past couple years.

Even though I use 1Password, I used to use weak passwords on some accounts I frequently had to sign in to because I couldn't stand typing my master password in to my iPhone every time I wanted to open it. Finger print unlocking means I can use significantly stronger passwords for almost everything with little trouble now. That feature has been invaluable to me. Probably one of the most important mobile features ever, for me.

I sign in even less often, maybe once a month, on my phone. GMail, other google services, Instagram, Snapchat, HackerNews in Firefox, everything I can think of stays signed in forever.

(Though I don't use much more than those, on my phone. I do have a laptop ...)

What are "reasonable security practices" for maintaining strong, unique passwords over several hundred sites?

For me I have a few standard passwords depending on type of security e.g forums which dont matter so much if people access vs email vs banking. On each I have change I make depending on the name of the business e.g. you could use the part of their business name to decide part of that password type thing. For someone like me who is less likely to be specifically targeted for hacking and more likely to lose account security to mass breaches like LinkedIn (twice now guys!), this seems a good way to limit chances of a broad account breaches while maintaining fairly easy to remember 100's of passwords. That said I completely acknowledge a sophisticated hacker would have no issues beating my method.

Randomly generate a password for every site. Store said passwords in a password manager protected with one master password which you remember (taking the number of passwords you would have to remember from hundreds (impossible) to one (very possible)). Even using the built-in password saving feature of your browser is fine for this if you can't be bothered to use anything else. Chrome even has an option to generate random passwords for you.

That's what I thought, but it's also exactly what LastPass and other password managers do, so I'm still unclear why kevin_thibedeau thinks password managers aren't " reasonable security practices."

Reply on news.ycombinator.com