Hacker News Reader

Hacker News

Comment by TTPrograms | Hacker News Reader

Parent Full thread

TTPrograms

Note the hack was in 2012. Hopefully most people have rotated passwords by now.

View on HN

Normal people don't rotate passwords unless they are forced to.

Anyone know of automated ways to rotate all the passwords on all of our accounts across the web?

It's a common feature of password managers.

Honest question: Why does any none need password managers? Does not chrome password sync or firefox sync do the job? Thanks

To generate random, strong passwords. Also not to be locked into a browser. Better actual password management (e.g. last changed). Tags.

A canary of chrome did have the ability to generate random passwords, but password management in chrome is still a pain IMO. Not sure about FF, but a quick google suggests it doesn't generate random passwords automatically.

FF doesn't, but as usual, there are addons for that :)

Chrome and Firefox are password managers :)

People use other managers for many reasons: storing passwords (and other secrets) which aren't used on a site, using them on different browsers (say, Safari on the desktop and Chrome on mobile) and lack of trust on the browser's password manager.

Also, for a long time, browsers didn't save passwords with forms marked with autocomplete=off.

Some of us still use native applications that don't use Chrome or Firefox.

Can any open source password managers do this?

When I used pwsafe and keepassx they had this option.

Wow, single point of failure for all my accounts, all my credential, all my personal, private and public data. I would love to use it!

I know you're being sarcastic, but with lastpass you can rotate most of your passwords.

https://blog.lastpass.com/2014/12/introducing-auto-password-...

Anyone know of an open source Firefox extension that can do this?

I don't, but would the extension in-effect need to have all your passwords too? Since I don't know of any battle tested (multiple very bad vulnerabilities exposed in public) password managers that offer this other than LastPass, I say check out the public opinion of that extension.

Yes, but as an extension it could just call into Firefox (which has all the passwords) to do all the work.

Have you tried this? It fails for most sites IME.

Yes I did (I didn't want to say it, disappointing most HNers).

I works for most of the major websites (Google, Amazon, etc. I think you can look them up). And also handles multiple google accounts pretty well, even when an google account is logged in, without logging it out. And it definitely doesn't works for the majority of the websites.

(And now for the skeptical ones) I'd say use it for websites you use 2FA since any bug (or intentional backdoor) won't be successful.

PSA: If you're using LastPass for managing passwords, DONOT use their 2FA authenticator app, since now it offers an option to autofill option. Now that is the point where you're crossing into al eggs in one basket territory.

Reply on news.ycombinator.com