Hacker News Reader

Comment by gridspy | Hacker News Reader

Personally, my bank account is one part of my online identity I wouldn't trust in the hands of any password manager.

But why? What are you worried about? The anti-fraud systems being employed by your bank are damned good. Moreover, All banks (U.S.) provide fraud protection... Looking at my Bank's website for a moment reveals that a potential attacker could, I assume, change my ATM PIN (If they already knew it) do some bill pay, and possibly create an ACH transfer... Which I could reveal as fraudulent to my bank...

Why should I be worried about this? I'm not trolling... I just don't understand what we are all supposed to be afraid of.

This. For me, Lastpass gets everything except email and banking. That means I have to remember 3 logins, which I am okay with.

Just 3 ... problem is between banks, CC and brokerage accounts I have at least a dozen accounts which are 'financial' in nature.

I wish there was a way of securing all of them with the same secondary authentication token.

Something like this? https://www.pwdhash.com/ You can use the same password but the local browser plugin will use the site's URL to hash the password you type into something unique to that URL. I haven't used it personally and haven't researched it in detail but I like the concept.

Sounds like supergenpass which was implemented in Javascript as a bookmarklet, which is pretty good idea, except that any website with malicious code could grab your master pass from the DOM, and then they could use that for your account on any other website.

It looks like pwdhash works around this by functioning as a browser plugin (making your master password in accessible from the DOM) but I'd still be slightly worried about browser exploits allowing malicious sites to get at your master password.

Maybe you use trust-level master passwords. E.g.

Financial institutions you type in: 'myfinancialpassword' Other sites you type: 'myrelativelysecurepassword'

It's remarkably hard to get this right. pwdhash notes[1] that being a browser plugin stops JavaScript grabbing the password, but it's still possible with Flash. Third-party ports to other browsers don't even have the JS protection.

pwdhash still leaks the length of the password since it aims to give users visual feedback of characters being typed.

Then you've also got the issue of automatic update of plugins being compromised. The question is really: is it more secure than the alternatives?

1: http://crypto.stanford.edu/PwdHash/pwdhash.pdf

Reply on news.ycombinator.com