Hacker News Reader

Comment by js2 | Hacker News Reader

I'll add a self-hosted option that no one ever mentions – PasswordWallet:

https://www.passwordwallet.com/

I use iCloud Keychain for most of my passwords these days, but my critical passwords I continue to keep in PW as well.

PW also has an occasionally very useful feature that I have not seen in any other password manager: auto type. Sometimes I just need to point my cursor somewhere and have the password typed for me (e.g. into a login screen on a VNC/RDP connection).

PW uses Blowfish with 448-bit keys.

There is also "pass" (from the author of Wireguard) which is essentially a shell script wrapper around gpg and git:

https://www.passwordstore.org/

View on HN

Yeah. Auto-typing of password-related field is a relatively new security feature that got its start in Apple iOS.

While password auto-type is also found in Android, its security model is not quite a firm Bell-LaPadula yet like those implemented in Apple iOS/MacOS.

Exposing API to monitoring keystrokes remains problematic for any OSes.

> relatively new security feature

Maybe I'm misunderstanding the feature, but I've been auto-filling login forms since I was using IE7 with RoboForm. Other than using Touch ID to trigger the auto-fill instead of 1 click, I don't see any improvements in iOS/macOS Safari.

You leave all your password on the iCloud, accessible by AppleID but that AppleID password is so powerful and covers many more sensitive things (AppleWallet, ApplePay, ...)

Whereas, using a separate PIN/passcode at application-level provides a separate (master) password which would be used for all your passwords (in case your AppleID password gets compromised).

I do not use touchID nor FaceID because it violates the Principle of 3 Factors of Authentication: AppleID merges two of three factors:

1. "what you know (memory rote)" with

2. "what you have (biometric)".

https://www.cs.cornell.edu/courses/cs513/2005fa/NNLauthPeopl...

> using a separate PIN/passcode at application-level provides a separate (master) password which would be used for all your passwords (in case your AppleID password gets compromised).

That already happens exactly as you mentioned.

You need a secondary encryption password for encrypted iCloud data as well. Having access to your Apple account isn't enough.

https://support.apple.com/en-ph/HT202303#:~:text=Apple%20wil...

THIS!

Apple finally provides a modicum variant of Zero Knowledge password.

But that is only available in next iOS version 16.2. [1]

But, but ... BUT the Apple macOS/iOS issue of Three Form of Authentication being still being reduced into Two-Form with their merge (OR-logic) of what you have (FaceID/TouchID) and what you know (PIN/passcode) ... remains.

That reduction of authentication is still the greatest weakest link to individual security (whether ADP is used after v16.2 or not).

https://support.apple.com/en-ph/HT202303#:~:text=Apple%20wil...

The auto-typing feature is not the same as autofill. Rather, it literally emulates typing from the keyboard and is useful in contexts where autofill is not supported. I only ever use it on desktop, and it's a feature that PasswordWallet has had for more than a decade.

I've been using "pass" for years and love it. There is also a very nice iOS app that works well and is open source. I synchronise my devices and backup directly without a central repo. Its only flaw is gpg's poor UX...

There is a fork of pass called "passage" that uses Age for encryption instead: https://github.com/FiloSottile/passage Unfortunately I don't believe any iOS/Android apps exist to work with it so far.

pass is fine if you like gpg (why?) and the only machines where you need those passwords are Linux/macOS/*nix computers. There are ways to access it on Windows, Android, and iOS, but they are unbearably painful.

Agreed.

Your selection of password manager is going to be invariably dictated by how many different platforms you need to sync up your password manager with.

And those maintainers of their own password manager are in an arms race.

Passwordstore (pass) databases are just a git repo which makes great audit trails, but also gives it syncing for free rather than reinventing the wheel.

It uses PGP rather than rolling its own encryption, which also makes it compatible with hardware tokens, for free.

It's not some complicated project... it's just a thousand or so line shell script.

It's fine if all platforms where you want your passwords can run bash scripts, git and gpg. Linux and macOS can do it fine. Windows might, although it gets flaky. Android and iOS can’t, at least not in any human-friendly way.

Honestly, this is the most secure and sufficiently functional password manager!

Ooooooo, if the passwordstore has a bash autocomplete in which to navigate selections of its config file subdirectories, then the solution becomes incredibly robust.

Why would you store critical passwords in two places?

Because you should have backups for critical things.

Reply on news.ycombinator.com