Hacker News Reader

Comment by raverbashing | Hacker News Reader

Password managers have a central point of failure, either it's breached or its password/data is lost

I can trust a password manager, but I would keep an offline physical backup, and they're not the 'ultimate solution'

Yes, they have a single point of failure -- but, more importantly, this is the only point of failure.

Write your password on a piece of paper and store it safely (what constitutes 'safely' may vary. For most people, an envelope in the bottom of a drawer is plenty safe.). Put the actual password database on Dropbox and make sure it's replicated in a couple of locations.

> they're not the 'ultimate solution'

Nobody said that, so your quote-marks are out of place. The GP said that there is no better solution today.

What do you consider as better solution?

> and they're not the 'ultimate solution'

Negative statements have less information than positive ones.

I don't need a backup, because my password manager syncs with my phone and tablet. Loosing those two and my computer simultaneously would put me in really big trouble, but statistically I'm much more secure than transmitting non-truly-random passwords across the Internet.

Using two-factor authentication with your password manager helps mitigate the risk. Online managers such as lastpass only keep encrypted versions of your passwords, and they do not know your master pw to unlock that vault, so even if they get breached (which has happened), the attacker just has a bunch of encrypted passwords.

They are probably not the "ultimate solution", but anything that starts with "You'll need to practice ahead of time..." is not even worth considering.

I can't think of a reason to agree with this. Would you like to provide some?

Any scheme I'm going to replace my current password scheme with (whatever that might be) must be both secure and convenient. A scheme which I must invest time into 'practicing' is not convenient.

What's the central point of failure for my 1Password vault?

It's stored on four of my devices. It's stored on Dropbox as well, but a compromise of Dropbox won't give the attacker anything because it uses secure crypto and I have a strong master password.

The central point of failure is: you losing your master password

Is there any secure scheme that protects against that sort of major brain failure?

Not that I'm aware of, it's definitely not simple A lot relies on being able to "forget password" on systems

Share your master password with your friends. You can make it so that, say, 20 out of your 50 friends are required to piece together the master password.

See https://en.wikipedia.org/wiki/Shamir%27s_Secret_Sharing

If you are afraid of breaches you can use an offline password manager. Data being lost remains a problem, but this is the case for all of your files so it should be backuped the same.

Reply on news.ycombinator.com