Hacker News Reader

Comment by stouset | Hacker News Reader

> For me it was a case of thinking I know better.

I'm deeply curious: why? When virtually every reputable security practitioner on this site and others has echoed the advice to just use a password manager for years, how do you come to the conclusion that you know better than them?

If it sounds like I'm asking judgmentally, please don't interpret it that way. Your experience mirrors that of many others, and if I can understand how this line of thinking happens then maybe we can find ways to combat it.

This is just one battle amongst many where, despite endless warnings and examples to the contrary, people seem to think they are qualified to go against encouraged practice for password storage, password management, encrypting data at rest, encrypting data over the wire, etc. And in almost all cases, people come to the conclusion that they know better, when they absolutely do not.

View on HN

I think the reason is that it just feels insecure. If you keep all your passwords in your head, then you have full control. Using a password manager means handing them off to something else, whether it is a paid service, a piece of software, or whatever. It feels like a "cat's out of the bag situation", that once you let the password escape that first container (your mind), it will inevitably spread everywhere.

I'm not saying it's rational (I'm a happy customer of 1password), but there is something a little bit scary about letting go of control of your passwords.

>I'm deeply curious: why? When virtually every reputable security practitioner on this site and others has echoed the advice to just use a password manager for years

I think the disconnect is "perfect use" vs. "typical use".

With perfect use, generating a unique passphrase for each service and storing it only in your head is more secure than using any kind of remotely-syncing password manager. It's also more convenient - wherever you are, whatever you have with you, so long as you have an internet connection you can identify and verify yourself. You don't need your phone or an app or anything else.

With typical use, people use weak passphrases, reuse passphrases and forget passphrases, so using a remotely-syncing password manager is more secure, even if it's less convenient.

Some people (possibly wrongly) think they can achieve close enough to perfect use that they're better off not using a manager. Security experts know that virtually no one can achieve perfect use, so they recommend using a manager (which is almost certainly the correct advice to give to a wide audience).

But your apparent absolute confidence in the superior security of password managers, especially closed-source cloud-based password managers, seems to me to be overplaying your hand a little. The failure mode of a closed-source cloud-based password manager, even if very unlikely, is absolutely catastrophic.

> But your apparent absolute confidence in the superior security of password managers, especially closed-source cloud-based password managers, seems to me to be overplaying your hand a little. The failure mode of a closed-source cloud-based password manager, even if very unlikely, is absolutely catastrophic.

In fact it's you that's overplayed your hand.

Open-source vs. closed-source is a red herring. Did you download compiled binaries published by the authors of an open source project? Would you be able to tell if they had published backdoored binaries that didn't match the source? Would you be able to tell if they cleverly added backdoors to the source code itself? You might argue that such deception would eventually be discovered. Maybe, but by then the "catastrophic" scenario has already unfolded.

Similarly, if you're downloading and running a third-party deterministic password manager, open-source or not, you're giving the author of that project the ability to run arbitrary code on your machine. Unless you're running it in a container with no network access or access to storage, the failure case is identical — regardless of what the software claims to do on the label, it may do something wildly different (e.g., send all of your passwords to the author).

It's cool! I've been wondering too, since it's been an eye opener without equals finding out just how wrong I was. I think there were multiple lines of reasoning going on:

- "I don't even use that many logins." I do. I just abused 'reset password via email'.

- "I distrust the cloud provider's opsec." Seriously? I'm a self taught amateur. Get a grip guy.

- "What if they give my passwords to the NSA?" ... at this point I want to slap myself.

- "How can it be secure if it's easy to use?" I blame PGP for this one...

So I guess many things. In the end it was the usual mix of uninformed bias, weariness against third parties in security, being very wrong and the assumption that security needs terrible UX.

As I said, I never looked back. I've even sat down with friends and family, explained the concept and turned their '$catsname$birthyear' passwords they used for absolutely everything into security they wouldn't ever hope to achieve otherwise. And they're all so freaking happy, too.

For their master passwords I used the 'correct horse battery staple' approach and nobody has a problem remembering one of those, especially if it's in their native language.

So, yup, you're right in every way. I didn't know better.

Reply on news.ycombinator.com