Hacker News Reader

Comment by thinkMOAR | Hacker News Reader

If you are paranoid, then there is only one option, you are the password manager. Certainly not a piece of software you didn't author yourself. Else you are not truly paranoid.

View on HN

That's only true for very specific threat models. For most people, the limit in entropy for your passwords implied by keeping them all in your head makes them more vulnerable than writing them down in a place with imperfect security.

I recently wrote a thing for myself to let me remember one password and generate different passwords for each of my accounts.

https://github.com/kybernetikos/sinkless

I like it because there isn't any third party or service for me to trust, but I can still have unique complex passwords for each purpose. It feels pretty much the same as having them all in my head.

Until you have to change a password.

He addresses that on the page he linked to.

How do you deal with devices that do not support extensions?

Poorly at present, but it runs as a website on anything with a recent browser: https://kybernetikos.github.io/sinkless/ and you can copy and paste, or there is a node script that will generate the same passwords.

I'd like to make the UI work better in general, but in particular on mobile devices. But then I have many projects I'd like to make time for, and this one is probably usable enough for me for now.

Similar: https://webpass.rkeene.org/

Though it does syncing

That's pretty cool. How does the syncing work? You should add emojis! :-)

It just posts an encrypted json blob to a CGI script that waits for another connection with the same ID. The script then connects those two connections so that anything one sends the other receives using a FIFO, so no disk involved and they can stream as much as they want to each other.

Are you trying to tell me what my threat model should be? That makes me suspicious...

No, actually only stating truly paranoid people would not use a 3rd party password manager. Else you still have somewhat trust in third parties, making you not paranoid.

Your reply however... stamps paranoid label on it :)

If you were that paranoid you wouldn't be using a web browser in the first place. After all, its some 3rd party software that has access to your passwords.

There seems to be a growing chatter on HN and elsewhere about how you can't trust free software because you didn't audit/write it yourself.

I'm not sure if people actually believe that or use it as a way to point out how they're smarter than other people.

Sure its possible that the free software contains something malicious, but such an attitude is not constructive. If you only used software you wrote yourself you might as well not use a computer. There are degrees of trust, balancing of risks, and free software has a much better reputation of not containing malicious code.

Don't forget about the OS, you probably didn't write that software either (you are doomed)... and even if you keep your password on paper or in your head, there could be a keylogger when the time comes to use that password.

I'm paranoid enough to only use my own password manager, but if you must use a password manager written by someone else then don't use one that runs in a web browser. Moreover, although this doesn't apply in this case, don't use a password manager that stores anything on a server not totally controlled by you.

a piece of paper in your wallet is probably safer in many cases... but not as convenient

Rationally I'd say if you are truly paranoid then you'd assume that any security software you did author isn't secure enough since you acknowledge that humans, including yourself, are fallible. Thus you would prefer to use independently audited, battle tested, solutions (albeit ones that don't sync to the cloud).

If you can audit the code yourself, you can treat it as code you authored. (assuming you are competent to perform the audit)

True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

Make sure you read the code of the compiler you're using as well, and bootstrap/compile it from that source instead of trusting an existing compiler binary.

Why stop with compilers? Inspect the circuit diagrams for all your hardware and then make sure the actual manufacturing followed the designs to a tee.

I mean I know it hyperbole but I am pretty sure there are hardware bugs that allow access, see that Intel or IBM remote management disclosure. It might not a real backdoor but it's as good as one. As people above are mentioning keep your paranoia inside your threat model

I wish I could find the story where someone actually had this issue.

Basically, the story was that a program for grad research was inserting all kinds of nasty, anti-semetic things into text and it turned out the previous grad student had poisoned the compiler which was modifying the strings and was able to re-poison it every time through something else.

I forgot the exact details but it is an amazing read.

If you're able to find that, I'd love to read it.

Found it

https://www.quora.com/What-is-a-coders-worst-nightmare/answe...

Was a great read -- thanks!

> True, in theory, though in practice, i know plenty of capable people but almost none of them bothers to read the openssh source (or even a subset, like recent changes) before updating or recompiling.

Then they aren't paranoid but normal folks, eh?

Relevant: https://en.wikipedia.org/wiki/Underhanded_C_Contest

Valid point.

https://github.com/HainaLi/horcrux_password_manager

It is in JS at least. Underhanded C is likely an easier trick to manage.

What do you mean by "treat it as code you authored"?

For purposes of security paranoia, if you can perform a security audit on open source code it is just as good as any other code you've written.

Idk about other people but I find anything I don't find security holes in myself "as good" as anything I've written. I've got the same set of assumptions/blinders/competence either way.

This does NOT protect you from script injections, keyloggers, etc. Their approach in fact DOES.

I authored my password manager. It doesn't store the passwords anywhere.

Reply on news.ycombinator.com