Hacker News Reader

Comment by kijin | Hacker News Reader

How often do you need to type passwords into a machine that you either cannot or are unwilling to sync with a decent password manager? How do you trust this machine not to record and exfiltrate everything you ever typed into it? IMO it's a Good Thing (tm) that I have to jump through hoops to access my passwords on unfamiliar machines.

How does one even calculate H(username|service name|master password) on an unfamiliar machine that might not have a decent scripting language installed on it? If you asked me to do it on my father's laptop, for example, I'm gonna have to download Python first.

View on HN

Re. the number of machines, it's something I've encountered as an obstacle from a fair proportion of people I've spoken about password managers to. I think its more a perceived issue than a real one.

Just spitballing which systems I would realistically want access to passwords on, at a minimum, includes: personal desktop, personal laptop, tablet(s), cellphone(s), family (parent, sibling, in-laws, etc) computers, office desktop, office laptop.

In my case (many cases?), the latter two prevent software installation, so I would need to manually type from a manager synced on my cell. Which really is no different to what is required for 2FA - just a longer character string. Overall, a some setup and synch related inconveniences but not to a damaging degree, which is why I think this is more a matter of perception - once you think through where you're typing passwords it appears less of an obstacle.

Chrome syncing browser plugins with a password manager makes personal desktop/laptop, and office desktop/laptop pretty trivial (barring, yes, overzealous IT).

Cellphone and tablet I install the relevant app once and am done.

Either way, web access to the credentials isn't uncommon, though you'll need a device for 2-factor confirmation it's you.

For family devices...I wouldn't want to log into them. I don't trust their security sense and don't want to risk compromising my stuff because of their mistake. Why would I anyway; I have my cellphone on me, at minimum; I can access the account there.

> the [office computers] prevent software installation, so I would need to manually type from a manager synced on my cell.

I don't know about other Password Managers, but LastPass lets you access your vault using any web browser. So long as your network doesn't block the LP site, you can access your password manager from anywhere.

On a similar note, Keepass can be used without admin rights with the portable version, so you can keep the portable executable along with the encrypted db file in some secure and accessible email account/web service that your network doesn't block.

Indeed, or a USB drive.

Not often, but the times you do need to use those machines are probably the direst of times, i.e. emergencies.

I make sure that I always remember at least two passwords in addition to the master password for my password manager: my bank and my email.

If I need immediate access to any other site and I don't have access to my password manager, I'll just trigger a password reset and check my email.

Reply on news.ycombinator.com