Hacker News Reader

My MIL literally has a notebook in her house where she writes down her passwords. I scoffed when I found out about this, but then considered, well, it's a lot more secure than what she was doing before she had it, and the chances of someone breaking into her physical house for it are pretty slim.

Maybe suggest that to them?

I mean, I dunno. Knowing how to press an icon or copy-paste content from one app to another is sort of computer table stakes in 2018. These are problems on the user end, not the product end. It would be terribly insecure if their passwords were just automatically input every time someone on their computer opened a login screen.

> ...the chances of someone breaking into her physical house for it are pretty slim

I find this to be quite an under-represented opinion whenever I encounter password security discussions. How many people's threat models need consider physical security of their house? Surely most people's number one - if not only - threat is using a compromised service, so a password manager is just another vector; albeit one whose raison d'etre is security.

Also, petty thieves just don't care about your book of passwords. Just like they don't care about seeing if your hard drive is unencrypted when they steal your laptop - they just pawn it off.

Of course, the ideal for security is that the best options are so convenient that you might as well do them. But there sure is a lot of circlejerking that happens when someone is exposed as "doing it wrong."

I fully agree with you and it's nice to see that someone else is thinking pragmatically and not ending up arguing over three letter agencies.

If your machine with the password manager gets pwned then it's probably game over, and you can do that remotely for a networked device. So at the very least it's reasonable to compare the physical security of a paper notebook and a computer.

Yes you might have encrypted the device but as everyone is so fond of saying 'once you have physical access it's game over anyway', so by that logic the notebook and computer are as secure as one another as they both rely on physical security. Maybe the computer is even less secure as you can attack it over the network!

It's important to plan for disaster recovery though. That's probably a more reasonable fear - something like fire or accidentally spilling coffee over the book would be pretty bad. Maybe a backup copy in a waterproof fire safe would be a 'good enough' solution for priority accounts like email from where you can probably reset/recover all other accounts.

My approach is that anyone breaking into my home could do far more damage, and I'd have far more to worry about, than taking my passwords -- ultimately, nothing I have electronically is valuable/secret enough that someone is going to specifically target me and break into my house to try and gain access. Having a paper copy of my master password isn't much of a liability in that threat model (and probably makes me more secure day-to-day - I can use a longer, more complex master password without the fear that I will forget it and lose access to everything).

I tried to convince my father to use a password manager and tried to explain that using the same 8 letter password for 75% of services is incredibly risky, but i got so much resistance from him .. in the end he wanted me to send him an article on why a password manager would be good. When I looked for something I could send him and thought about what I need to do to help him transition to using a password manager I realized that even though there are great services out there are I don’t want to be responsible for messing with his current way of doing stuff. So I let it go.

I use keepassXC (actually MacPass, which is brilliant and has an HTTPConnecter plugin that can talk to the Firefox addon keepasshttp) and it works great. Maybe not as fancy as 1P etc but free and open source. On iOS I use MiniKeePass which also works well.

This is the setup that I was going to suggest to him. Personally I find it not that complicated, just needs some time to get used to the routines.

Just make sure that the MacPass implementation of that HTTPconnector isn't listening on 0.0.0.0 by default.

Some implementations do and it has been patched in the main repo but didn't make it out to all users. Communication from KeePass/MacPass to the browser is just over http as the name suggests so passwords are sent in plain text and can be sniffed over the network.

If it's confined to localhost then you're fine as it's as secure as not having a compromised device in the first place.

> In 25% of the cases it does not save e.g. the username correct. Explaining my parents how to open the app, edit the login, etc. is just not gonna work.

Can you explain this issue a bit more?

I use 1password, and I would be very angry if it randomly did not record my input data correctly. Yet, it's been flawless. Whether it's a username, a custom data field, an email, a site, a custom password, etc - it has never not recorded a piece of data I gave it. I'm on OSX, Windows and iPhone.

Is there an issue here I should be aware of? Because not recording data is a big, big deal..

This usually happens to me when I do a reset password flow for a login that was previously not in 1Password. 1Password then saves the password, but not the login. It also happens sometimes when the password entry is on a different page from the login entry field. A third scenario that sometimes occurs is when a website mangled what was put into the login form before field submit (this usually only happens with ISP provided routers, but have seen other cases).

I just discovered today, looking through 1Password's "weak passwords" section, that 7 years ago I recorded a password for one "Optumhealthbank", and the recorded password was

  ****

My best guess is they used JavaScript to replace the contents of the text field before submission. Thankfully I've apparently never needed to use this password.

That said, out of 1000+ saved passwords, this is the only case like that I've seen.

Yeah, I think I could count the number of times that one has happened on one hand in the past decade, but it definitely has happened enough I remember it.

When you fill in a username/password combo and it pops up offering to save it as a login for you, it just doesn't know that there's a username field.

When you revisit that entry in the future. Like possibly the far future when your one-year-long session finally expires, you'll find out you only have a password.

Pretty bad UX. The popup that has [Cancel] [Save] should just show you the username and blotted out password for you to confirm.

I have a few entries where I was so paranoid that I said fuck it and copied my password right into the name of the website entry. So I'm wondering if there's a case where it only saves the username and not the password because it doesn't detect it? I just haven't registered for a website in a long time so I only remember the one case.

If you haven't encountered it, you're just lucky or, more likely, haven't yet noticed. ;)

> If you haven't encountered it, you're just lucky or, more likely, haven't yet noticed. ;)

3rd option, I don't use that feature :)

I create all my passwords before registration when I need them. So that's the weak point it seems. Hell, I don't even have the browser plugin installed.

I think 1Password's issues are a UI issue. I've been using it for years and I still sometimes can't find the "Edit" button when the app is full-screened because it's so far away at the bottom.

Also, the 25% failure you speak of is why I don't trust it at all. All it takes is one time where it doesn't save your username and it becomes useless.

So I just open it up and create entries manually. Which is fine for me but exactly something I wouldn't expect everyone to do since the app trains you to depend on its autosave.

I think a few UI changes would go a long way. I have a mental list and wish it would be worthwhile to build my own, as every developer likes to think. But in reality it just feels like a list of minor features/tweaks they can add eventually.

The most layman friendly thing I've come up with for parents/wife/kids/etc... is Safari on a Mac + iPhone using Apple's built in keychain manager. That's an insanely expensive solution compared to password management software though.

Every password manager has broken/buggy autofill on at least some sites. It's a really hard thing to get right, and the developers are always one step behind the changes that are made to the sites.

I’m not sure about family friendliness but I’ve basically moved to letting 1password and the iOS password manager coexist. iOS manager is basically fulfilling the role of cache + autofill from keyboard.

I've heard Dashlane is more "grandma" friendly (albeit at the cost of some security).

As a dashlane user, these UX problems still apply.