What do crypto & network pros think of lastpass, keepass, 1password, et al? | Hacker News Reader

What do crypto & network pros think of lastpass, keepass, 1password, et al?

quora.com

41 pointsniels_olson22 comments

For what it's worth, Bruce Schneier says use one: http://www.schneier.com/blog/archives/2009/08/password_advic...

It's not clear to me if he likes the web passed browser plugin method. He seems to be talking specifically about small utility applications that perform the service. Though presumably these connect to a server for syncing.

Would there be any additional security hazard from using last pass and it's plugins verses using a password manager that's not integrated into the browser?

I avoid browser-integrated password stores.

The attack surface is larger than a standalone app; your browser is a popular (and historically ripe) target; your browser sees lots of untrusted input from third parties; you manipulate sensitive data with your browser.

Actually Schneier wrote one: http://www.schneier.com/passsafe.html (now OSS)

I use one (actually three) but it's not a good solution for everybody (what is?). Mostly the pros/cons are obvious but two less obvious risks: * Beware the clipboard * Don't forget the vault passphrase...

(I'll sound like a 1Password fanboy in this thread but so be it)

I'm not sure that's what you mean by "beware the clipboard", but 1Password actually clears the clipboard some time after you copy a password to it. In my case, it doesn't really help since I'm also using a clipboard history through Quicksilver…

As for the passphrase, this can be a problem. I was planning on regularly sending my list of password to my close family but never got to it yet.

> what you mean by "beware the clipboard"

It's not that long ago that certain browsers would give up your clipboard to any site that asked for it.

IE: http://www.securiteam.com/windowsntfocus/5CP0C1F61O.html

Similar (attacks paste), for FF: http://www.digitaltrends.com/computing/firefox-clipboard-hac...

Some managers (e.g. KeePass/KeePassX) have a feature where it will clear the copied username and password from the clipboard after an ellapsed period of time (say, 15 seconds). What's great about this feature is that it still preserves the rest of the clipboard history.

The best way to avoid losing the vault passphrase is to make it a strong, rememberable password and move the passwords within the vault to randomly generated character strings (where sites permit it, there are a frustratingly large number of sites where certain characters or lengths of passwords simply do not work). That way, you remember only one password.

The biggest issue I've encountered with over a year of daily use of a password manager is making sure you can access the password database file consistently. Having the file on Dropbox is no use if your Dropbox password can only be fetched from the password database! So, always always always keep a local copy somewhere just in case.

I can't "think of" them, because I have no experience with these services. Here's why:

* I generate random passwords 12 characters long unique to every site and write them down on business card stock which I keep in a reasonably secure place. They fit in my wallet with my money for example.

* Usually I don't even need to carry them around. Since the plaintext password and login session cookie must be handled in the clear by the web browser anyway, I just use the browser's built-in password manager. Mobile devices remember credentials too. If your browser is pwned, your login session is pwned, Zeus has proven this.

* I use a separate web browser in a separate OS image for online banking and purchasing things online (anything involving money).

This system works adequately for me. Therefore, giving passwords to a third party appears to me to add an unnecessary risk.

I fully admit that my system is unusual (I work for a multi-factor authentication company) and many people may be better off with a password management service.

There is an excellent Podcast available where Steve Gibson (security expert) talks about LastPass and it's internals - audio and transcript are here: http://www.grc.com/sn/sn-256.htm

That's funny. Steve Gibson as an expert. He's a quack.

http://www.theregister.co.uk/2002/02/25/steve_gibson_invents...

see, that's good to know. I was hoping for expert opinion (grad student, some years as a successful consultant, etc)

dcreemer has the right idea. Schneier is the real deal. I usually listen to his advice.

8+ points for a question that hasn't been answered. Odd.

As the asker, I'm thrilled. I really hope the smart people here will share their thoughts. I would put a monetary bounty on the question if I could.

It's a bit of an abuse of HN though. Oh well, hope it gets some good answers soon either on quora or here.

>It's a bit of an abuse of HN though.

Really? Why?

Nothing major or egregious. Just by presenting it as a quora post I was expecting to go there and find answers already there. At least if it was an Ask HN, people would understand to not expect an answer. I'm not sure HN is meant to be a place to "advertise" like this. But in the end some good answers/discussion was generated, so it's all good.

I put the question on Quora, since questions are what Quora's for, but I really hope folks here will share their thoughts (tptacek, et al). I'm hoping to these questions help gather up what is known about these services' tactics, techniques, and procedures, and how those compare with best practices.

awesome question, does anyone know if there is a feature grid of all/some of the apps within this market? One thing I am interested in is accessibility with mobile devices and how quick the mobile devices that are there are updated.

I used to use PasswordSafe on the desktop with the file kept in Dropbox but there didn't seem to be an Android version that allowed writing to the phone so I switched to KeePass on the desktop and KeePassDroid on the phone. Unfortunately KeePassDroid doesn't work with the 2.x version of KeePass, so I have to use the old version on the desktop.

To be clear, the file format for Keeppass 2.x has always been different from 1.x, and then just this past April, they released 2.15 which is a slightly different format. from the previous 2.x version.

KeepassDroid is updated to read the 2.15 format.

https://market.android.com/details?id=com.android.keepass

What's in this version: Support for KeePass 2.15 database format changes.

UPDATED: April 11, 2011 CURRENT VERSION: 1.9.2

I use 1Password and their mobile and desktop apps can use Dropbox for sync. I've never had a problem with it.

Reply on news.ycombinator.com