Hacker News Reader

Comment by andrewaylett | Hacker News Reader

Something I've not seen come up yet: a password manager that's integrated with your browser is a good defence against phishing.

Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all. This is fairly similar to the "trust on first use" that SSH gives you, which some folk were wishing might have existed for SSL certificates the other day.

Unfortunately some sites require you to "log in with your ... credentials" rather than doing SSO. But you TOFU those, too, once you've verified they're legit.

Happy Bitwarden user here: the software is all Free, but I trust the company to run their servers securely more than I trust myself to, so I pay them to do so. Extra benefit: if I lose all my infrastructure, I haven't lost my passwords.

View on HN

> Extra benefit: if I lose all my infrastructure, I haven't lost my passwords.

I just dump the SQL database of Vaultwarden and have that as a backup (it's encrypted). I've verified that a new Vaultwarden instance can be spun up on any Docker-capable machine quickly, the SQL file just needs to be mounted in and named properly. So it's a very localhost-friendly backup with no 'infrastructure' requirements. It can be up in minutes.

I suppose you're not saving attachments.

I am, these are in a separate directory that needs to be treated analogously. It's also pretty painless. Still, if you just want to save your ass, the DB is probably what one is after.

I agree with everything you've written here, but while all good points, they're really more about convenience -- not trust.

_Why_ do you trust Bitwarden?

I also use BW btw, but I don't have a good reason as to why they're trustworthy, and will probably run my own server someday.

I would argue it is trust. I trust my password manager to validate the website I am entering my password into more than I trust my eyes. I know that I can't be perfectly vigilant every single time I enter my password. The risk of the password manager betraying me is roughly an order of magnitude below the risk of my falling for a phishing attack.

Plus I use the password manager baked into my browser, so I'm basically trusting it anyways.

I trust it (in my case 1Password) because it’s a company that happily makes money from that trust, and if were to be insecure or the trust wantonly breached, they would cease to exist. Their motivations align with what I want them to be.

> because it’s a company that happily makes money from that trust

You could also say this about Microsoft, except they've been breaking such trust for a long time.

That's a pretty obviously bad take. You're comparing a company whose single product is about keeping one kind of thing secure, and another company that makes dozens of products, most of which don't explicitly have to do with security.

I’m not an expert by any means but I have a layman sense that keeping Windows safe is a way more gargantuan task than keeping an encrypted vault safe inside my computer (before 1password moved to this cloud nonsense to milk subscription money).

If my windows is compromised no amount of tech wizardry can protect my 1password credentials.

Microsoft exists in an effective duopoly for desktop computing - the vast majority of desktop computers run Windows, and only a small fraction run MacOS, and an even tinier fraction run anything else.

That, combined with a host of other lock-in factors (the strong emotional attachments that people have to being a "PC person" and not a "Mac person", the relative expensiveness of devices that run MacOS, the software that only runs on Windows, the UX difference between platforms) put Windows in an entirely different class than password managers.

Password managers are a commodity. Operating systems are not. Microsoft knows this, and they abuse it accordingly.

Lastpass made money the same way, and look at what happened to Lastpass users.

Yeah but anyone could tell LastPass were extremely lax as a business, their software has always seemed poor quality and their communication is terrible as well. 1Password nails both of these things.

Because it’s a crime for them to make use of the passwords, and I’d be able to claim back any financial loss.

I picked Bitwarden because it’s widely trusted, it’s trusted because it’s open source and widely assumed to be casually audited by many _other_ people. There’s a weak point here in how many of us are relying on others to do the audit, in a bystander effect sense. I don’t think either of these are BW specific, which just shows there’s a large family of wise options.

But so is wordpress. Open source and a lot of eyes can find bugs but not everyone reports

They've published the results code audits and network audits here:

https://bitwarden.com/blog/bitwarden-network-security-assess...

If I'm accessing my passwords via the clients that BitWarden the company distributes, then I'm still putting my trust in the company. Where the encrypted data is stored is in many ways less important.

And the irony is that the one website I can't trust my password manager to protect me from phishing attacks on is the password manager's own web interface. So I always want to log in with one of the non-web clients, and only trust the web vault if I reached it via a known-good link (like the one in the settings panel of the browser addon and mobile apps).

What's the alternative to trusting BW? If it's reusing credentials then you just have to trust them more than any other authenticated service. I'd say that's the model that applies to most people, they're not going to self-host or manually sync between devices.

Why trust BW over other providers? Because of third-party audits and signals of good-faith like open source.

Why trust BW over self-hosting? Well, I don't. Or rather I have more confidence in being able to recover from a failure on my part, nevermind that they're probably less likely to suffer from technical issues.

> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all.

1Password does this.

It also warns if you try to fill on a site that isn't linked (says something like "1Password can't verify that reaibank.com should use your realbank.com login"

> Because it'll only offer passwords for sites that match the entry, defaulting (most often) to being the same domain, if you come across a phish then it won't offer the site at all.

The Bitwarden browser extension does this. When you add a login, it also adds the URI of the website, so the login info and auto-fill will only show up when you're on the same domain. Of course you can edit and add or remove your own URIs for logins. You can also change the URI matching behaviour.

Yes, and this is what I use.

I'm sorry, I misread your first sentence and thought you were saying you hadn't seen any password managers that defend against phishing. My bad!

Yep agreed. I just have a small anecdote. My credentials were stolen when altoira.com was domain hijacked and setup a phishing campaign -- even when using 1Password to manage my credentials.

Thankfully when they restored everything and require a reset of passwords, they offered TOTP 2FA which would provide an additional defence when phishing succeeds.

> which some folk were wishing might have existed for SSL certificates the other day

Isn't this basically what HSTS + cert pinning does?

Cert Pinning is more akin to "trust on zeroth use, only this certificate", HSTS is kind of unrelated since all it does it tell the browser to access the site via HTTPS. If the site is on the preload list all that buys you is the first access must be over TLS.

Pinning is more for the app case, HSTS more for the browser case.

HSTS and pinning (which isn't used on web any more, because it's too much of a foot-gun) help you be sure that you're really talking to who your computer thinks you're talking to. A password manager (or, better WebAuthn) helps you be sure you're talking to the same site that you were talking to when you set up your account.

If you're on the wrong site, all the validity indicators in the world won't help the misidentification. And it needn't even be a malicious site: I auto-fill my work credentials in part so that I don't have to remember which internal tools take which set of credentials. Which isn't nearly as much of an issue nowadays (with more SSO) as it was a few years ago, but that just makes the last few exceptions all the more difficult to remember.

Apple keychain?

If I were an Apple ecosystem person, certainly.

The only problem with that is you have to be all-in on Apple to make it work. I certainly use it on my MacBook, iPhone and iPad, but I also still use LastPass because my Windows machine doesn't know anything about the keychain.

I carefully eviscerated windows from my life. It’s better that way if you can do it.

For some of us, it goes beyond personal choice. We have to consider our families and their circumstances as well. My wife and I could do it...if I worked for another employer (I'm fairly close to retirement and am not expecting to go job hunting between now and then) and if our adult children, who share my family password manager account, would only realize they shouldn't be using Windows and Android (and also had the money to throw out their hardware and buy all Apple stuff).

browserpass for the pass password manager does this

1password does this unless I'm misunderstanding your post.

Yes! As far as I'm aware the "cloudy" password managers all do it.

Reply on news.ycombinator.com