Hacker News Reader

Comment by teeray | Hacker News Reader

Does this provide any benefit over a (properly used) password manager?

I’d be happy with just:

- an “alphabet”, “minlength” and “maxlength” attributes on password fields so password managers generate perfect passwords every time

- a well-known URI for password managers to do zero-touch password rotation.

- actual elements for login components to close the confused deputy attack for password managers.

All these things would be much easier changes for crufty old sites to make, which would aid adoption.

View on HN

If you're copying passwords out of a password manager and pasting them into password fields, then yes, you're getting a significant improvement to phishing protection with a hardware key. If you're using the password manager's autofill feature, and that autofill feature is bug-free, then you're not getting any additional phishing protection.

Your passwords can still be stolen, however. Any hardware authentication mechanism is going to ensure that no matter how compromised your local machine is, the worst an attacker can do is steal one active session. They can't steal the secret required to initiate any future session.

If the password manager stores the requesting site with the secret, either manually or through TOFU, then it has an opportunity to provide better phishing protection than manual copying.

This is how Android Password Store [1] works, and it regularly triggers a phishing warning (that I have to override with multiple taps) when I'm trying it out by attempting to autofill a password for one app with the password associated with a different app ID.

Granted, I also use it with my Yubikey, because that's what holds the GPG decryption key.

[1]: https://github.com/android-password-store/Android-Password-S...

First you need to invent a password manager that can be properly used? The one I have runs on my computer and trusts everything else I've ever installed not to have put in a mechanism to observe memory allocated to my browser.

Is that how most credentials are stolen these days?

Most attacks are social engineering. Everything else, to the best of my knowledge, does not target passwords

The biggest attack is persistent login tokens that are stored on a device, eg. Discord has an issue with malware (disguised as DMs from random people asking "do you want to try out a beta for my game") that steals the login token from appdata, using it to purchase a bunch of gifted nitro and perpetuate the scam via that user's account.

Users opening shady attachments or going to amarzön.se and logging in are probably 99% of cases.

A keylogger can take my password but a Yubikey can not be copied.

Reply on news.ycombinator.com