Hacker News Reader

Comment by nprateem | Hacker News Reader

Such a bad password manager makes me lose faith in Cloudflare as a brand.

I totally tuned out that this is a Cloudflare repo. Some Googling turned up a USENIX slide deck that puts this into context:

https://www.usenix.org/sites/default/files/conference/protec...

Whereas the README uses URLs as the realm string, the slides uses realm strings like "root-password" or "ssh-v2" to derive keys from a seed stored in a UEFI variable.

I think the idea is that you can administer all of your servers with one master password, while each server derives different passwords locally from its own seed. If a given seed is compromised, rederive the passwords from a new seed (or reprovision the server from scratch). If your master password is compromised ... well, try not to let that happen.

> If your master password is compromised ... well, try not to let that happen.

Good thing that keyloggers don't exist then... :'(

It doesn't even specify how many rounds of KDF are used in the readme. I really hope it's more than the default 4096. For reference, using KeepassXC, there's a "benchmark" button that finds the number of rounds for a 1 second delay and the number of rounds for my computer is in the 50000000 range.

It just takes one compromised password to start a dictionary based or other offline attack to brute force the master password which would then allow the attacker to regenerate other realms.

It even doesn't matter. Passwords should be regularly rotated and encouraging people to use this opens them up to bad practices since no one's going to rotate all their passwords at once, so they'll never do it.

> Passwords should be regularly rotated

Disagree. I'd even call required rotation a smell.

Requiring rotation leads to people coming up with passwords more frequently, meaning they'll likely choose weaker passwords. On top of that, regular rotation isn't necessary for passwords generated independently by a password manager.

The issue here is that there's no way to deal with revocation / password changes if a service is compromised.

It doesn't matter what you think. If someone's using a service that requires it and the tool doesn't allow it it's no good.

I responded to that in the original comment. Whether or not a service requires rotation (bad practice), this tool won't work (can't handle compromised passwords).

It's 4096 iterations:

https://github.com/cloudflare/gokey/blob/v0.1.0/csprng.go#L2...

If Toyota made one bad car, would you lose faith in the entirety of Toyota?

.....because if so, let me introduce you to the Toyota Mega Cruiser: https://en.wikipedia.org/wiki/Toyota_Mega_Cruiser

Reply on news.ycombinator.com