Hacker News Reader

Comment by 2Gkashmiri | Hacker News Reader

i have been a hardened user of keepass and it is strange to find people who "HATE" the idea of keepass over anything online, bitwarden or lastpass or 1password or whatever BS "zero knowledge backup" or other nonsense. you dont need to have LIVE SYNCING for your passwords.

i have a keepass on my laptop and its copy on my phone. if occasionally i have to update anything, i do that and copy the file to the other place. say i update on the phone so next time i just share the file to the laptop and i am synced.

this "janky" method has worked for over 5-7 years now without any problems so i dont understand why anyone wants to "keep live sync" enabled for such things and have to pay someone for the privilege and then have to wait for them to get hacked. nonsense

View on HN

Why don't I want live syncing between my phone and my laptop? I use my phone quite a lot despite my laptop being within an arm length or two. Having new passwords accessible between them seems like an obviously useful thing.

I keep the file in dropbox so it syncs to all the devices.

good for you. are you worried a threat actor would hack your dropbox and steal your keepass file and break your password? probably but that would mean keepass has been broken, something that hasnt been the case so whats the problem?

And if that was the case wouldn't same risk profile apply to something hacking the file from your device?

Dropbox famously worked with the NSA sharing both encrypted user data as well as decrypted user data...

I would not use them for anything sensitive ever.... But you do you I guess

sure. where do you draw the line?

mind- your own mind/post-it notes- you forget and you loose notes

offline- keepass- works. is safe. has not been broken

online- whatever SAAS- works but only pinky promise of being unhackable- can leak from beyond your own control.

your keepass could be hacked but they would require access to your device. you have control over that. you do not have control over lastpass servers

best to use what is the most secure. your own brain?

>are you worried a threat actor would hack your dropbox and steal your keepass file and break your password?

I keep a copy of my password file in Dropbox, as one of several backups.

(The file, to begin with, is GPG-encrypted.)

I keep my passwords in my head. This has worked for over 30 years.

I get downvoted every time this comes up but meanwhile y'all are upthread arguing over the finer points of keeping your digital list of passwords in the cloud or on a local drive. I thought minimizing attack surface was the name of the game?

My passwords are all unique and contain plenty of entropy and memorizing them was not actually very hard. I also memorize various phone numbers, email addresses, important dates, etc.

Maybe google has wrecked your brains, but I suspect this technique is more accessible than you think. Or are you arguing that it's less secure?

As someone who started out at a help desk, this method definitely doesn't work for people for some unfixable reasons:

- people forget

- you can't remember dozens of passwords without a system, and having a system is bad, and almost everyone has dozens of passwords

- this still doesn't help you when a provider (like your ISP or credit card company) is hacked, and since you're probably using some kind of system or the same password in lots of places for ease of memorization, you're hugely at risk

These discussions basically end up speedrunning to "everything is a magic link email" a la Slack (once you filter out the mob pushing their fave password manager), which more and more services are moving to. It's nice because:

- you don't store passwords

- you have no password recovery flow (or, you could also say you only have password recovery flow, but your users never actually set a password)

- your users can't forget their passwords

- it's pretty much just as secure as your email, which is probably gmail, which is fine

I think you get downvoted because your method isn't broadly applicable. I don't doubt it works for you--and I'll side note that I'm old enough to remember actually remembering things like phone numbers and what-not--and that we could all probably use some practice remembering. I'll also say that it's probably the case that most "accounts" are just to harvest your email address to spam you or track you and sell your info to marketers, so a system with some built in back pressure on adding an account is useful in that sense. But if we geek ambassadors go out there and tell people "just remember dozens of passwords or you're asking to be hacked" we're inviting them to spend a lot of time with customer service and in forgot password flows.

Your assertion that you need a "system" to remember multiple passwords is simply false. In fact, I generate passwords with a random generator I wrote in python, just like any software "solution".

You did touch on one of my secrets, I don't maintain hundreds of superfluous "accounts". I'm not going to count them, but I suspect I'm at around 30. If I don't log into a service for a long time then I just go ahead and transition that to "never" in which case it doesn't matter if I remember the password or not since it's clear I don't need that account anyway.

I also use unique logins and emails with each service which I guess is even more to remember.

For throwaway accounts and things that really don't matter I use an easier to guess (and crack) leetspeak pw and/or a post-it note.

I suspect people who are not techies have even fewer accounts to remember so this may actually work for many (though I agree, not all) of them. Probably more than you give credit. In fact I assume that most non-techies are simply keeping credentials in their memory in which case the best advice is probably just to remind them to use unique ones, at least for their email and their bank...

I've also worked help desk and no one ever called to report that everything was hunky dory.

Anyway, I appreciate you taking the time to address the issue rather than just leaving another drive-by downvote.

Yeah I mean, there may be a goldilocks zone of sophisticated enough to remember 30 random strings of text but not sophisticated enough to need to remember 300 random strings of text, and yeah if it works for you that's awesome (I keep thinking I'll try and get my memory back to where it was when I was in college, but I keep forgetting to do it!! :P)

And yeah I think the big bad we're working against is people using the same password (or a password with some very small variations that's super easy to guess from a variant) across all their services. I'm sure almost everyone does this, I even know sophisticated engineers who do it, I also do it for accounts I don't care about. "Use a password manager browser extension" is the easiest thing for us former help deskers to tell people, and as long as that person didn't choose LastPass (which you should never have chosen, how many breaches will it take) they'll be in great shape.

So you’ve memorized multiple hundred passwords of high complexity and uniqueness? I’m impressed if so but kind of doubtful.

So you log into hundreds of unique accounts each month? Why?

Maybe not every month, but having hundreds of unique accounts is quite trivial to do. For example I manage dozens of accounts for friends and family for a variety of reasons. The fact that I don’t log into these accounts every month makes it even harder to remember them.

“Just have less accounts so you can remember your passwords!” is not real advice

I'll warrant that if you have hundreds of accounts you rarely log in to then it may behoove you to record them somewhere. However in this case I'm not sure a password vault is superior to just keeping them on an encrypted volume on a thumb drive. And I'd still argue its best to keep these rarely-used credentials siloed from your day-to-day passwords, especially if they're being held in trust for someone else (really each client should have their own silo).

That’s a good point about siloed credentials, I honestly never thought about that.

However I’d say give that the password vault is open-source and can be self-hosted (like Bitwarden) there are many reasons to use it over an encrypted flash drive. It can be automatically backed up easily, is supported on every device (including mobile) via a web browser. It also includes useful tools like a configurable password generator, versioning, and auto fill. For the average person that is much better than an encrypted flash drive volume, which IME are platform locked (LUKS doesn’t work on Windows, Bitlocker doesn’t work on Linux), are much less convenient, and are much more fragile.

Of course, use whatever works best for you, I don’t know your situation.

Sure, but for passwords you rarely use the added convenience of things like autofill seems less impactful compared to the added attack surface.

Not the person you're responding to, but: My keepass database has over 250 entries over the last decade. There's no way I could remember a unique password for each entry.

If you could explain how "monthly" is relevant to the discussion, that'd be great.

I’m a happy user of 1Password for Families, which I only mention since it means >1 person is storing in our vaults (and 1P isn’t as vulnerable to “my backup has unencrypted URLs stored in it” — one of my main issues with LastPass’ latest breach).

Like you we have TONS of credentials (and other supported items), around 2800 vault items in total, some of which we definitely only use once a year, others we use multiple times per day. Probably started using a password manager and some technique to share some vaults around 2010, so also a decade.

> "... around 2800 vault items in total... "

This is absolutely insane to me.

The number of people reporting needing access to multiple hundreds or more of required credentials is blowing my mind. If this is the reality of how people are using the internet these days then we desperately need a better cross-platform solution to identity management and authentication than can ever be offered by passwords. These vault programs are sounding more like a horrendous bandaid than the mere unnecessary convenience I viewed them as.

If you need to share passwords amongst multiple people I guess I can see some of the appeal of these networked vaults, but it strikes me that even this is a drastically subpar situation that ought to be handled on a deeper architectural level (like with sub-accounts and ACLs).

> This is absolutely insane to me.

What's absolutely insane to ME is how consistently your responses seem to ignore that other people have different use cases for passwords. Nobody cares if something seems "insane" to you. It may surprise you to discover that services like these exist, perhaps, because people interact with passwords in a different way than your "I only keep passwords that I use monthly" brain database paradigm.

You can't seriously be telling me that managing 2800 secrets for a single "family" isn't evidence of a broken system. Unless GP is doing IT for the actual mafia I stand by my assertion that this is nuts and we ought to consider whether there's a better paradigm we could be pursuing.

To whoever is reading this: I am not doing IT for the Mafia. ;)

I mean, this is all apples and oranges, but if you could, examine your browser history across all devices as a household going back let's say 10 years. Lots of sites, right? How many did you ever create an account on for whatever reason? Are those all in your vault today? They essentially are for us. To the very best of my knowledge (and there's functionality in 1Password to analyze this, obviously anything not in vaults is invisible to it however) we have no duplicated passwords, anywhere on the internet.

To give some examples of how we do use 1Password, in terms of "Online Shopping" (just one of our shared vaults) that has 100's of credentials for everything from Amazon through Walmart and covering whatever we buy online from groceries to ammunition. Tons of more specialist or niche suppliers like Christmas Designers also make you 'Create Account' to have order histories and to be able to track shipments - this one in particular is a great place for garland, lighting and other holiday items, tis the season!

1Password also stores all our rewards programs (i.e. Store Cards, Airline, Hotels). I'd guess we are signed up with 40-50 merchants for some kind of "Rewards" (i.e. Fred Meyer or QFC, and where the ROI for signing up for their program is some items will be $2.49 instead of $4.49 on offer). I have traveled a lot for business and so can't always fly one carrier alliance or stay entirely within one hotel chain, so I guess that's another ~20 (airlines) and ~20 (hotel chains) for you.

I'm not going to memorize software licenses (serial numbers or license files for e.g., Bartender for macOS), nor other access tokens (i.e. SSH Keys, API Tokens) to various geekery.

Two other things which end up helping a lot, one of which adds lots of vault items: the integration story with Privacy [1] and Fastmail [2]. We've used and loved Privacy for a long time, and this integration stores the unique per-merchant credit card details in a vault. With Fastmail you can create 'Masked Emails' so you've got a unique email for each place you signed up. We've easily rotated both card details and emails on accounts when we find out someone was compromised, and with these integrations we're only rotating that site, not potentially 100+ sites using say the same Chase Sapphire card.

So, your own approach may vary, and I see from other comments that you memorize all your accounts (?) and commented on the frequency of access ("monthly") being relevant to you, so I'd assume frequency/recency plays a part, and you duplicate credentials for less important sites or rely on 'Forgot Password' functionality for less used sites? How do you deal with accounts you didn't need in the last 60 days? In any case, 1Password works amazingly for us, and quite a large number of our friends too, although anecdotally they've usually got 100's not 1000's of items in vaults. :)

[1] https://blog.1password.com/privacy-virtual-cards/

[2] https://1password.com/fastmail/

"sub-accounts and ACLs" sounds just as awful to me, if not worse, quite honestly. Imagine managing an "Account" at each of 100's of online merchants and other sites like Netflix, where each has >= 1 "User", and "ACLs" (permissions).

I am entirely happy for my family to just have access to the Amazon or Netflix email addresses (logins) and passwords without any of that overhead.

Monthly is just a simple test to see if you're actually using these accounts. I'd say start by reconsidering if you need these accounts at all and if you decide you do, go ahead and keep them in a software vault. But I still recommend keeping the ones you use once a month or more in your head. It will be more secure (and possibly more convenient) and if you are using them this frequently it will also be easy to remember them. I'd also posit that these frequently-accessed accounts are likely to be your most important ones, deserving of a little extra security.

Over 20 years, probably.

I do the same. I have iterations written down in a safe but my family will have a hard time accessing my digital identity when I’m gone

How many?

Around 30.

That’s too few to be secure by about an order of magnitude, for me

Glad that method works out for you. Fortunately for the rest of the world, technology has progressed far enough that Password Storage is a solved problem.

I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things. Some people would rather entrust a reputable service to handle the very menial task of managing their passwords for them, rather than go through the hassle of doing it themselves.

Not only do these services provide better convenience, they make you more secure! Many people reuse the same password, so when a site gets "owned", any site using that same password is now compromised as well. Some of these services will even automatically tell you when a site gets "owned" and offer to change that password for you retroactively.

Now, if you want to go ahead and use a local only method, be my guest. But please, don't ever suggest to anyone else that they should do the same, that's just bad security advice! By the way, getting hacked in the password manager does not mean all your passwords leaked. It just means some extra metadata about you may get discovered, which I'd argue is a reasonable trade-off.

What on earth are you talking about?

There is no universe in which having a local encrypted key vault that is not online and not synced to the cloud is less secure than having a cloud synched version of the same thing.

There is literally no way that can possibly be less secure.

So if your argument is that the convenience of it makes it more secure … I dont know to say except:

you’re wrong.

> Not only do these services provide better convenience, they make you more secure!

Nope.

> By the way, getting hacked in the password manager does not mean all your passwords leaked.

Nope. That’s not what it means. It means your encrypted vault was leaked, which includes your passwords, if they bother to crack it.

> which I'd argue is a reasonable trade-off.

Well, at least it’s fair to say you saved that as an opinion; fair. Other people probably agree that the security risk of using an online password vault is worth the convenience of using it.

Fair.

…but, fundamentally less secure.

Anyone who chooses to manage their own passwords, offline, is choosing a more secure, less convenient alternative.

I think that’s fair too; and, given number of hacks to lastpass, okta, etc… not, perhaps, terrible advice.

You don’t need cloud synced passwords.

You just want that, because it’s easy.

You could get robbed of your physical key. simpler than an actual burglar. however they could not even do an autopsy of your brain to recover your cloud keys.

I don't feel too strongly about this, just replying since you were being an absolutist.

If they can rob you they can also use the 5$ wrench attack to force you to give up your cloud password manager master password. So even in that case having a local vault is at least as secure as a cloud vault.

https://xkcd.com/538/

What I like the most is offline relative to the Internet but online when it comes to my LAN and when I want to. Like 1Password in the good old days.

I'm lol'ing cuz "Password Storage" using keepass is indeed a solved problem.

>I think it's very typical to think of HN users to think of the average person as tech-savvy enough to do what you're doing, but they aren't. People are fallible, people forget things, people lose things.

this should be taught in schools if that is your concern. what i am doing with the "manual sync" for files is because i have 2 machines i want to get my passwords. there is a HUGE population who only have a phone. for them, keepassdroid or some other keepass app is the only thing that they should ever need or use. i know because i have set up the files for my family members, they only have their phones at hand and the file has served them well for years without any problem.

now they "whatsapp or email" the file to themselves or to me if they have to change their phone and get it back in a matter of minutes. this is not as big of a deal that you need to have online tied system and be a techie otherwise

If I only had a phone, I would definitely want live sync, so I had a chance of recovery if my phone was gone. Keepass isn't even something I'd consider.

I'm not sure what you're referring to that should be taught in schools. The problem of forgetting things is often "human error" not "pilot error", a random packet loss of the mind rather than lack of skill.

There's strategies to mitigate it, like always leaving the house with the same set of items and never changing it up, and avoiding situations where you rely on memory, but live sync is going to prevent a lot of mistakes.

The threat model of storing passwords in an encrypted file with live sync is gonna be smaller than only keeping it in one device. Yeah you are at more risk of getting pwnd but at almost no risk of losing your passwords. Your phone dies and you lose everything. And if you send your passfile through a convenient service like whatsapp or telegram you risk your data also getting leaked through them without the benefit of live sync.

But doing password saving and live sync through a third party service it's pretty crazy to me. Why not split the threat? One program to store your passwords and one service to sync them. I use keepass2android and keepassxc with my own file sync server as sync method. If you don't want your own server you can use a multitude of third party ones.

What should be taught in school is to store your passwords in a secure way just like any other important real life skills like doing your taxes, basic eating and physical health, etc.

The trouble is losing a phone is probably just as common or more common than getting hacked, and keepass sync is purely manual.

I suspect the most secure way to store passwords is in your Google account, because they have a far higher budget than almost anyone else. They will spy on you, but they also keep random hackers out.

I use BitWarden (with gmail as the 2FA) instead because I wanted the ability to try different browsers, and I like being able to store other bits of critical info in my vault.

You generally can't get hacked on anything important unless you already lost your phone, even if they have your password, because of 2FA.

You also don't lose your account if you lose your phone if you use SMS 2FA like most people do even though it's not perfectly secure, because your cell carrier can recover your number.

Reply on news.ycombinator.com