Hacker News Reader

Comment by nicoburns | Hacker News Reader

OpenID actually solved this problem by letting you use your own domain. Much like email it was possible to have this delegate to a 3rd party provider while retaining full control to seamlessly switch providors. Unfortunately OpenID never saw widespread adoption, and the OAuth based ID we're left with doesn't allow this.

But yes, in 2023 you probably shouldn't use 3rd party authentication. You're much better off combining email/password login with a password manager, which effectively allows you push authentication on a 3rd party while retaining full control.

View on HN

...until someone breaks into LastPass and steals all vaults and you have to hope that your vault used the newer iteration settings. And those are just the cases we hear about because the attackers were careless. Cloud based password managers are simply an unimaginably attractive target for all kinds of threat actors, from individuals to groups all the way to nation states. I'd not be surprised if all the major ones already have backdoors installed - either on purpose with a gag order or even without the company's knowledge. Ironically, a simple text file on a well encrypted USB is probably one of the more secure ways to do this nowadays.

You should use a local-storage password manager, like KeePass.

I use KeePass, but keep the file in cloud storage because I need to log in from multiple places and it's a tradeoff I'm willing to make. I don't want to excuse bad security practices, but in the end I've decided I'm safer with good passwords + cloud storage than I am with possibly bad passwords because I need to retype them all the time.

I feel like this is part of the reason we need real data protection laws in the US. There doesn't seem to be any downside for a company with lax security practices.

Same. keepass with the db on a cloud drive. keepass clients on both laptop and phone access the same cloud copy, and also each keep a local copy.

I intentionally don't let the clients integrate with the browser. I let the browser itself cache the unimportant stuff for convenience, and anything important I always paste from the password manager and have to get a code from the totp app also anyway.

I don't think anyone should use a fully 3rd party full featured password manager like lastpass or onepass.

I would say it is NOT better that they use that vs nothing. 'anything is better than nothing' is not true here. Some things are better than nothing, and some are not.

KeePassXC supports TOTPs out of the box and its browser integrations fill TOTP fields just like they do with password fields. I love that the browser integrations check logins by domain, and shows a popup when it finds one. Manually copying and pasting logins is susceptible to phished domains, even the lookalikes with visually similar/identical Unicode characters.

Maybe I will revisit this policy. Thanks.

Also, you could add an extra key (can be any file, so you would need passphrase+key) and keep only the key offline on each device.

Don't let perfect be the enemy of the good. Many people won't use a password manager at all if it has no cross-device syncing, and that almost always means a cloud implementation. Sure, it's less secure than a pure local-only password manager, but it's way more secure than not using a password manager at all.

That only works if you stick to a single device. If you use many devices or frequently switch between different devices, you'll want portability.

Bitwarden (and the Rust clone Vaultwarden) are both 100% open source and self-hostable. Vaultwarden runs great on an old raspberry pi or any low power SBC. All of the convenience of Bitwarden clients/extensions/integrations but the same tiny attack surface (encrypted db on one local machine) as keepassXC or a text file.

If you know what you're doing, that is definitely an option. But self-hosting is not something I would recommend to the general public. I wouldn't even recommend it to the average person in IT to be honest. If the people at LastPass already manage to screw up the configuration so many times (and they really ought to know better than 99.99% of the population by now), then you can guess how safe it would be íf the average Joe sets something like that up.

KeePass on Google drive with local backup.

> But yes, in 2023 you probably shouldn't use 3rd party authentication.

You misspelled "definitely" as "probably" here.

> ... by letting you use your own domain. Much like email ...

It's getting harder and harder to send email from your domain without being send to spam, bouncing, or the server just discarding your email without notice.

Sending it from your own domain isn’t hard, it’s self-hosting that domain which is hard. If you pay Microsoft or Google using your own domain works well.

I use smtp2go for sending, it's easy to setup your domain with them, and they are free for low volume (1000 emails/month) senders. Emails never get rejected, guess they know their game.

Co-incidentally, we (sqlitebrowser.org) switched most of our stuff to them over a year ago, and yeah they've been hassle free.

Currently using their lowest paid tier US$10/month, as that's 10k emails a month which is far more than we send. At least at this stage. ;)

Wish they'd occasionally look over the PR's submitted to their GitHub repo's though. ;)

eg: https://github.com/smtp2go-oss/smtp2go-go

It is, but OpenID didn't have this problem because requests were always initiated by the other party.

Reply on news.ycombinator.com