Comment by PaulHoule

5 days ago

"Password manager you trust..."

Not so easy.

I've worked at places where we use a password manager to manage lots of passwords for random services that we subscribe to. The engineering manager always says "you can put your own passwords in for free" and I say "no thanks, they're going to get hacked" and then six months later... they get hacked.

I use the password manager on my iPhone because it seems pretty secure and it is so miserable to type passwords in on a phone but my other solution for passwords has used cryptographic generation with the database playing only a secondary role and it is fine for passwords but does nothing for passkeys.

29 comments

PaulHoule

Reply
jjice  5 days ago

The idea of keeping my passwords in my work-sponsored password manager just sounds absurd. Who thinks that's a good idea? What happens when you leave the job?

  • zchrykng  5 days ago

    My workplace doesn't offer this, but I like the idea of how 1Password does it. If your workplace has a business account with 1Password, each of the business users gets a personal account for free. If you change jobs you can pay for your own account, but it isn't tied to the company account other than getting it for free with the corporate account.

  • john_strinlai  5 days ago

    it's work-owned or work-managed accounts that get stored in a work-sponsored password manager.

    most will come with free personal accounts for employees, if they want and choose to set them up. those are separate, and have smooth offboarding for the no-longer-employee.

  • newsoftheday  5 days ago

    What I did was use usernames on those services that included a few chars to remind me which business I'd created it for. I was a software engineer bug changed jobs/contracts on average about once per year (that's a very, very rough average though).

  • wastewastewaste  5 days ago

    eh the companies account for that. for example 1password basically gives you a "free" extra personal account if you enroll into a work account. and when you leave, you just keep the personal account.

    "free" because im not sure if your employer pays for it or if its like a free benefit to a bussiness licence

    • mentalpiracy  5 days ago

      I deployed it for our company, I can confirm for you that as of this post, the personal account is a free benefit to the business license.

blackcatsec  5 days ago

What you describe is a different attack surface than the much more problematic on that password managers solve well: password re-use across websites where the blast radius is super high.

If I had to trade off the risk of a password manager being hacked versus password re-use, I'm going to strongly recommend to people generally to use a password manager. Yeah there's a lots of "if this, if that"--but that's almost a universally better risk for most people.

qbane  5 days ago

I think this part is where TOTP's 2FA/MFA model is "safer": you do not need to trust the TOTP manager. Even if the app sends all your TOTP secret keys to the server, they cannot hack your account because your password is stored elsewhere, and TOTP code alone is useless.

waterTanuki  5 days ago

>I've worked at places where we use a password manager to manage lots of passwords for random services that we subscribe to. The engineering manager always says "you can put your own passwords in for free" and I say "no thanks, they're going to get hacked" and then six months later... they get hacked.

There is heaps of context missing from this. Did the password manager itself get hacked, or did an employee leak a password for a single site that didn't use 2FA ?? The former strongly solidifies your point, the latter undermines it, and to be clear I don't think it's a good idea to use an employer sponsored password vault either.

wastewastewaste  5 days ago

which password manager were you using that it got hacked?

  • zbentley  5 days ago

    Not GP, but I've seen this happen a few times with $work managed password managers. From memory and in no particular order, the reasons for the breach were:

    - User account with access to the SaaS password manager was compromised.

    - User account with access to the SaaS password manager was compromised.

    - User account with access to the SaaS password manager was compromised.

    - Password safe file (keepass) was compromised/leaked and its (medium-strength) master password was presumably brute-forced.

    EDIT forgot one:

    - Password manager was used by a user-facing web backend, which unlocked it with an unscoped read-everything master password. Web backend was hacked, predictable consequences ensued.

    • mentalpiracy  5 days ago

      These examples are very different than your provider being hacked.

      Ideally you should be isolating your passwords across the company so that one user doesn’t compromise every login, no?

      3 replies →

Capricorn2481  5 days ago

Aren't password managers like Bitwarden essentially zero trust? Even if they hacked the entire database, what would they do with that?