7 ms·

On a tangent, has anyone tried using Vault as a personal keyring, rather than using a cloud based password manager? In particular, how much would I need to trus

On a tangent, has anyone tried using Vault as a personal keyring, rather than using a cloud based password manager? In particular, how much would I need to trust each device that runs a Vault instance, if I was concerned mainly about malware running alongside it? Right now, I have everything in Keepass, and no good way to synchronize that between devices. Merging key repos is a royal pain, but mainly, I don't like the idea of trusting everything to an organization that I can't hold accountable. Running my own service on a generic tiny EC2 cluster feels like an improvement, although I would still worry a little about the virtual neighbors.

dbingham 9y ago
Please, someone build an open source solution similar to Lastpass backed by a Vault instance with browser plugins and a web front end to allow for key management. That would be amazing. Lastpass is almost necessary for me to keep all my passwords moderately secure and still usable. But I really do not love trusting all of my info to a 3rd party.
- UnoriginalGuy 9y ago
  > But I really do not love trusting all of my info to a 3rd party. You don't need to. You need to trust Lastpass's design. A Lastpass database is an AES-256 encrypted blob, encrypted using a "slow" hash of your master password (PBKDF2, rounds are configurable). Lastpass don't know your password. When they authenticate you they test to see if your database is decryptable with the password you entered (after it is hashed). If you set 2F then they won't even allow attempts until 2F is satisfied (Google Authenticator is free). Lastpass's biggest weakness is also applicable to this theoretical OpenSource alternative: Javascript. Javascript is delivered from Lastpass (for the browser extension) and after you decrypt your password database, that JS has full access to it. If a "bad guy" is able to inject evil JS between you and them, then they could trivially steal already decrypted passwords. As I said, this weakness has nothing to do with Lastpass, it would equally apply to all password managers which integrate into the browser with an extension. In effect you've exchanged convenience for security. And you can already read the Lastpass browser extension's source code, being more open source doesn't make you immune from this issue. So you can choose to trust Lastpass, or not, but the design is sound. Slapping the words "open source" onto something won't mitigate any of LastPass's inherent design issues, and you'd still want to follow a similar design since it is a good compromise between security and convenience. Coming up with a superior design that doesn't sacrifice convenience would be awesome, but it is a hard problem...
  - heliosAtwork 9y ago
    Sure, it can happen to open source; all engineering rules still apply. The attractive part to me would be that there are more eyes on the code. I would host my own in a google app engine or heroku and avoid a 3rd party who is more attractive to hackers due to the number of accounts they host and potential gain to criminals.
    - kasey_junk 9y ago
      Thats not how many (most?) breaches occur. The situation you would run into (and worry about) is that an exploit is found in the software and then it is mechanized so that things like google app engine and heroku are scanned and user run versions exploited in mass. Open source does not prevent that, only diligent operations do. So by self hosting your are making the bet that you are doing that singularly more competently than the hosted version.
      - heliosAtwork 9y ago
        No, open source does not prevent anything. There is just more transparency. Any self hosting would need to be fully connected with automated update notifications from the "crowd" of contributors and reviewers. I guess, it becomes a managed service at that point (since as you point out it should have reliable and secure production characteristics which does require a high level of competency). I am imagining a cloud of one for my passwords (a stateless, secure container, with disabled user access to the OS and which connects to an encrypted simple file store to keep my small sized but precious passwords).
    - UnoriginalGuy 9y ago
      Just to be clear: I have nothing against Open Source at all. Open Source is great. I was just pointing out that Open Source in and of itself isn't a security protection. If you follow the same design you'll have the same design weaknesses, Open Source or closed. The "more eyes" thing, may be true, but I'd argue popularity is more important than license in determining the number of "eyes." I'd also caution you in assuming an exploit would be against the server side. The server holds a bunch of really hard to decrypt blobs. The client is the real crown jewel. The client browser has all of the usernames/passwords decrypted, so if you were either able to deliver an "evil" extension update, or find an exploit in the existing extension, you could extricate those credentials. That's the real rub: You turn off extension updates and you're more secure against "evil" extension updates; but you're now more vulnerable to situations where a bug is discovered in the legitimate extension and the organisation pushes a real update to patch that. Auto-updaters in particular are both a huge benefit and a huge security hole.
- nucleardog 9y ago
  I don't know what options are still available, but the "3rd party" thing is why I ended up paying $100 or something to purchase 1Password back when it was still only available as a one-time-purchased standalone app. Even if it's open source, I'm in no position to effectively evaluate their crypto/etc. But I can do some basic reasoning about the possible attack surfaces. With 1Password I hold all my data, and the software that I use to view it runs completely independently of anything else. Besides a takeover of my local machine or breaking the encryption, nobody gets my data. With something like LastPass, they hold all my data. The software that I use to view it runs in my browser. The software handling all my passwords is running in the same program that I use to execute untrusted code from the internet thousands of times a day. This has bitten them in the ass a few times. I'd love an open source password manager solution given the turn 1Password has taken towards being a "cloud service", but for the love of god can it please be useful without tying it to my web browser.
AdmiralAsshat 9y ago
The standard advice here is to throw your KeePass vault onto Dropbox/Google Drive/OneDrive, but I agree, keeping everything sync'd is a PITA. It's a problem that needs solving, but KeePass itself is probably not keen on solving it.
- paulryanrogers 9y ago
  Keepass2 actually has reasonably good built-in merging. There are also sync plugins which could help with the cloud provider's own collision copy issues
NikolaeVarius 9y ago
I've been sort of sketching out a system for this in my spare time. Something like a portable container that you can host anywhere and keeps syncing easy. What kinds of other features would you want?
StavrosK 9y ago
I use KeePass2Android and merging works very well with it. It just automatically reads from my Dropbox file and merges any changes.
simias 9y ago
This is probably not a good solution for the vast majority of people but it works well for me: I use pass[0] but I host my ~/.password-store on a sshfs on a server I own. Wherever I need to access my passwords I just mount the sshfs and then can proceed as normal. Since pass supports versioning the passwords with git it would also be possible to use that, just push/pull the repository to keep it in sync. It would also give you access to the password even while offline, but I actually prefer the added security of not copying the passwords over, even encrypted. Obviously if you want to access your passwords from, say, a Windows machine or a smartphone it won't quite do the trick. [0]https://www.passwordstore.org/ https://www.passwordstore.org/
- rkeene2 9y ago
  Similar to "pass" is "hunter2" ( https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/ ) which uses a hardware security module such as a smartcard to decrypt the password and allows sharing between users in a file that can be managed by a version control system (such as Fossil or Git).
  - mysterydip 9y ago
    Hunter2 sounds like a reference to this: http://bash.org/?244321 http://bash.org/?244321 Amusing if true, both dealing with passwords so it's likely.
    - rkeene2 9y ago
      It is. There are several references to that on the page and in the source.
  - simias 9y ago
    I actually already do that with pass and a GnuPG smartcard since pass uses gpg to handle the encryption. You can also provide several PGP encryption keys if you want to share your passwords across several people. I believe pass lets you specify the keys on a per-directory basis, although I never actually tried to do that myself.
mooman219 9y ago
I understand the problem you're having with keepass. My solution for it was to store the kdbx in cloud storage then access it with a nice service called https://app.keeweb.info/ https://app.keeweb.info/. This means remembering two passwords, one for your cloud storage, and one for your kdbx file. Keeweb is open source and can be used without an internet connection if you would like to use it as your primary keepass client https://github.com/keeweb/keeweb https://github.com/keeweb/keeweb

dbingham 9y ago

Please, someone build an open source solution similar to Lastpass backed by a Vault instance with browser plugins and a web front end to allow for key management. That would be amazing. Lastpass is almost necessary for me to keep all my passwords moderately secure and still usable. But I really do not love trusting all of my info to a 3rd party.

UnoriginalGuy 9y ago
> But I really do not love trusting all of my info to a 3rd party. You don't need to. You need to trust Lastpass's design. A Lastpass database is an AES-256 encrypted blob, encrypted using a "slow" hash of your master password (PBKDF2, rounds are configurable). Lastpass don't know your password. When they authenticate you they test to see if your database is decryptable with the password you entered (after it is hashed). If you set 2F then they won't even allow attempts until 2F is satisfied (Google Authenticator is free). Lastpass's biggest weakness is also applicable to this theoretical OpenSource alternative: Javascript. Javascript is delivered from Lastpass (for the browser extension) and after you decrypt your password database, that JS has full access to it. If a "bad guy" is able to inject evil JS between you and them, then they could trivially steal already decrypted passwords. As I said, this weakness has nothing to do with Lastpass, it would equally apply to all password managers which integrate into the browser with an extension. In effect you've exchanged convenience for security. And you can already read the Lastpass browser extension's source code, being more open source doesn't make you immune from this issue. So you can choose to trust Lastpass, or not, but the design is sound. Slapping the words "open source" onto something won't mitigate any of LastPass's inherent design issues, and you'd still want to follow a similar design since it is a good compromise between security and convenience. Coming up with a superior design that doesn't sacrifice convenience would be awesome, but it is a hard problem...
- heliosAtwork 9y ago
  Sure, it can happen to open source; all engineering rules still apply. The attractive part to me would be that there are more eyes on the code. I would host my own in a google app engine or heroku and avoid a 3rd party who is more attractive to hackers due to the number of accounts they host and potential gain to criminals.
  - kasey_junk 9y ago
    Thats not how many (most?) breaches occur. The situation you would run into (and worry about) is that an exploit is found in the software and then it is mechanized so that things like google app engine and heroku are scanned and user run versions exploited in mass. Open source does not prevent that, only diligent operations do. So by self hosting your are making the bet that you are doing that singularly more competently than the hosted version.
    - heliosAtwork 9y ago
      No, open source does not prevent anything. There is just more transparency. Any self hosting would need to be fully connected with automated update notifications from the "crowd" of contributors and reviewers. I guess, it becomes a managed service at that point (since as you point out it should have reliable and secure production characteristics which does require a high level of competency). I am imagining a cloud of one for my passwords (a stateless, secure container, with disabled user access to the OS and which connects to an encrypted simple file store to keep my small sized but precious passwords).
  - UnoriginalGuy 9y ago
    Just to be clear: I have nothing against Open Source at all. Open Source is great. I was just pointing out that Open Source in and of itself isn't a security protection. If you follow the same design you'll have the same design weaknesses, Open Source or closed. The "more eyes" thing, may be true, but I'd argue popularity is more important than license in determining the number of "eyes." I'd also caution you in assuming an exploit would be against the server side. The server holds a bunch of really hard to decrypt blobs. The client is the real crown jewel. The client browser has all of the usernames/passwords decrypted, so if you were either able to deliver an "evil" extension update, or find an exploit in the existing extension, you could extricate those credentials. That's the real rub: You turn off extension updates and you're more secure against "evil" extension updates; but you're now more vulnerable to situations where a bug is discovered in the legitimate extension and the organisation pushes a real update to patch that. Auto-updaters in particular are both a huge benefit and a huge security hole.
nucleardog 9y ago
I don't know what options are still available, but the "3rd party" thing is why I ended up paying $100 or something to purchase 1Password back when it was still only available as a one-time-purchased standalone app. Even if it's open source, I'm in no position to effectively evaluate their crypto/etc. But I can do some basic reasoning about the possible attack surfaces. With 1Password I hold all my data, and the software that I use to view it runs completely independently of anything else. Besides a takeover of my local machine or breaking the encryption, nobody gets my data. With something like LastPass, they hold all my data. The software that I use to view it runs in my browser. The software handling all my passwords is running in the same program that I use to execute untrusted code from the internet thousands of times a day. This has bitten them in the ass a few times. I'd love an open source password manager solution given the turn 1Password has taken towards being a "cloud service", but for the love of god can it please be useful without tying it to my web browser.

AdmiralAsshat 9y ago

The standard advice here is to throw your KeePass vault onto Dropbox/Google Drive/OneDrive, but I agree, keeping everything sync'd is a PITA. It's a problem that needs solving, but KeePass itself is probably not keen on solving it.

paulryanrogers 9y ago
Keepass2 actually has reasonably good built-in merging. There are also sync plugins which could help with the cloud provider's own collision copy issues

NikolaeVarius 9y ago

I've been sort of sketching out a system for this in my spare time. Something like a portable container that you can host anywhere and keeps syncing easy. What kinds of other features would you want?

StavrosK 9y ago

I use KeePass2Android and merging works very well with it. It just automatically reads from my Dropbox file and merges any changes.

simias 9y ago

This is probably not a good solution for the vast majority of people but it works well for me: I use pass[0] but I host my ~/.password-store on a sshfs on a server I own. Wherever I need to access my passwords I just mount the sshfs and then can proceed as normal. Since pass supports versioning the passwords with git it would also be possible to use that, just push/pull the repository to keep it in sync. It would also give you access to the password even while offline, but I actually prefer the added security of not copying the passwords over, even encrypted. Obviously if you want to access your passwords from, say, a Windows machine or a smartphone it won't quite do the trick. [0]https://www.passwordstore.org/ https://www.passwordstore.org/

rkeene2 9y ago
Similar to "pass" is "hunter2" ( https://chiselapp.com/user/rkeene/repository/hunter2/ https://chiselapp.com/user/rkeene/repository/hunter2/ ) which uses a hardware security module such as a smartcard to decrypt the password and allows sharing between users in a file that can be managed by a version control system (such as Fossil or Git).
- mysterydip 9y ago
  Hunter2 sounds like a reference to this: http://bash.org/?244321 http://bash.org/?244321 Amusing if true, both dealing with passwords so it's likely.
  - rkeene2 9y ago
    It is. There are several references to that on the page and in the source.
- simias 9y ago
  I actually already do that with pass and a GnuPG smartcard since pass uses gpg to handle the encryption. You can also provide several PGP encryption keys if you want to share your passwords across several people. I believe pass lets you specify the keys on a per-directory basis, although I never actually tried to do that myself.

mooman219 9y ago

I understand the problem you're having with keepass. My solution for it was to store the kdbx in cloud storage then access it with a nice service called https://app.keeweb.info/ https://app.keeweb.info/. This means remembering two passwords, one for your cloud storage, and one for your kdbx file. Keeweb is open source and can be used without an internet connection if you would like to use it as your primary keepass client https://github.com/keeweb/keeweb https://github.com/keeweb/keeweb