11 ms·

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the

I’m really not sure the “only real solution” is every human needs to selfhost a password manager. That’s ill-advised; an extreme take. The vast majority of the population will do a worse job on the availability and security of a selfhost solution than 1Password, whose core business and value proposition is password management. I’m a very happy user of 1Password for Families and consider it the likely the best ~$50 a year that I spend on hosted technologies.

sroussey 2y ago
Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.
- zarzavat 2y ago
  Do you still have the hard disk? Did you attempt to recover it ?
- littlestymaar 2y ago
  That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.
  - pydry 2y ago
    I've always wanted a decentralized solution that lets me trust my friends instead.
    - eru 2y ago
      You can use a threshold secret sharing scheme to distribute your keys amongst your friends (and amongst companies). This way you don't need to trust any single one of your friends to be 100% honest nor 100% available.
      - pydry 2y ago
        Thats kind of my point. you could rsync files before you could Dropbox too, but there was still a need for a Dropbox.
      - littlestymaar 2y ago
        I know how to do that in theory (I've worked with Shamir secret sharing on elliptic curves before) but you don't have the option to do that in LUKS, so in practice you can't use it.
  - prmoustache 2y ago
    My rule of thumb is if for some reason you need to use crypto keys that can't be easily replaced, you need to have a safe at the bank with the keys stored in 2 differente media formats, that are recreated every year. I don't trust many people to do that. I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. And having a note somewhere telling me I have a safe in bank X is the only solution I have found.
    - gertop 2y ago
      > I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. Ah! I have the exact same recurring worry, it's very unpleasant. I'd really prefer to keep home media unencrypted, but the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind.
      - littlestymaar 2y ago
        > the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind. Even worse is the eventuality of them getting their hand of a picture of your ID card or passport, or whatever they can later use to steal your identity. Identity theft is nightmare stuff.
  - patrakov 2y ago
    It's worse: there are regulations (called "sanctions" and "KYC") that force companies to pull the rug.
    - littlestymaar 2y ago
      Idk if it's “worse” but yeah sanctions are a serious problem for the many people who happen to have family ties with the “wrong” countries.
  - eru 2y ago
    > [...] you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) [...] Huh? There's plenty of already existing legal ways to do that. Just leave your key with your lawyer or a notary, and existing regulation about fiduciary duty handle everything just fine. You can also make normal private contracts that stipulate fiduciary duties, courts will enforce those contracts just fine. As a technical alternative (or augmentation), you can also use a threshold secret sharing mechanism to store your keys amongst your friends and/or with companies. Now what you can complain about is that there is no convenient way to do all of this. And that's a very legitimate complaint! Convenience is important. However, the way to get convenience is not via regulation.
    - littlestymaar 2y ago
      > However, the way to get convenience is not via regulation. It is, because no company is ever going to give you the convenience you want at their own expense ;)
      - eru 2y ago
        Well, obviously the customer only gets the convenience they are willing to pay for. Competition should help keep those costs down.
        littlestymaar 2y ago
        The blind faith some people have in markets and competition despite all evidence always leaves me in awe.
        eru 2y ago
        I'm not sure what you mean by 'despite all evidence'? You can also write: > The blind faith some people have in [regulation and government] despite all evidence always leaves me in awe. In any case, markets ain't perfect. They are made of people, after all. But they are better than the alternatives. And most importantly: if you don't like what's on offer, you are allowed to get an alternative without going to jail.
- dijit 2y ago
  Sounds like you had control of your data.
- remram 2y ago
  Do you have machines with no backups? Why?
- psd1 2y ago
  Feels. I had half a bitcoin on a disk that I left alone. Forgot about it. Reinstalled the OS. Three times. I was a sysadmin for years, but the cobblers' children go barefoot.
recursive 2y ago
I'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.
- jackson1442 2y ago
  You can export them- just did so by touching the context menu on the mobile app then “copy item JSON.” This includes the private key for the passkey. Here’s one I just exported: https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee920424de60 https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee9... Whether or not you can import them into something else though…
- scient 2y ago
  The whole original point of what underpins FIDO2 was device locked, unphishable credentials. Wanting to export and move passkeys between devices is kind of counter to that. And I would argue vendors completing the attestation process are much more trustworthy than storing your own keys god knows where.
  - recursive 2y ago
    Oh, ok. If that's the same thing as passkeys, then I finally figured out that I'm not interested. To me it looks like another vector for platform lock-in, or getting mysteriously locked out of my accounts with no recourse. I'll wait for FIDO3.
    - Groxx 2y ago
      Yep. I absolutely refuse to support anything that wants to dictate what I do with my identity. Such things do have purposes, in high-stakes environments. They prevent accidents. The vast majority of uses on the public web are not even remotely in that realm. It'd be better off being a separate spec that only a handful of internal-only systems use, ideally requiring MDM to set up conveniently (to strongly discourage normal and even high-stakes-normal website usage). My banking website has absolutely no business knowing and being able to approve or deny what brand my authenticator is.
patrakov 2y ago
I also think that the "self-hosted" requirement is an over-reach. It would be sufficient to require some standardized commodity that can, in principle, be self-hosted, but is available in an equivalent form from multiple unaffiliated third parties. E.g., a WebDAV folder.
MrDrMcCoy 2y ago
I disagree. While Vaultwarden may be a bit much to ask of the unwashed masses, the storage model of KeePass* is very easy to understand and works with any existing file synchronisation solution, which almost everyone already has at this point. The effort is nearly as low as with a cloud hosted solution, and the value/safety proposition is quite high.

sroussey 2y ago

Agreed. I self hosted the key 100 bitcoin in like 2010. Machine crashed. Oops.

zarzavat 2y ago
Do you still have the hard disk? Did you attempt to recover it ?
littlestymaar 2y ago
That's a fundamental problem with cryptographic security: you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) but you cannot trust yourself doing that either, because you can, and will, make mistakes.
- pydry 2y ago
  I've always wanted a decentralized solution that lets me trust my friends instead.
  - eru 2y ago
    You can use a threshold secret sharing scheme to distribute your keys amongst your friends (and amongst companies). This way you don't need to trust any single one of your friends to be 100% honest nor 100% available.
    - pydry 2y ago
      Thats kind of my point. you could rsync files before you could Dropbox too, but there was still a need for a Dropbox.
    - littlestymaar 2y ago
      I know how to do that in theory (I've worked with Shamir secret sharing on elliptic curves before) but you don't have the option to do that in LUKS, so in practice you can't use it.
- prmoustache 2y ago
  My rule of thumb is if for some reason you need to use crypto keys that can't be easily replaced, you need to have a safe at the bank with the keys stored in 2 differente media formats, that are recreated every year. I don't trust many people to do that. I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. And having a note somewhere telling me I have a safe in bank X is the only solution I have found.
  - gertop 2y ago
    > I have everything encrypted and self hosted and I sometimes wonder what I would do if I was suffering from amnesia after an accident for example. Ah! I have the exact same recurring worry, it's very unpleasant. I'd really prefer to keep home media unencrypted, but the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind.
    - littlestymaar 2y ago
      > the thought of a robber seeing my tax returns or photos of my infant daughter is constantly at the back of my mind. Even worse is the eventuality of them getting their hand of a picture of your ID card or passport, or whatever they can later use to steal your identity. Identity theft is nightmare stuff.
- patrakov 2y ago
  It's worse: there are regulations (called "sanctions" and "KYC") that force companies to pull the rug.
  - littlestymaar 2y ago
    Idk if it's “worse” but yeah sanctions are a serious problem for the many people who happen to have family ties with the “wrong” countries.
- eru 2y ago
  > [...] you cannot trust people to manage your keys for you (because due to lack of regulation preventing that companies have this bad habit of pulling the rug under their customers' feet) [...] Huh? There's plenty of already existing legal ways to do that. Just leave your key with your lawyer or a notary, and existing regulation about fiduciary duty handle everything just fine. You can also make normal private contracts that stipulate fiduciary duties, courts will enforce those contracts just fine. As a technical alternative (or augmentation), you can also use a threshold secret sharing mechanism to store your keys amongst your friends and/or with companies. Now what you can complain about is that there is no convenient way to do all of this. And that's a very legitimate complaint! Convenience is important. However, the way to get convenience is not via regulation.
  - littlestymaar 2y ago
    > However, the way to get convenience is not via regulation. It is, because no company is ever going to give you the convenience you want at their own expense ;)
    - eru 2y ago
      Well, obviously the customer only gets the convenience they are willing to pay for. Competition should help keep those costs down.
      - littlestymaar 2y ago
        The blind faith some people have in markets and competition despite all evidence always leaves me in awe.
        eru 2y ago
        I'm not sure what you mean by 'despite all evidence'? You can also write: > The blind faith some people have in [regulation and government] despite all evidence always leaves me in awe. In any case, markets ain't perfect. They are made of people, after all. But they are better than the alternatives. And most importantly: if you don't like what's on offer, you are allowed to get an alternative without going to jail.
dijit 2y ago
Sounds like you had control of your data.
remram 2y ago
Do you have machines with no backups? Why?
psd1 2y ago
Feels. I had half a bitcoin on a disk that I left alone. Forgot about it. Reinstalled the OS. Three times. I was a sysadmin for years, but the cobblers' children go barefoot.

recursive 2y ago

I'm a happy user of 1password also. But I'm not touching passkeys until they let me export them. Last time I checked, it was a platform lock-in.

jackson1442 2y ago
You can export them- just did so by touching the context menu on the mobile app then “copy item JSON.” This includes the private key for the passkey. Here’s one I just exported: https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee920424de60 https://gist.github.com/jacksonwelsh/f5ad519770b1adde40a6ee9... Whether or not you can import them into something else though…
scient 2y ago
The whole original point of what underpins FIDO2 was device locked, unphishable credentials. Wanting to export and move passkeys between devices is kind of counter to that. And I would argue vendors completing the attestation process are much more trustworthy than storing your own keys god knows where.
- recursive 2y ago
  Oh, ok. If that's the same thing as passkeys, then I finally figured out that I'm not interested. To me it looks like another vector for platform lock-in, or getting mysteriously locked out of my accounts with no recourse. I'll wait for FIDO3.
  - Groxx 2y ago
    Yep. I absolutely refuse to support anything that wants to dictate what I do with my identity. Such things do have purposes, in high-stakes environments. They prevent accidents. The vast majority of uses on the public web are not even remotely in that realm. It'd be better off being a separate spec that only a handful of internal-only systems use, ideally requiring MDM to set up conveniently (to strongly discourage normal and even high-stakes-normal website usage). My banking website has absolutely no business knowing and being able to approve or deny what brand my authenticator is.

patrakov 2y ago

I also think that the "self-hosted" requirement is an over-reach. It would be sufficient to require some standardized commodity that can, in principle, be self-hosted, but is available in an equivalent form from multiple unaffiliated third parties. E.g., a WebDAV folder.

MrDrMcCoy 2y ago

I disagree. While Vaultwarden may be a bit much to ask of the unwashed masses, the storage model of KeePass* is very easy to understand and works with any existing file synchronisation solution, which almost everyone already has at this point. The effort is nearly as low as with a cloud hosted solution, and the value/safety proposition is quite high.