7 ms·

> That tiny shell script is the -minimum- security any password manager must have. So any device without touchid or a yubikey can't use a password manager with

> That tiny shell script is the -minimum- security any password manager must have. So any device without touchid or a yubikey can't use a password manager without typing out your full master password every time you want to access any password?

lrvick 19d ago
Every modern device under the sun ships with a hardware security module of some kind which could, if nothing else, rate limit decryptions and ensure decryptions can only happen on that machine. There are so so many hardware anchors free for the taking. The same hardware Microsoft, Google, and Apple use to verify you are running a "genuine" OS these days can also do general purpose encryption and decryption with rate limits and touch policies. Pick literally any of them. TPM, Passkeys, PIV, touchid, yubikeys, nitrokeys, the keycard to your last hotel room being touched on the hidden NFC reader most people do not know about under Dell touchpads. Use whichever one is the least shitty but not having a hardware anchor in a password manager is shipping a car without airbags.
- what 19d ago
  Apples SE doesn’t let you load a key, so you have to reencrypt your secrets for every Apple device you want them on… requiring hundreds of touches. The UX just sucks, which is why it’s not a thing.
  - lrvick 19d ago
    An optional remotely attestable secure enclave all secrets are encrypted to on first entry can however bulk encrypt secrets to a public key of each device bypassing the touch policy when adding new devices but still requiring a manual tap for each secret on each device if consent challenges on all involved devices and optional time delay policies are met.
    - what 19d ago
      I’m really not sure what you’re trying to say? You have some magic device that can tell when you want you reencrypt everything for new devices versus just accessing your passwords? This doesn’t exist.
      - lrvick 18d ago
        Policy gated secure enclaves are absolutely a thing and I have designed several of them, some of which are responsible for protecting hundreds of billions of dollars in assets for major financial institutions. To make a transaction several people around the world sign with hardware enclaves in their devices, or yubikeys/nitrokeys, and if the threshold of signatures is met, the enclave can permit bulk usage of key material that would not be safe to directly use locally. The same enclaves that protect multi-billion dollar signing keys, can also be used to assist with secure policy-gated bulk transfer of passwords between the TPMs of different computers, among many other uses. https://whitepaper.turnkey.com/ https://whitepaper.turnkey.com/ https://distrust.co/blog/enclaveos.html https://distrust.co/blog/enclaveos.html https://caution.co https://caution.co
- Marsymars 19d ago
  Sure, what does "the Secure Enclave or TPM could theoretically do this" do for me, if I've got a a trio of desktop PCs running macOS/Linux/Windows with no Touch ID between any of them and I want to keep my passwords synced and reasonably accessible?
  - cure_42 19d ago
    You use a yubikey? Duh?
    - Marsymars 19d ago
      Yeah, I mean, I'm just not going to do that, I tried a yubikey for a few weeks and found the convenience factor to be terrible. Like if someone wants a password manager that either prompts them or requires a yubikey for every password, that's fine, but expecting everyone else to be on board with that isn't reasonable. I'm not really willing to accept a level of convenience other than "unlocking my PC lets me autofill website auth without any additional steps", and I'm happy with the level of risk that exposes me to.
      - cure_42 19d ago
        It stays plugged into my PC and requires a single second of effort to tap it. I have another that lives on my keys and again requires barely any effort to tap against my phone. But sure, if the tiniest bit of effort is too much, there isn't really a good way to make passwords actually secure for you. Hopefully that doesn't have any totally unforeseeable consequences for you down the line.
      - lrvick 18d ago
        > Yeah, I mean, I'm just not going to do that, I tried a yubikey for a few weeks and found the convenience factor to be terrible. If you cannot be bothered to touch a device when it blinks in exchange for having defense against phishing and malware, then I am going to assume you believe you are magically immune to phishing and malware.
  - lrvick 19d ago

lrvick 19d ago

Every modern device under the sun ships with a hardware security module of some kind which could, if nothing else, rate limit decryptions and ensure decryptions can only happen on that machine. There are so so many hardware anchors free for the taking. The same hardware Microsoft, Google, and Apple use to verify you are running a "genuine" OS these days can also do general purpose encryption and decryption with rate limits and touch policies. Pick literally any of them. TPM, Passkeys, PIV, touchid, yubikeys, nitrokeys, the keycard to your last hotel room being touched on the hidden NFC reader most people do not know about under Dell touchpads. Use whichever one is the least shitty but not having a hardware anchor in a password manager is shipping a car without airbags.

what 19d ago
Apples SE doesn’t let you load a key, so you have to reencrypt your secrets for every Apple device you want them on… requiring hundreds of touches. The UX just sucks, which is why it’s not a thing.
- lrvick 19d ago
  An optional remotely attestable secure enclave all secrets are encrypted to on first entry can however bulk encrypt secrets to a public key of each device bypassing the touch policy when adding new devices but still requiring a manual tap for each secret on each device if consent challenges on all involved devices and optional time delay policies are met.
  - what 19d ago
    I’m really not sure what you’re trying to say? You have some magic device that can tell when you want you reencrypt everything for new devices versus just accessing your passwords? This doesn’t exist.
    - lrvick 18d ago
      Policy gated secure enclaves are absolutely a thing and I have designed several of them, some of which are responsible for protecting hundreds of billions of dollars in assets for major financial institutions. To make a transaction several people around the world sign with hardware enclaves in their devices, or yubikeys/nitrokeys, and if the threshold of signatures is met, the enclave can permit bulk usage of key material that would not be safe to directly use locally. The same enclaves that protect multi-billion dollar signing keys, can also be used to assist with secure policy-gated bulk transfer of passwords between the TPMs of different computers, among many other uses. https://whitepaper.turnkey.com/ https://whitepaper.turnkey.com/ https://distrust.co/blog/enclaveos.html https://distrust.co/blog/enclaveos.html https://caution.co https://caution.co
Marsymars 19d ago
Sure, what does "the Secure Enclave or TPM could theoretically do this" do for me, if I've got a a trio of desktop PCs running macOS/Linux/Windows with no Touch ID between any of them and I want to keep my passwords synced and reasonably accessible?
- cure_42 19d ago
  You use a yubikey? Duh?
  - Marsymars 19d ago
    Yeah, I mean, I'm just not going to do that, I tried a yubikey for a few weeks and found the convenience factor to be terrible. Like if someone wants a password manager that either prompts them or requires a yubikey for every password, that's fine, but expecting everyone else to be on board with that isn't reasonable. I'm not really willing to accept a level of convenience other than "unlocking my PC lets me autofill website auth without any additional steps", and I'm happy with the level of risk that exposes me to.
    - cure_42 19d ago
      It stays plugged into my PC and requires a single second of effort to tap it. I have another that lives on my keys and again requires barely any effort to tap against my phone. But sure, if the tiniest bit of effort is too much, there isn't really a good way to make passwords actually secure for you. Hopefully that doesn't have any totally unforeseeable consequences for you down the line.
    - lrvick 18d ago
      > Yeah, I mean, I'm just not going to do that, I tried a yubikey for a few weeks and found the convenience factor to be terrible. If you cannot be bothered to touch a device when it blinks in exchange for having defense against phishing and malware, then I am going to assume you believe you are magically immune to phishing and malware.
- lrvick 19d ago