alt Hacker NewsSo you decrypt -any- password on a system with malware, and malware gets -all- the passwords. Makes life super easy for an attacker.
All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere.
To prevent this, you need to encrypt each password to a key held in a yubikey, nitrokey, or similar with a touch policy. Now as an attacker if I want to get the users whole database of 100 passwords I must trick them to tapping a blinking smartcard or touchid 100 times. Presumably the user would notice something is wrong, and stop. Damage control.
This is how I have been doing password management for over a decade with password store, the standard unix password manager. That tiny shell script is the -minimum- security any password manager must have.
I get that most major password managers like 1password and lastpass also get this wrong. I submit with a straight face that they have never let any capable security engineers near their products. They have a negligent design end to end and must not be replicated.
Replies
> That tiny shell script is the -minimum- security any password manager must have.
So any device without touchid or a yubikey can't use a password manager without typing out your full master password every time you want to access any password?
It's hard to give a big enough :rolleyes: for this nihilistic bullshit being spouted in 2026. In fact I'm going to go further: I accuse you lrvick of active maliciousness and trying to aid illicit access and discourage people from improving their security, because you have no excuse not to know better.
>All they would need to do is install a wrapper for sesame that waits for the next database unlock and exfiltrates all passwords in plain text to a pastebin somewhere.
"""All""" they need is to get root? Most people access all key stuff on their own devices, and for the vast ultra super majority of the population and vital sites if their personal trusted device is rooted it's over regardless. Your "Now as an attacker if I want to get the users whole database of 100 passwords I must trick them to tapping a blinking smartcard or touchid 100 times" is total fucking make believe, completely ignoring normal things like RECOVERY FLOWS. If you have root on someone's computer and phone you have access to their email and probably messaging as well, and that will suffice to get into nearly everything including the majority of financial institutions (which even now have massive ones that don't even support HSMs at all, let alone leave no recovery route! looking at you Charles Schwab, with total client assets in excess of $12.5 trillion at the start of this year [0]). There isn't any need for "100 times" because most people don't have 100 different critical accounts, rather single digits or even just one actual one that has things like money or comms.
>This is how I have been doing password management for over a decade with password store, the standard unix password manager. That tiny shell script is the -minimum- security any password manager must have.
Literally laughing out loud here. If it's not easy enough for my friends in their 70s to use and like it's WORTHLESS to most security. Including on some level mine or yours, because security has key social/network effects beyond just individuals, stolen money, information, and access is used to fuel further security threats. Job #1 is to make something people like and works with most of what already exists. Otherwise it's yet another case of "ROTATE PASSWORDS EVERY 2 MONTHS NO USE X NUMBERS OH ALSO Y SPECIAL CHARACTERS NO NOT LIKE THAT" which results in everyone just leaving stuff on sticky notes on their screens and doing the bare minimum to fool the system and using the same thing or minor variants everywhere. Theorycrafted garbage made for robots not humans.
>I submit with a straight face that they have never let any capable security engineers near their products. They have a negligent design end to end and must not be replicated.
I submit with a straight face you are either literally working for a hostile agency to spread disinformation or you have serious neurodivergence or you are seriously and dangerously bubbled with an (un)healthy splash of Dunning-Kruger mixed in.
----
0: https://pressroom.aboutschwab.com/press-releases/press-relea...
Isn't this a fundamental issue with all popular password managers? Your setup where each decrypt requires a physical action is superior of course (even if an attacker is still likely to get 2-3 of the most important secrets before you start to investigate why a login isn't working), I just mean that most people don't have this and it's not a particular flaw with OP's implementation right?