undefined | Better HN

0 pointstptacek8y ago0 comments

Right! Sorry. I don't use Windows. Honestly? My recommendation about password managers probably shouldn't extend to Windows; there might be no password manager I confidently recommend on that platform.

That's not a statement about 1Password; it's about the fact that the security models are different on the two platforms, and I'm very familiar with how 1Password works on macOS and less so on Windows.

0 comments

3 comments · 1 top-level

e12e8y ago· 2 in thread

It would appear making a password store on Windows would be rather simple, wrapping DPAPI:

https://msdn.microsoft.com/en-us/library/ms995355.aspx

At that point you should probably be about as (in)secure as access to the platform is. I don't know how you could improve much on that (assuming secureboot and bitlocker encrypted disk).

Is there some magic going on the MacOS side that somehow improves on this?

tptacekOP8y ago

Yes! The actual encryption of passwords is not the hard part of a password manager (though, of course, commercial password managers seem plenty capable of screwing that up!)

The hard problem is getting the passwords out of the encrypted store and into form fields in your browser.

cyphar8y ago

Would you consider the KeePassHTTP solution to be adequate (they have a browser plugin that acts as a password manager using the browser's APIs and the passwords are retrieved after authenticating the plugin with the KeePassXC server -- which prompts the user each time and only entries that match the URL are sent).

They also support copying the password to your clipboard (which they then clear after a few seconds). There's also the automated entry system which basically emulates keystrokes.

j / k navigate · click thread line to collapse