News for hackers. Stuff that matters.
Re:On Password Managers by tptacek on Thursday July 20, 2017 @12:54PM (#14814196)
Right! Sorry. I don't use Windows. Honestly? My recommendation about password managers probably shouldn't extend to Windows; there might be no password manager I confidently recommend on that platform.

That's not a statement about 1Password; it's about the fact that the security models are different on the two platforms, and I'm very familiar with how 1Password works on macOS and less so on Windows.

Re:On Password Managers by e12e on Thursday July 20, 2017 @11:35PM (#14817870)
It would appear making a password store on Windows would be rather simple, wrapping DPAPI:

https://msdn.microsoft.com/en-us/library/ms995355.aspx

At that point you should probably be about as (in)secure as access to the platform is. I don't know how you could improve much on that (assuming secureboot and bitlocker encrypted disk).

Is there some magic going on the MacOS side that somehow improves on this?

Re:On Password Managers by tptacek on Friday July 21, 2017 @11:14AM (#14821169)
Yes! The actual encryption of passwords is not the hard part of a password manager (though, of course, commercial password managers seem plenty capable of screwing that up!)

The hard problem is getting the passwords out of the encrypted store and into form fields in your browser.

Re:On Password Managers by cyphar on Friday July 21, 2017 @12:49PM (#14821944)
Would you consider the KeePassHTTP solution to be adequate (they have a browser plugin that acts as a password manager using the browser's APIs and the passwords are retrieved after authenticating the plugin with the KeePassXC server -- which prompts the user each time and only entries that match the URL are sent).

They also support copying the password to your clipboard (which they then clear after a few seconds). There's also the automated entry system which basically emulates keystrokes.