3 ms·
1) The encrypted data can be lost, thereby locking the user out of all of their accounts. 2) The encrypted data can be stolen. If the user was using a weak mas
by Nadya 11y ago
1) The encrypted data can be lost, thereby locking the user out of all of their accounts.
2) The encrypted data can be stolen. If the user was using a weak master password, all of their accounts can be compromised.
3) The data can only be synced to a limited number of devices.
1) Backups. Never only keep 1 copy of something you can lose. And to be even more secure: never keep backups in the same place (both at home? what if your house burns down?) This one is plausible but not the largest of concerns, IMO.
2) User error. This is the most plausible attack but Visionary is worse in this regard. I'll expand on this below.
3) Depends what program you use. Or whether you take advantage of syncing to begin with (I personally don't.)
Since Visionary always returns the same password for a given Master password - it becomes security by obscurity. If you're going to make the lines of Argument #2, if a user uses a common Master password and a hacker bruteforces passwords through Visionary using common passwords - they will obtain the supposedly more secure password. But if a person uses an insecure password on a "standard" password manager that generates them a random password - that sort of attack becomes impossible unless they get their hands on the user's database.
I'm going to be honest: the attack vector I'm most concerned about (#2) as it is also the most plausible threat to potential security: Visionary is less secure because it always generates the same password from anywhere. Meaning anyone with a weak password is more "at-risk" because most people aren't going to have their database stolen, let alone by someone who'd know what to do with it or furthermore would even bother with it. They'd spend less time stealing another laptop than working through an encrypted one.
- libeclipse 11y agoI know client side security is a joke, but the only reason I made it iterate thousands of times is to increase the time taken to generate a password. That makes brute force attacks unfeasible.