3 ms·

I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then u

by tudorw 10y ago

I've read zero reports of people breaking into houses, finding a piece of paper down the back of the cabinet with lots of passwords on and no site names, then using those passwords randomly to gain access to an unknown system... A 'software' or 'online' password manager seems like a terrible idea, all your eggs in one convenient basket, if Sony and VISA and the NSA are unable to secure their systems 100% of the time I doubt the maker of your software will fare much better over the long term.

joepie91_ 10y ago
This is misunderstanding the threat model. Assuming you're using a local password manager and not a 'hosted' one, the moment your system is compromised, you're screwed anyway and so that single basket doesn't really matter anymore. If an attacker has sufficient access to read out passwords from RAM, it also has sufficient access to just keylog everything. To follow your analogy: if somebody physically breaks into your home and places a security camera pointed at your safe(s), it's not really going to matter for the average user whether all the safe combinations are on a single piece of paper. They're going to get them anyway, because they've compromised the environment and can just watch the footage.
- noja 10y ago
  Not quite: if I can steal your password manager passwords I get all of them immediately, if I compromise your system and you don't use a password manager I can slowly steal passwords over time with some effort. Most attempts will favour "all and now", above "slowly over time".
tudorw 10y ago
Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account. :P //not-tudorw
- tudorw 10y ago
  fair point :)
  - tudorw 10y ago
    while obviously fairly painful, am assuming that came from the Stratfor list ? While I concede a piece of paper is far from secure, I'm human and what I do others do too, I would have faired better had I followed my own advice. Conveniently your point does re-inforce they key aspect of my comment, that if Stratfor, a global intelligence company, can fall foul of security then there really are very few safe ports to rely on harbouring your secrets ;) Btw, thanks for not locking me out, gentlemanly of you.
- deleted 10y ago
  [deleted]

by tudorw 10y ago

joepie91_ 10y ago

This is misunderstanding the threat model. Assuming you're using a local password manager and not a 'hosted' one, the moment your system is compromised, you're screwed anyway and so that single basket doesn't really matter anymore. If an attacker has sufficient access to read out passwords from RAM, it also has sufficient access to just keylog everything. To follow your analogy: if somebody physically breaks into your home and places a security camera pointed at your safe(s), it's not really going to matter for the average user whether all the safe combinations are on a single piece of paper. They're going to get them anyway, because they've compromised the environment and can just watch the footage.

noja 10y ago
Not quite: if I can steal your password manager passwords I get all of them immediately, if I compromise your system and you don't use a password manager I can slowly steal passwords over time with some effort. Most attempts will favour "all and now", above "slowly over time".

tudorw 10y ago

Maybe using a password manager is better than using the password "wizard007" everywhere, including your HN account. :P //not-tudorw

tudorw 10y ago
fair point :)
- tudorw 10y ago
  while obviously fairly painful, am assuming that came from the Stratfor list ? While I concede a piece of paper is far from secure, I'm human and what I do others do too, I would have faired better had I followed my own advice. Conveniently your point does re-inforce they key aspect of my comment, that if Stratfor, a global intelligence company, can fall foul of security then there really are very few safe ports to rely on harbouring your secrets ;) Btw, thanks for not locking me out, gentlemanly of you.
deleted 10y ago
[deleted]