6 ms·

> Worse, an attacker who sees one of your passwords has a pretty decent shot at brute forcing the rules you use, and an attacker who sees two of them has the ru

• macintux 10y ago
  1Password doesn't ordinarily store your database (although I can't speak to the more recent team/cloud features). It's up to you to decide how to make them available to different devices, via Dropbox e.g. So, yes, if the attacker has access to your Dropbox and your master password, you're screwed, but that's a very high bar to hurdle.
• eridius 10y ago
  1Password isn't a web-based password manager, it's an offline one that has a syncing component. Syncing is traditionally done either over WiFi (so no exposure to attackers), Dropbox, or iCloud. More recently 1Password now has an optional subscription model that gets you syncing + all updates to the app on all platforms. But the new built-in syncing uses a separate Account Key, which you provide along with your master password the first time you set up syncing on a particular device, and then you never use the account key again (until you have to set up a new device). This means you can store the account key in whatever secure manner you want without needing ease-of-access, and it means you won't ever accidentally type your account key into the wrong place and expose it to an attacker. So basically, if you use 1Password's built-in syncing, the attacker has to compromise your machine to get at your vault, just as they would have to do if you didn't do any syncing at all. If you use a third-party service for syncing (e.g. Dropbox, iCloud) they have to compromise that service. And of course in both cases they still need your 1Password master password.
  • tempestn 10y ago
    Even for a cloud-based manager like Lastpass, you would have 2FA turned on, so an attacker with just your master password still wouldn't be able to log in. (Although obviously you would still change the master password if it were compromised.)
• theandrewbailey 10y ago
  > If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. Have really long passwords that are extremely random on a bit-by-bit basis and doesn't have a snowball's chance in hell of containing a dictionary word (which are the blindingly killer flaw in your formula). Like: 6vRmÓ£æp¥£{&XèñgäÐë¸pH©Þ|÷g¸jn§/¥ÔÎpV4fÎ or ò\f4¬Ð³ &{W+ãÄçÏ)æý½06Ýzȯ+µ>få²9Æð:WÚu > Plus, I still don't get why 1Password is better than a password generator on the 4th point. Because you have credentials that are 100% externally independent of each other. Only you have access to the plaintext passwords (the only way they are related) and you define the terms on which the ciphertext is distributed.
  • rocqua 10y ago
    That is massive overkill. 128 bits of security is way more than sufficient. 23 characters (uppercase, lowercase, numbers) already gives much security. Honestly, 128 bits is already overkill. An attacker that determined is probably quite proficient at rubber hose cryptography. The point of PW manager is to prevent compromise from spreading. Not to keep a motivated NSA out of your PC.
    • theandrewbailey 10y ago
      I know, but that's a good property to have, it's easy to do, and the extra costs are insignificant.
      • rocqua 10y ago
        It's a useless property to have, and the extra costs make it much harder to transcribe by hand. Never mind the fact that using non-ascii is asking for compatibility problems. Honestly, diceware[1] is probably an even better choice, though it sometimes fails symbol count requirements. [1] http://world.std.com/~reinhold/diceware.html http://world.std.com/~reinhold/diceware.html
• minitech 10y ago
  > If an attacker is specifically targeting me and thinking about my passwords, there's not much I can do at that point. You could use a password manager…