4 ms·

Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge

Is it just me, or are these "cloud password managers" a terrible idea given the typical person's threat model? First, there are hackers looking to score a huge pile of accounts. Second, there could be a relatively unsophisticated person with a grudge, like an ex-partner. In a distant third, there are nation-state-level actors. If I keep a local encrypted password file and copy it around by hand, I may have some vulnerabilities, but it's not worth a hacker's time to steal only my accounts, and I can probably protect my credentials from casual malice. On the other hand, if I put my passwords on the same service as hundreds of thousands of other people, that's a huge jackpot that attracts significant hacking interest, and the service only has to screw up once. The risk doesn't seem worth the convenience.

UnoriginalGuy 10y ago
As soon as you put a Keepass encrypted database onto any cloud service (e.g. DropBox, Google Drive, etc) you've effectively just recreated LastPass. Both use an AES-256 encrypted database encrypted using a master password which is first hashed using a modern/slow hashing algorithm. Obviously it is imperfect that the LastPass plugin has bugs in it; and I won't defend that. But I will say that the convenience is worth the risk most of the time, but LastPass needs to be better than this if they want to maintain people's respect and trust. If you intend to keep your encrypted password database completely offline (e.g. USB keys) then, sure, it is more secure but very few users are willing to take on such inconvenience. Password Managers in general have resulted in less password reuse, longer passwords, and more random passwords. Last Pass in particular offers "one click" password rotation on dozens of popular services.
- wsinks 10y ago
  One click password rotation! I had no idea.
  - UnoriginalGuy 10y ago
    It is neat but only on a select list of popular sites, you can see the list at the bottom of this page: https://helpdesk.lastpass.com/generating-a-password/#h2 https://helpdesk.lastpass.com/generating-a-password/#h2
wsinks 10y ago
Not necessarily a terrible idea, but you are right - they're good for some time and then the economies of scale do tip. That said, these things are very convenient.
keypusher 10y ago
The biggest threat to most users is that their password on SomeRandomSite gets out (db dump, hacked, whatever) and since they use the same password everywhere, now their bank and/or their email password is out in the wild. If you are willing to carry an encrypted password file around with you, and consult it every time you need to enter a password, go for it. Yes, that is more secure than LastPass. What LastPass offers is balance between convenience and security. Also, I believe that a hacker who gained access to LastPass's database would merely get a bunch of encrypted passwords. LastPass doesn't know your master vault password, which is needed to unlock your vault and use the passwords that are stored there. So, they are a big target, but primarily for attacks like this where an individual page might be able to hijack the plugin for users visiting the site, and not because some could hack LastPass and get everyone's passwords.

UnoriginalGuy 10y ago

As soon as you put a Keepass encrypted database onto any cloud service (e.g. DropBox, Google Drive, etc) you've effectively just recreated LastPass. Both use an AES-256 encrypted database encrypted using a master password which is first hashed using a modern/slow hashing algorithm. Obviously it is imperfect that the LastPass plugin has bugs in it; and I won't defend that. But I will say that the convenience is worth the risk most of the time, but LastPass needs to be better than this if they want to maintain people's respect and trust. If you intend to keep your encrypted password database completely offline (e.g. USB keys) then, sure, it is more secure but very few users are willing to take on such inconvenience. Password Managers in general have resulted in less password reuse, longer passwords, and more random passwords. Last Pass in particular offers "one click" password rotation on dozens of popular services.

wsinks 10y ago
One click password rotation! I had no idea.
- UnoriginalGuy 10y ago
  It is neat but only on a select list of popular sites, you can see the list at the bottom of this page: https://helpdesk.lastpass.com/generating-a-password/#h2 https://helpdesk.lastpass.com/generating-a-password/#h2

wsinks 10y ago

Not necessarily a terrible idea, but you are right - they're good for some time and then the economies of scale do tip. That said, these things are very convenient.

keypusher 10y ago

The biggest threat to most users is that their password on SomeRandomSite gets out (db dump, hacked, whatever) and since they use the same password everywhere, now their bank and/or their email password is out in the wild. If you are willing to carry an encrypted password file around with you, and consult it every time you need to enter a password, go for it. Yes, that is more secure than LastPass. What LastPass offers is balance between convenience and security. Also, I believe that a hacker who gained access to LastPass's database would merely get a bunch of encrypted passwords. LastPass doesn't know your master vault password, which is needed to unlock your vault and use the passwords that are stored there. So, they are a big target, but primarily for attacks like this where an individual page might be able to hijack the plugin for users visiting the site, and not because some could hack LastPass and get everyone's passwords.