3 ms·

OT: Just wondering why so many people are using password managers. When you use a password manager you have one single point of attack and failure. I wouldn't l

OT: Just wondering why so many people are using password managers. When you use a password manager you have one single point of attack and failure. I wouldn't like to give all my credentials to one single entity.

grzm 9y ago
The password manager is typically on a machine you control. If your machine is owned, you've got issues regardless. A password manager provides a way to effectively utilize higher-entropy, per-account passwords. As with all security-related matters, it's a tradeoff. I expect many choose password managers for this reason.
- Kiro 9y ago
  Pretty sure the typical password manager user does not control the machine.
  - grzm 9y ago
    In terms of physical control of the machine? In terms of what software is loaded on the machine? Would you elaborate on what you mean "typical password manager user" and "does not control"?
477353468463695 9y ago
Well, personally, prior to using a password manager, I had one user name (plus variations for when that user name was already taken) and something like three different passwords for all of my services. The passwords weren't horrible, brute-forcing them would have taken a while, but if you have the same user name and password in many services, then it just takes for one of those services to get compromised to have many of your accounts be compromisable. And generally speaking, unless you're a high-ranking target, it's far more likely for a service to get compromised than for someone to even bother attacking your device. And yeah, sure, I could have just remembered more different passwords and user names, but I'm a human and that requires effort. Now when using a password manager, I can easily choose different user names, e-mail addresses, passwords and far more complicated passwords as well. And all of that with basically no effort. This also improves privacy, as with different user names it's much harder to link up my different accounts' postings. And I can now easily maintain multiple accounts for the same service, too, allowing me to spread out postings across those, so that you can't follow back my post history for all eternity to link up all kinds of information that I've posted over time.
BinaryIdiot 9y ago
Unfortunately I haven't found a reasonable alternative. I have to use HUNDREDS of passwords every few weeks. HUNDREDS! Some for work, some for personal. Occasionally a service gets broken into so I can't have all of them be the same password and I can't have a system where I add, say "FB" to the end of the password to denote a service as that makes it pretty vulnerable. So I am forced to use a password manager. I hate it and I'm terrified it'll get broken into one day. But what alternative do I have? I enable 2 auth on everything that I can but those are a very, very small handful compared to all of the usernames and passwords I have to use. How do you not use a password manager is my question.
walshemj 9y ago
Also why would you use internet banking for your primary bank account its just increasing your attack surface. I only have internet banking enabled for my secondary account (which has 2fa) which never has more than £100 in it and I only did that so I could xfer money to my p2p account.
twobyfour 9y ago
That's why I don't use a cloud password manager. I use one that allows syncing my devices directly with my phone via wifi. Doesn't even touch a file hosting service like Dropbox. Yes, that makes the physical devices a vulnerability, but the attacker would still need to guess or brute-force the master password to decrypt the vault. It's also a much less juicy target than a million customers of a cloud service. And as someone else pointed out, using the same password everywhere is a non-starter. Nor is memorizing the passwords for more than a tiny fraction of the roughly 1000 entries in my password manager.

grzm 9y ago

The password manager is typically on a machine you control. If your machine is owned, you've got issues regardless. A password manager provides a way to effectively utilize higher-entropy, per-account passwords. As with all security-related matters, it's a tradeoff. I expect many choose password managers for this reason.

Kiro 9y ago
Pretty sure the typical password manager user does not control the machine.
- grzm 9y ago
  In terms of physical control of the machine? In terms of what software is loaded on the machine? Would you elaborate on what you mean "typical password manager user" and "does not control"?

477353468463695 9y ago

Well, personally, prior to using a password manager, I had one user name (plus variations for when that user name was already taken) and something like three different passwords for all of my services. The passwords weren't horrible, brute-forcing them would have taken a while, but if you have the same user name and password in many services, then it just takes for one of those services to get compromised to have many of your accounts be compromisable. And generally speaking, unless you're a high-ranking target, it's far more likely for a service to get compromised than for someone to even bother attacking your device. And yeah, sure, I could have just remembered more different passwords and user names, but I'm a human and that requires effort. Now when using a password manager, I can easily choose different user names, e-mail addresses, passwords and far more complicated passwords as well. And all of that with basically no effort. This also improves privacy, as with different user names it's much harder to link up my different accounts' postings. And I can now easily maintain multiple accounts for the same service, too, allowing me to spread out postings across those, so that you can't follow back my post history for all eternity to link up all kinds of information that I've posted over time.

BinaryIdiot 9y ago

Unfortunately I haven't found a reasonable alternative. I have to use HUNDREDS of passwords every few weeks. HUNDREDS! Some for work, some for personal. Occasionally a service gets broken into so I can't have all of them be the same password and I can't have a system where I add, say "FB" to the end of the password to denote a service as that makes it pretty vulnerable. So I am forced to use a password manager. I hate it and I'm terrified it'll get broken into one day. But what alternative do I have? I enable 2 auth on everything that I can but those are a very, very small handful compared to all of the usernames and passwords I have to use. How do you not use a password manager is my question.

walshemj 9y ago

Also why would you use internet banking for your primary bank account its just increasing your attack surface. I only have internet banking enabled for my secondary account (which has 2fa) which never has more than £100 in it and I only did that so I could xfer money to my p2p account.

twobyfour 9y ago

That's why I don't use a cloud password manager. I use one that allows syncing my devices directly with my phone via wifi. Doesn't even touch a file hosting service like Dropbox. Yes, that makes the physical devices a vulnerability, but the attacker would still need to guess or brute-force the master password to decrypt the vault. It's also a much less juicy target than a million customers of a cloud service. And as someone else pointed out, using the same password everywhere is a non-starter. Nor is memorizing the passwords for more than a tiny fraction of the roughly 1000 entries in my password manager.