3 ms·

> If you use the same password for every site or the same phone number for every 2FA SMS, then only one password/phone number has to be compromised for a massi

by platz 9y ago

> If you use the same password for every site or the same phone number for every 2FA SMS, then only one password/phone number has to be compromised for a massive escalation in privilege. > store them in a password manager using your logic, only one (master) password has to be compromised for a massive escalation in privilege.

kerkeslager 9y ago
> using your logic, only one (master) password has to be compromised for a massive escalation in privilege. No, if you got my master password somehow, you'd also have to gain access to my thumb drive or backup hard drive where I have the password database. That can definitely be done; I have no illusions about the impenetrability of my personal security. But there's a very large incentive for hackers to compromise large databases of passwords from popular websites, and very little incentive for them to compromise my personal password DB. Additionally, my master password is the strongest of my passwords, with about 124 bits of entropy, so this narrow point of failure is strong relative to my other passwords. The strength of security at the various websites I use is unknown, and if I use the same password for all of them, only one has to fail for my password to be exposed. Obviously it's still possible that my password could be collected by a keylogger or some such, but that's a lot less likely than that one of the 100+ websites I've ever put a password into gets compromised. This has been fairly thoroughly discussed ad nauseum elsewhere--the argument you're making has been made and debunked many times, so let's not rehash tired arguments.
- developer2 9y ago
  A hack against your password manager isn't going to be targeted at you as an individual. It will happen to one of the major companies who develop the software. The security of the product is only as good as the weakest link at the company. Where is their source control stored - GitHub? How strong are the passwords of the developers (and managers, etc.) who have access? Do they use two-factor auth? How easy is it to social engineer one's way in, and add a commit to the app so that the next release decrypts all credentials and sends them to the hacker's remote endpoint? It's probably 3-5 lines of code to sneak in. The possibility of a "disgruntled/ambitious employee" exists, too. There's also the browser extensions. I know web extensions are sandboxed, but does that include preventing a malicious extension from capturing the keystrokes from your password manager's master password text box? Each of these companies also has a website UI where you can view/manage your passwords; they load data into local storage - thus not being decrypted on the server side - but these are still vulnerable to cross-site scripting attacks, etc. I think it's inevitable that one of the major password managers will wind up being compromised. Such an event would be catastrophic.
  - kerkeslager 9y ago
    Sure, it's possible to use a badly-designed password manager, such as using a centralized or closed-source password manager. I'd say this is still more secure than using the same password everywhere, because it only involves trusting one entity with the keys to everything, rather than trusting multiple entities with the keys to everything. But it's definitely a bad security practice. The password manager I use is KeePassX. In both the KeePass and KeePassX varieties it stores the passwords locally, so the only vulnerability you mentioned that it's vulnerable to is that malicious code would get into the source. One would hope that this would be caught by auditing, but of course it's always possible it wouldn't be. However, this is a only a possibility: it's guaranteed that one of the sites I log into with a password will leak that password at some point. So using KeePassX is definitely safer than using the same password everywhere. > I think it's inevitable that one of the major password managers will wind up being compromised. Such an event would eclipse the Equifax breach. Sure, if it's one of the password stores that stores its passwords centrally. But that idea is so backward that I barely consider such systems to be password managers--I'd file those under the "Joe's totally-not-a-password-collection-scheme website". The simple answer is don't use those. If it's one of the password stores that stores passwords locally, then it will only leak passwords of users who update their password store software between the breach and when the breach is discovered. You can come up with scenarios where any password scheme will be broken if a user does completely the wrong thing, like posting their password publicly. That doesn't mean password managers are a bad idea, it just means there's no such thing as an idiot-proof security system.
- username223 9y ago
  This. For ordinary people, the key to security is avoiding centralized data stores for sensitive information. If someone hacks a website I use, they will only get that one random password. If they want to get my master password, they need to break into my home computer, in which case they'll only get access to a single person's digital life, which is probably not worth the effort. If Mossad or the NSA wants to steal my passwords, they will get them, but I'm just some random nobody, so that's not my threat model.

by platz 9y ago

kerkeslager 9y ago

> using your logic, only one (master) password has to be compromised for a massive escalation in privilege. No, if you got my master password somehow, you'd also have to gain access to my thumb drive or backup hard drive where I have the password database. That can definitely be done; I have no illusions about the impenetrability of my personal security. But there's a very large incentive for hackers to compromise large databases of passwords from popular websites, and very little incentive for them to compromise my personal password DB. Additionally, my master password is the strongest of my passwords, with about 124 bits of entropy, so this narrow point of failure is strong relative to my other passwords. The strength of security at the various websites I use is unknown, and if I use the same password for all of them, only one has to fail for my password to be exposed. Obviously it's still possible that my password could be collected by a keylogger or some such, but that's a lot less likely than that one of the 100+ websites I've ever put a password into gets compromised. This has been fairly thoroughly discussed ad nauseum elsewhere--the argument you're making has been made and debunked many times, so let's not rehash tired arguments.

developer2 9y ago
A hack against your password manager isn't going to be targeted at you as an individual. It will happen to one of the major companies who develop the software. The security of the product is only as good as the weakest link at the company. Where is their source control stored - GitHub? How strong are the passwords of the developers (and managers, etc.) who have access? Do they use two-factor auth? How easy is it to social engineer one's way in, and add a commit to the app so that the next release decrypts all credentials and sends them to the hacker's remote endpoint? It's probably 3-5 lines of code to sneak in. The possibility of a "disgruntled/ambitious employee" exists, too. There's also the browser extensions. I know web extensions are sandboxed, but does that include preventing a malicious extension from capturing the keystrokes from your password manager's master password text box? Each of these companies also has a website UI where you can view/manage your passwords; they load data into local storage - thus not being decrypted on the server side - but these are still vulnerable to cross-site scripting attacks, etc. I think it's inevitable that one of the major password managers will wind up being compromised. Such an event would be catastrophic.
- kerkeslager 9y ago
  Sure, it's possible to use a badly-designed password manager, such as using a centralized or closed-source password manager. I'd say this is still more secure than using the same password everywhere, because it only involves trusting one entity with the keys to everything, rather than trusting multiple entities with the keys to everything. But it's definitely a bad security practice. The password manager I use is KeePassX. In both the KeePass and KeePassX varieties it stores the passwords locally, so the only vulnerability you mentioned that it's vulnerable to is that malicious code would get into the source. One would hope that this would be caught by auditing, but of course it's always possible it wouldn't be. However, this is a only a possibility: it's guaranteed that one of the sites I log into with a password will leak that password at some point. So using KeePassX is definitely safer than using the same password everywhere. > I think it's inevitable that one of the major password managers will wind up being compromised. Such an event would eclipse the Equifax breach. Sure, if it's one of the password stores that stores its passwords centrally. But that idea is so backward that I barely consider such systems to be password managers--I'd file those under the "Joe's totally-not-a-password-collection-scheme website". The simple answer is don't use those. If it's one of the password stores that stores passwords locally, then it will only leak passwords of users who update their password store software between the breach and when the breach is discovered. You can come up with scenarios where any password scheme will be broken if a user does completely the wrong thing, like posting their password publicly. That doesn't mean password managers are a bad idea, it just means there's no such thing as an idiot-proof security system.
username223 9y ago
This. For ordinary people, the key to security is avoiding centralized data stores for sensitive information. If someone hacks a website I use, they will only get that one random password. If they want to get my master password, they need to break into my home computer, in which case they'll only get access to a single person's digital life, which is probably not worth the effort. If Mossad or the NSA wants to steal my passwords, they will get them, but I'm just some random nobody, so that's not my threat model.