3 ms·

Off topic : does anyone know why using these kind of software would be more secure than storing the password ourselves in text files ? I fail to understand as h

Off topic : does anyone know why using these kind of software would be more secure than storing the password ourselves in text files ? I fail to understand as hackers / virus makers just now need to hack one software to get everything

ghostly_s 8y ago
Password managers facilitate password strength best-practices, which without them have ~0% adoption rate.
entee 8y ago
They don’t store the password, they store the cyphertext where your single longer password is part of the key. If you wanted to do things that way yourself, my understanding is that you’d be just as secure if you stored the cypher text in a file on your computer. Also these companies provide nice integrations with web browsers and OSes which makes using complicated passwords easier. It’s true that a hacker with your master password would own the keys to your life, but that’s often true in general: despite repeated requests to not have a single password, most people have a one or just a few passwords they reuse everywhere. This is a better way because you can focus on remembering one big password, add 2FA, and have unique, complex passwords everywhere else.
- ttoinou 8y ago
  Now hackers only need to focus on such application like password manager and they can impersonate you
e12e 8y ago
If you are able to remember and type different passwords that encode 96-128 bits of entropy for all your services, logins and passphrase needs, without re-using a password or elements of it; then sure: it might be "more" secure to just use passwords. I haven't looked too closely at 1password - but with for example bitwarden the master password is used via kdf to encrypt all data client side. If you don't self-host - you're still just a single service away from compromise (an attacker could log the passphrase in a compromised client) - but on balance I'd say it's more secure than trying to memorize dozens or more strong passwords.
jjeaff 8y ago
Seems obvious, these managers store the passwords in an encrypted file. Requiring one (hopefully) really good password to lock it all down plus a 2nd factor option like ttop or fingerprint. I only have to remember one long complex password that I have never used anywhere else and that secures and encrypts all my other passwords. And rather than searching and copy pasting, a browser extension can fill in passwords when I request. Add to that, a password manager generates a long and complex and unique password for every account I have so I don't have to make one up or go to another source to create it. And one of the coolest features, though it doesn't work everywhere and I am only familiar with LastPass, is its ability to automatically change passwords. On certain sites, I can tell it to rotate all the passwords in my file. It logs in and makes the changes for me.
- ttoinou 8y ago
  You can encrypt a text file on your computer as well. Doesn't change the fact that once decoded in memory or sent via the web browser it's all clear what your password are (here are the true security threats)...

ghostly_s 8y ago

Password managers facilitate password strength best-practices, which without them have ~0% adoption rate.

entee 8y ago

They don’t store the password, they store the cyphertext where your single longer password is part of the key. If you wanted to do things that way yourself, my understanding is that you’d be just as secure if you stored the cypher text in a file on your computer. Also these companies provide nice integrations with web browsers and OSes which makes using complicated passwords easier. It’s true that a hacker with your master password would own the keys to your life, but that’s often true in general: despite repeated requests to not have a single password, most people have a one or just a few passwords they reuse everywhere. This is a better way because you can focus on remembering one big password, add 2FA, and have unique, complex passwords everywhere else.

ttoinou 8y ago
Now hackers only need to focus on such application like password manager and they can impersonate you

e12e 8y ago

If you are able to remember and type different passwords that encode 96-128 bits of entropy for all your services, logins and passphrase needs, without re-using a password or elements of it; then sure: it might be "more" secure to just use passwords. I haven't looked too closely at 1password - but with for example bitwarden the master password is used via kdf to encrypt all data client side. If you don't self-host - you're still just a single service away from compromise (an attacker could log the passphrase in a compromised client) - but on balance I'd say it's more secure than trying to memorize dozens or more strong passwords.

jjeaff 8y ago

Seems obvious, these managers store the passwords in an encrypted file. Requiring one (hopefully) really good password to lock it all down plus a 2nd factor option like ttop or fingerprint. I only have to remember one long complex password that I have never used anywhere else and that secures and encrypts all my other passwords. And rather than searching and copy pasting, a browser extension can fill in passwords when I request. Add to that, a password manager generates a long and complex and unique password for every account I have so I don't have to make one up or go to another source to create it. And one of the coolest features, though it doesn't work everywhere and I am only familiar with LastPass, is its ability to automatically change passwords. On certain sites, I can tell it to rotate all the passwords in my file. It logs in and makes the changes for me.

ttoinou 8y ago
You can encrypt a text file on your computer as well. Doesn't change the fact that once decoded in memory or sent via the web browser it's all clear what your password are (here are the true security threats)...