3 ms·
As long as they encrypt the stored passwords and you don't use your master password anywhere else, there's not much that can go wrong.
by _bxg1 8y ago
As long as they encrypt the stored passwords and you don't use your master password anywhere else, there's not much that can go wrong.
- meowface 8y agoThe browser extensions can provide a big attack surface. But otherwise, you're right.
- bigiain 8y agoUnless, say, someone uploaded malicious code to a repo with a dependancy the password manager pulls in which changes that behaviour... Some code somewhere needs to be able to decrypt all those stored encrypted passwords - that code is a _super_ high value target. I like/use/recommend/have-paid-for 1Password for 5-6 years now - but I worry that the online and 1Password for Teams implementation - even though I trust the 1Password team to "get it right" - has got to be a really "fun" target for sufficiently motivated and resourced attackers. (If I were sitting round at the NSA looking for a fun project - automated MITM of 1Password traffic at p0wned or backdoored-by-agreement carrier or IX routers, using trusted root CA certs to create legitimate-seeming SSL certs, and on-the-wire JavaScript code injection... I reckon I could sell that to my super-sekrit-PHB as a worthwhile research project. )
- kenneth 8y agoI use self-synced standalone 1Password for this reason. Much smaller attach surface.