4 ms·
>Are those password managers listed really "better" than onepass or lastpass? If so, why? The main point seems to be that they're either local or able to be se
by iotku 8y ago
>Are those password managers listed really "better" than onepass or lastpass? If so, why?
The main point seems to be that they're either local or able to be self hosted.
In theory online password manager service providers could be forced (or otherwise compromised) to access a user's password database or interface to said database.
Encryption could be potentially worse than the more commercial offering if implemented wrong, but you can also restrict access better to local/self-hosted databases.
>Shouldn't, I want to pay money for my password manager?
Not if it's unnecessary to do so, and it also adds a paper trail relating your account to your passwords etc should they be compromised.
Personally that's pretty far out of my threat model, but I still have my password DB locally because I figure if someone compromises my computer they'll get my passwords anyways (keyloggers, etc), but at least an online service I have no control of wont get compromised and affect me.
Only real difficulty with local keepass databases is keeping them synced/up to date on my devices.
- xvector 8y ago> In theory online password manager service providers could be forced (or otherwise compromised) to access a user's password database or interface to said database. Could they really, though? 1Password, for example, extensively details their client-side encryption protocol. Unless they were forced to distribute a compromised client, there's really no downside to using it.
- iotku 8y ago>1Password, for example, extensively details their client-side encryption protocol. Unless they were forced to distribute a compromised client Not particularly familiar with the methods 1Password uses, but that is the general theory. It's pretty out there and you'd likely have to be in pretty deep for a government (or some other attacker) to try and pull something like that (especially just to hit you personally). There's similar pie in the sky arguments for most software on your computer that will auto update as well I suppose (Windows Update, Google Chrome, whatever...). I don't think it's a realistic concern for most people, but if your life (or your freedom) depended on your password manager you'd want the least amount of points of failure possible.