3 ms·

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple p

There’s something that I don’t really understand regarding password managers which maybe you could explain. How is using a password manager to manage multiple passwords more secure than using a single password everywhere? In the case of a password manager, if your computer is breached, then all passwords are breached. If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached. In the case of using the same password everywhere, if one website is breached, then the password to all sites is breached. Am I missing something?

CJefferson 8y ago
Think of it this way -- your password managers password never gets passed to untrustworthy websites, so there is a very small chance it would ever get breached. You now only have to trust one website/program, rather than every website (and we have evidence that many major websites can't be trusted with our passwords).
itmeyou 8y ago
When using a single password for all sites, any malicious or breached website exposes access to all your accounts. When using a password manager, only a breach of your computer or the password manager itself (or your email) will totally pwn you. Breaches online are very, very common, and I would expect any password used on every single website you use to get leaked quickly.
zeeZ 8y ago
If your computer is "breached" then it doesn't matter where your passwords come from. They could just run a keylogger and get them that way. It really depends on your threat model. No system is perfect and we're mostly balancing security and convenience most of the time. The same password everywhere is super convenient, but only one site needs to fail and it's all over. A cloud password manager with unique passwords protect from that. A local password manager eliminates the threat of them being compromised, but is less convenient if you have multiple devices. Storing your passwords offline on paper in a safe protects your from someone getting read access to your PC or outright stealing it, but is annoying and gets more inconvenient based on your passwords entropy.
- deleted 8y ago
  [deleted]
simion314 8y ago
The password for the password manager is only in my brain, the only way to get it is to install a keylogger on my machine. If instead I used it on all 30 + websites that requier login the only thing you need to do it is to hack or wait for one of this sites to get hacked and get it from there, then login with it in all this websites. I had used the one password on most websites years ago(I did not known better back then but I did used different password for my important email account), I think my credentials were leacked in 5 data leaks and hackers are still attempting to login with my old credentials in present. The only time this affected me when someone hacked and stole my Minecraft account but I got it back.
FatDrunknStupid 8y ago
Password manager and correct a letter = very secure. Even if some one has access to your kit.
dwighttk 8y ago
>if your computer is breached >if that [one] website is breached >if one [any] website is breached Not one of those things is like the others.
MaulingMonkey 8y ago
I've probably made accounts with 100+ or so different websites or services. Eventually this turns into a game of statistics: https://haveibeenpwned.com/ https://haveibeenpwned.com/ lists no less than 6 mass breaches my account details have ended up in through no fault of my own, all of them including at least email addresses and password hashes (if not plaintext passwords) (edit: Actually, I've recalled at least a 7th service that has been compromised that HIBP doesn't list) That's either 6 times my bank account password gets leaked... or 0 times if I use unique passwords. I strongly suspect there are more breaches that HIBP simply isn't aware of with my information in them. Additionally, I need to rotate either 600 (!) or merely 6 different passwords to re-secure my accounts. So, obviously, unique passwords are a big win here. > If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached. I use an offline password manager specifically because of this reason. Still, needing to pwn any of 5 targets to get my bank account (me, my bank, my password service, my email provider, or my phone provider) isn't much worse than needing to pwn any of 4 targets (me, my bank, my email provider, or my phone provider), and both are much better than needing to pwn any of 100+ targets, some of which have terrible security and are probably already pwned without even knowing it. So, options for unique passwords: Memorize 100+ strong unique passwords: I "can't" do this. Memorize 100+ weak unique passwords: Too weak to brute force attacks for my tastes. Use a memorizable unique password generation scheme: Not unique enough for my tastes. Memorize a few very strong unique passwords and use a password manager. This does have the weakness that capturing my master passwords via keylogger will get you all my accounts, instead of just all the important ones that I regularly use - but since "all the important ones that I regularly use" includes my email, that's just as good as pwning all of my accounts in my book.

CJefferson 8y ago

Think of it this way -- your password managers password never gets passed to untrustworthy websites, so there is a very small chance it would ever get breached. You now only have to trust one website/program, rather than every website (and we have evidence that many major websites can't be trusted with our passwords).

itmeyou 8y ago

When using a single password for all sites, any malicious or breached website exposes access to all your accounts. When using a password manager, only a breach of your computer or the password manager itself (or your email) will totally pwn you. Breaches online are very, very common, and I would expect any password used on every single website you use to get leaked quickly.

zeeZ 8y ago

If your computer is "breached" then it doesn't matter where your passwords come from. They could just run a keylogger and get them that way. It really depends on your threat model. No system is perfect and we're mostly balancing security and convenience most of the time. The same password everywhere is super convenient, but only one site needs to fail and it's all over. A cloud password manager with unique passwords protect from that. A local password manager eliminates the threat of them being compromised, but is less convenient if you have multiple devices. Storing your passwords offline on paper in a safe protects your from someone getting read access to your PC or outright stealing it, but is annoying and gets more inconvenient based on your passwords entropy.

deleted 8y ago
[deleted]

simion314 8y ago

The password for the password manager is only in my brain, the only way to get it is to install a keylogger on my machine. If instead I used it on all 30 + websites that requier login the only thing you need to do it is to hack or wait for one of this sites to get hacked and get it from there, then login with it in all this websites. I had used the one password on most websites years ago(I did not known better back then but I did used different password for my important email account), I think my credentials were leacked in 5 data leaks and hackers are still attempting to login with my old credentials in present. The only time this affected me when someone hacked and stole my Minecraft account but I got it back.

FatDrunknStupid 8y ago

Password manager and correct a letter = very secure. Even if some one has access to your kit.

dwighttk 8y ago

>if your computer is breached >if that [one] website is breached >if one [any] website is breached Not one of those things is like the others.

MaulingMonkey 8y ago

I've probably made accounts with 100+ or so different websites or services. Eventually this turns into a game of statistics: https://haveibeenpwned.com/ https://haveibeenpwned.com/ lists no less than 6 mass breaches my account details have ended up in through no fault of my own, all of them including at least email addresses and password hashes (if not plaintext passwords) (edit: Actually, I've recalled at least a 7th service that has been compromised that HIBP doesn't list) That's either 6 times my bank account password gets leaked... or 0 times if I use unique passwords. I strongly suspect there are more breaches that HIBP simply isn't aware of with my information in them. Additionally, I need to rotate either 600 (!) or merely 6 different passwords to re-secure my accounts. So, obviously, unique passwords are a big win here. > If your passwords are hosted encrypted on a website, then if that website is breached, the master password you send it will be visible to the attacker, and thus all passwords are breached. I use an offline password manager specifically because of this reason. Still, needing to pwn any of 5 targets to get my bank account (me, my bank, my password service, my email provider, or my phone provider) isn't much worse than needing to pwn any of 4 targets (me, my bank, my email provider, or my phone provider), and both are much better than needing to pwn any of 100+ targets, some of which have terrible security and are probably already pwned without even knowing it. So, options for unique passwords: Memorize 100+ strong unique passwords: I "can't" do this. Memorize 100+ weak unique passwords: Too weak to brute force attacks for my tastes. Use a memorizable unique password generation scheme: Not unique enough for my tastes. Memorize a few very strong unique passwords and use a password manager. This does have the weakness that capturing my master passwords via keylogger will get you all my accounts, instead of just all the important ones that I regularly use - but since "all the important ones that I regularly use" includes my email, that's just as good as pwning all of my accounts in my book.