3 ms·
This is not true. If malware runs on your machine and there is no password manager storing 1400 passwords, the malware cannot pivot to 1400 destinations. Howeve
by kerng 7y ago
This is not true. If malware runs on your machine and there is no password manager storing 1400 passwords, the malware cannot pivot to 1400 destinations. However, if there is a password manager on the device that the malware gains access to and it would indeed store 1400 passwords in one place, then all 1400 assets are compromised at once.
I think that's what the previous commenter wanted to highlight.
In the end it's about managing risks, I would use different locations for storing passwords depending on value. Like really important ones go elsewhere and are not on the device I use everyday for browsing the Internet or reading email.
- UncleMeat 7y agoYou'll presumably access those services eventually. And for the huge majority of people if they are memorizing a password for a infrequently used service means using a shitty password. "Even though the malware has access to my email, which I presumably login to with frequency, and therefore can perform password resets for many services, I might notice it and reformat my machine before I login to some other important service" is not exactly a compelling threat model.
- kerng 7y agoThe comment didnt talk about memorizing passwords, it's more about storing password manager files offline for very valuable assets. It would not be smart to store crypto currency private keys or recovery pass words on main computer for instance.