2 ms·
Either the key is stored unencrypted on a physical device, which can likely be seized by an attackers who has access to the ciphertext, or is encrypted with a p
by dharmab 7y ago
Either the key is stored unencrypted on a physical device, which can likely be seized by an attackers who has access to the ciphertext, or is encrypted with a passphrase. This isn't doing anything the master key and passphrase isn't already doing. (The key you input is not the key used to encrypt the data.)
- acqq 7y agoThe advantage of using a long key (generated randomly) is that bruteforcing of the material protected with the key is impossible, which does matter in some scenarios: specifically, if one trusts the container format, knows that the container will be accessible to the potential attackers who can try to brute force it, but also knows that the rest (the long key used) won’t be accessible to the said attackers. Which can be a reasonable scenario. Whoever uses a password manager should use reasonably long keys generated randomly. The real problem, like always, is key management. And knowing what is “overkill” for a given scenario, i.e. where reasonability ends. 8 MB is really something that should have some additional reasons than just protection from brute forcing the key.