3 ms·

Let's put our passwords on a remote server which convinces us they're secure. How did we even get here that such information leaves our control?

fullstop 7y ago
Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how. It's not the best option, of course, but certainly better than weak and reused passwords, right?
- sys_64738 7y ago
  Is convenience more important than security? That's what you're saying here.
  - fullstop 7y ago
    No. I'm saying that the vast majority of people are not capable of doing this, and that it's a better option than weak passwords.
  - rodgerd 7y ago
    Convenience is security.
  - stordoff 7y ago
    Before using a password manager: I'm using short, memorable (often repeated) passwords that are rarely, if ever, changed. After using a password manager: I'm using long (generally 64 characters), unique passwords, and if one is compromised, it's a 30s job to change it on all of my devices. Convenience _enables_ security. I could probably roll my syncing solution, but I would _not_ be convinced it is secure (I don't have that level of expertise), and I would probably end up using a third party anyway (Dropbox/Digital Ocean). I'm not going to sync it manually to the 6 or so devices I regularly use, plus others I use less frequently (it may be more secure, but it's not practical). Because it's low friction, I end up using it more, so it's a _net_ gain in security, even if it isn't perfect.
cuillevel3 7y ago
In theory they can do more security, than you get when you just store a keepass file on a server. Things like temporarily blocking access when GeoIP information for the client changes, or a lot of secrets are accessed in bulk. The keepass file, you only lose once and the attacker has years (or up to your next rotation) to crack it.

fullstop 7y ago

Most people access services from more than one device and are not capable of rolling, managing, and securing their own synchronized password database. That's how. It's not the best option, of course, but certainly better than weak and reused passwords, right?

sys_64738 7y ago
Is convenience more important than security? That's what you're saying here.
- fullstop 7y ago
  No. I'm saying that the vast majority of people are not capable of doing this, and that it's a better option than weak passwords.
- rodgerd 7y ago
  Convenience is security.
- stordoff 7y ago
  Before using a password manager: I'm using short, memorable (often repeated) passwords that are rarely, if ever, changed. After using a password manager: I'm using long (generally 64 characters), unique passwords, and if one is compromised, it's a 30s job to change it on all of my devices. Convenience _enables_ security. I could probably roll my syncing solution, but I would _not_ be convinced it is secure (I don't have that level of expertise), and I would probably end up using a third party anyway (Dropbox/Digital Ocean). I'm not going to sync it manually to the 6 or so devices I regularly use, plus others I use less frequently (it may be more secure, but it's not practical). Because it's low friction, I end up using it more, so it's a _net_ gain in security, even if it isn't perfect.

cuillevel3 7y ago

In theory they can do more security, than you get when you just store a keepass file on a server. Things like temporarily blocking access when GeoIP information for the client changes, or a lot of secrets are accessed in bulk. The keepass file, you only lose once and the attacker has years (or up to your next rotation) to crack it.