4 ms·

No password manager supports multiple levels of security conveniently, so I'm forced to use two managers. For web browsing, passwords often protect the site no

No password manager supports multiple levels of security conveniently, so I'm forced to use two managers. For web browsing, passwords often protect the site not me (magazine logins...). One wants a manager to stay open during browsing sessions, so one doesn't have to type the master password for every single use. For financial transactions, one wants zero risk of someone cracking your financial security because they enjoyed thirty seconds physical access while you stepped away from your desk. (Be reasonable: No one is going to set up a proximity monitor that locks their screen if they lean back in their chair, any more than they'll rig a trip wire shotgun to protect their data. Don't propose a version of this. I want convenience, so secure data needs extreme protection, not my browser during thirty second gaps.) I've begged 1Password for years to allow certain passwords to be marked "secure" invoking all obvious measures: A second password needed to unlock, immediately locks again after use. No dice. They've tried offering a few alternatives that are so inconvenient that using a second manager is frankly easier. Remember how Steve Jobs made his fortune: the iPod assumed people were stupid. The flat file system was corrected in the first year of the Mac, but reintroduced for the iPod for "ease of use". Similarly, I honestly don't believe that password managers are foremost concerned with security. They're concerned with sales. Dashlane is no better, but it's a second system that I prefer for financial passwords.

geofft 7y ago
If you step away from your desk for thirty seconds, I can install malware that captures your financial passwords (and cookies) next time you log in. The reason password managers universally don't support the feature you request is that they'd be giving their users a false sense of security. You don't have extreme protection at all. I'm sorry, I wish computers didn't work this way, but they do, and you have to keep yourself secure in the world as it exists and not in the world as you wish it were. The usual way of solving this in corporate scenarios is to keep the office physically secure such that no outsider can get to someone's desktop in a tiny window without being noticed, and them set the screen to lock after a minute or so. For personal computers, don't leave your laptop unlocked at the cafe when you go to pick up your coffee. Get in the habit of closing your lid.
blowski 7y ago
Can I rephrase your idea - you're suggesting to have a 'flag' on some passwords so that, for those passwords, you have to re-enter the key every time? Initially, it sounds like a great idea - like how I can use my computer if it's unlocked, but need to re-enter the password to install something. What makes you think 1Password aren't introducing this because they care more about sales than security? In general, I've found 1Password to care a huge amount about security because if somebody proves them to be insecure, it will have a huge effect on their sales. Security and their bottom line go together.

geofft 7y ago

If you step away from your desk for thirty seconds, I can install malware that captures your financial passwords (and cookies) next time you log in. The reason password managers universally don't support the feature you request is that they'd be giving their users a false sense of security. You don't have extreme protection at all. I'm sorry, I wish computers didn't work this way, but they do, and you have to keep yourself secure in the world as it exists and not in the world as you wish it were. The usual way of solving this in corporate scenarios is to keep the office physically secure such that no outsider can get to someone's desktop in a tiny window without being noticed, and them set the screen to lock after a minute or so. For personal computers, don't leave your laptop unlocked at the cafe when you go to pick up your coffee. Get in the habit of closing your lid.

blowski 7y ago

Can I rephrase your idea - you're suggesting to have a 'flag' on some passwords so that, for those passwords, you have to re-enter the key every time? Initially, it sounds like a great idea - like how I can use my computer if it's unlocked, but need to re-enter the password to install something. What makes you think 1Password aren't introducing this because they care more about sales than security? In general, I've found 1Password to care a huge amount about security because if somebody proves them to be insecure, it will have a huge effect on their sales. Security and their bottom line go together.