6 ms·

Unpopular opinion: using a password manager as a service is as bad as password reuse: all your passwords behind a single password.

corytheboyd 6y ago
...no, it’s not at all the same thing
iamdbtoo 6y ago
So then what would you suggest?
- TheDong 6y ago
  Presumably the alternative to 'a password manager as a service' is 'a local password database and password manager which is not a service'. This can be something like password store, or keepass, where the attacker needs both your password database unlock key / gpg passphrase, but also needs access to the database / gpg keys, which means either physical access, or at least access to your local files. I think there is some merit to pointing this out. If 1password allows anyone to make login attempts against their service, that means some bored teenager with a botnet can make attempts at your password. I use password-store, and I could tell you my gpg passphrase right now, but you still couldn't access any of my passwords. You'd need to get access to my yubikey and my psasword repository before you could do anything with that passphrase at all. I think it's true that a setup like mine, which requires a physical hardware token to decrypt my passwords, is more secure than a password service, however I also think the parent comment is totally wrong. 1password without a hw token isn't the most secure option, but it's way better than password reuse on random sites.
  - gilrain 6y ago
    > If 1password allows anyone to make login attempts against their service, that means some bored teenager with a botnet can make attempts at your password. They would need to guess both your master password and your 128 bit secret key. https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
  - eigenspace 6y ago
    I can agree that a 'password manager' as a service is less secure than a 'local password database that's not a service', but that's not the comparison the OP made. They compared passwords as a service to reusing a single password and said it was the same, which IMO is foolish.
  - adambyrtek 6y ago
    I've never used 1Password, but both LastPass and Bitwarden support hardware tokens like Yubikey for two-factor authentication. Keeping the encrypted store locally might give you some edge, but I personally need to be able to access secrets from more than one device, and once you allow external access then the advantage of your solution compared to hosted services disappears.
    - TheDong 6y ago
      I don't think the advantage completely disappears. Let's look at one possible attack: the attacker knows all my passwords, and they manage to steal my laptop from my car. What can they do in each scenario? In the case of lastpass, bitwarden, or keepass, the attacker now has all my passwords. The 2fa token was used once in the past, so all the passwords are stored on the device, protected only by a password at most. In the case of password-store with my gpg-private-key on the yubikey, the attacker still can't decrypt anything unless they also stole my yubikey, which I never leave unattended. The fact that my private key on my yubikey isn't just required to sync or login (like it is for the 2fa case), but is rather where the actual decryption is done every single time I access a password, does have a difference. I don't think the difference is very large though, no.
murermader 6y ago
In order to log in, you need a (really long) secret key + a strong password, that should not be used anywhere else. That is pretty secure. The secret key can be kept save, because it is only required once for each device, when you log in the first time.
eigenspace 6y ago
Honestly, I think your opinion is unpopular because it demonstrates a serious lack of understanding or thought. If you re-use the same password for all sites, it takes just one sketchy site being compromised for all of your other sites to become compromised. In the case of a password manager, the manager itself is the one that needs to be compromised, and you have more reason to trust them to avoid being compromised than some other random site. Some random sketchy website being hacked doesn't need to effect the rest of your network of logins if you use a manager. Most password managers (such as 1password) won't let anyone from any machine access your stored passwords over the web by just supplying your single password. They require multiple extra steps that are quite limiting, so for the most part they first need access to a computer that you've already installed your password manager on. Furthermore, if your password manager is compromised, you have a very clear path to your password on that manager, and then a list of all the websites, usernames and passwords that you need to change in order to regain secruity. By contrast, I'm still rediscovering old websites I used 10 years ago that used my old omni-password which was compromised.
- 29athrowaway 6y ago
  Your mistake is assuming I had not thought of that. I have, and my position remains the same.
  - eigenspace 6y ago
    Then you should explain why you think what you think instead of just throwing around self proclaimed "unpopular opinions" without any explanation. With the information you've provided (i.e. none), it really just looks like an uninformed opinion. Why do you think the points I listed above don't make password managers more secure than password reuse?
  - luhn 6y ago
    Do you have a counterpoint, or do you have this opinion solely for the sake of having a contentious opinion?
    - 6y ago
NikolaeVarius 6y ago
I have MFA. Have fun
- 29athrowaway 6y ago
  As if SMS was secure. Your phone company will believe any random person to be you. Not all factors are secure.
  - NikolaeVarius 6y ago
    I dont think my yubikey receives SMS
    - 29athrowaway 6y ago
      Yubikeys are secure, but the most popular second factor is SMS, followed by authenticators, which are better than SMS in my opinion. MFA does not imply bulletproof security.
      - ssully 6y ago
        Well since this discussion is in a thread about 1password I think it's worth pointing out that 1password doesn't even support SMS as an MFA option [1]. [1]: https://support.1password.com/two-factor-authentication/ https://support.1password.com/two-factor-authentication/
  - gilrain 6y ago
    1Password does not use SMS for 2FA.
Lazare 6y ago
You're totally right. As long as you have a different, secure password for every site and service, and you keep a careful list of all of them, and make sure to keep this list backed up, and encrypted, and sync this list across your devices so you have access to it when and where needed, then you totally don't need a password manager. ...oh wait, that's literally a password manager. Sometimes opinions are unpopular for good reasons.
mekster 6y ago
Have you heard of 2fa? Master password alone won't unlock the rest of passwords.

corytheboyd 6y ago

...no, it’s not at all the same thing

iamdbtoo 6y ago

So then what would you suggest?

TheDong 6y ago
Presumably the alternative to 'a password manager as a service' is 'a local password database and password manager which is not a service'. This can be something like password store, or keepass, where the attacker needs both your password database unlock key / gpg passphrase, but also needs access to the database / gpg keys, which means either physical access, or at least access to your local files. I think there is some merit to pointing this out. If 1password allows anyone to make login attempts against their service, that means some bored teenager with a botnet can make attempts at your password. I use password-store, and I could tell you my gpg passphrase right now, but you still couldn't access any of my passwords. You'd need to get access to my yubikey and my psasword repository before you could do anything with that passphrase at all. I think it's true that a setup like mine, which requires a physical hardware token to decrypt my passwords, is more secure than a password service, however I also think the parent comment is totally wrong. 1password without a hw token isn't the most secure option, but it's way better than password reuse on random sites.
- gilrain 6y ago
  > If 1password allows anyone to make login attempts against their service, that means some bored teenager with a botnet can make attempts at your password. They would need to guess both your master password and your 128 bit secret key. https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- eigenspace 6y ago
  I can agree that a 'password manager' as a service is less secure than a 'local password database that's not a service', but that's not the comparison the OP made. They compared passwords as a service to reusing a single password and said it was the same, which IMO is foolish.
- adambyrtek 6y ago
  I've never used 1Password, but both LastPass and Bitwarden support hardware tokens like Yubikey for two-factor authentication. Keeping the encrypted store locally might give you some edge, but I personally need to be able to access secrets from more than one device, and once you allow external access then the advantage of your solution compared to hosted services disappears.
  - TheDong 6y ago
    I don't think the advantage completely disappears. Let's look at one possible attack: the attacker knows all my passwords, and they manage to steal my laptop from my car. What can they do in each scenario? In the case of lastpass, bitwarden, or keepass, the attacker now has all my passwords. The 2fa token was used once in the past, so all the passwords are stored on the device, protected only by a password at most. In the case of password-store with my gpg-private-key on the yubikey, the attacker still can't decrypt anything unless they also stole my yubikey, which I never leave unattended. The fact that my private key on my yubikey isn't just required to sync or login (like it is for the 2fa case), but is rather where the actual decryption is done every single time I access a password, does have a difference. I don't think the difference is very large though, no.

murermader 6y ago

In order to log in, you need a (really long) secret key + a strong password, that should not be used anywhere else. That is pretty secure. The secret key can be kept save, because it is only required once for each device, when you log in the first time.

eigenspace 6y ago

Honestly, I think your opinion is unpopular because it demonstrates a serious lack of understanding or thought. If you re-use the same password for all sites, it takes just one sketchy site being compromised for all of your other sites to become compromised. In the case of a password manager, the manager itself is the one that needs to be compromised, and you have more reason to trust them to avoid being compromised than some other random site. Some random sketchy website being hacked doesn't need to effect the rest of your network of logins if you use a manager. Most password managers (such as 1password) won't let anyone from any machine access your stored passwords over the web by just supplying your single password. They require multiple extra steps that are quite limiting, so for the most part they first need access to a computer that you've already installed your password manager on. Furthermore, if your password manager is compromised, you have a very clear path to your password on that manager, and then a list of all the websites, usernames and passwords that you need to change in order to regain secruity. By contrast, I'm still rediscovering old websites I used 10 years ago that used my old omni-password which was compromised.

29athrowaway 6y ago
Your mistake is assuming I had not thought of that. I have, and my position remains the same.
- eigenspace 6y ago
  Then you should explain why you think what you think instead of just throwing around self proclaimed "unpopular opinions" without any explanation. With the information you've provided (i.e. none), it really just looks like an uninformed opinion. Why do you think the points I listed above don't make password managers more secure than password reuse?
- luhn 6y ago
  Do you have a counterpoint, or do you have this opinion solely for the sake of having a contentious opinion?
  - 6y ago

NikolaeVarius 6y ago

I have MFA. Have fun

29athrowaway 6y ago
As if SMS was secure. Your phone company will believe any random person to be you. Not all factors are secure.
- NikolaeVarius 6y ago
  I dont think my yubikey receives SMS
  - 29athrowaway 6y ago
    Yubikeys are secure, but the most popular second factor is SMS, followed by authenticators, which are better than SMS in my opinion. MFA does not imply bulletproof security.
    - ssully 6y ago
      Well since this discussion is in a thread about 1password I think it's worth pointing out that 1password doesn't even support SMS as an MFA option [1]. [1]: https://support.1password.com/two-factor-authentication/ https://support.1password.com/two-factor-authentication/
- gilrain 6y ago
  1Password does not use SMS for 2FA.

Lazare 6y ago

You're totally right. As long as you have a different, secure password for every site and service, and you keep a careful list of all of them, and make sure to keep this list backed up, and encrypted, and sync this list across your devices so you have access to it when and where needed, then you totally don't need a password manager. ...oh wait, that's literally a password manager. Sometimes opinions are unpopular for good reasons.

mekster 6y ago

Have you heard of 2fa? Master password alone won't unlock the rest of passwords.