4 ms·

serious question: why not? If you don't trust a password manager to hold a master password for another password manager, can you trust it to hold your other pa

by chias 6y ago

serious question: why not? If you don't trust a password manager to hold a master password for another password manager, can you trust it to hold your other passwords / whatever else you store in your password manager?

filmgirlcw 6y ago
I don’t have an issue having a master password for one password manager stored inside another; I DO think having it in a web browser's built-in password manager is a bad idea, particularly because most browser password managers don’t require authentication to use (unless you’re logging into the browser for the first time). If someone gets access to my unlocked machine and can get into my web browser, they could potentially get into my other password manager to retrieve important information. That’s a very bad thing. Sometimes you’re required to enter a password to retrieve/view saved passwords in a web browser, sometimes you aren’t — but it is very rare that the built-in password manager requires authentication for auto-fill. As a general rule, I don’t use Chrome's built-in password manager for anything sensitive because it didn’t require prior authentication to view stored passwords (it may have changed now, but I’m not sure), and the same is true for autofill of my 1Password master password and security key on ANY platform. I don’t want someone to be able to autofill and get access to all my data.
CivBase 6y ago
Isn't the point of a password manager that you only have to remember one password? If you put it in another password manager, then you have to remember that password instead, so have you really improved the situation? Plus it just adds extra, unnecessary attack vectors since there are now two attackable points of authentication for your first password manager and three attackable points for any accounts managed by that password manager.
PhilosAccnting 6y ago
I'm still hashing out the details, but essentially cybersecurity has one major flaw: nothing is immaculate. At least the way I see it, good CySec is creating a chain of dependent constraints (e.g., password-protect a file, which uses a password stored in another file, encrypted with a password, etc.). Wherever that chain comes out is the "entry-point". A password you forgot is as bad as deleting one of the links in the chain. Thus, there's no perfect solution, and cybersecurity professionals make a lot of money on the ensuing fear from that.

by chias 6y ago

filmgirlcw 6y ago

I don’t have an issue having a master password for one password manager stored inside another; I DO think having it in a web browser's built-in password manager is a bad idea, particularly because most browser password managers don’t require authentication to use (unless you’re logging into the browser for the first time). If someone gets access to my unlocked machine and can get into my web browser, they could potentially get into my other password manager to retrieve important information. That’s a very bad thing. Sometimes you’re required to enter a password to retrieve/view saved passwords in a web browser, sometimes you aren’t — but it is very rare that the built-in password manager requires authentication for auto-fill. As a general rule, I don’t use Chrome's built-in password manager for anything sensitive because it didn’t require prior authentication to view stored passwords (it may have changed now, but I’m not sure), and the same is true for autofill of my 1Password master password and security key on ANY platform. I don’t want someone to be able to autofill and get access to all my data.

CivBase 6y ago

Isn't the point of a password manager that you only have to remember one password? If you put it in another password manager, then you have to remember that password instead, so have you really improved the situation? Plus it just adds extra, unnecessary attack vectors since there are now two attackable points of authentication for your first password manager and three attackable points for any accounts managed by that password manager.

PhilosAccnting 6y ago

I'm still hashing out the details, but essentially cybersecurity has one major flaw: nothing is immaculate. At least the way I see it, good CySec is creating a chain of dependent constraints (e.g., password-protect a file, which uses a password stored in another file, encrypted with a password, etc.). Wherever that chain comes out is the "entry-point". A password you forgot is as bad as deleting one of the links in the chain. Thus, there's no perfect solution, and cybersecurity professionals make a lot of money on the ensuing fear from that.