6 ms·

Maybe you can't. Everybody has their own risk tolerance, but at some point, everybody's going to have to draw a line. Maybe you're only storing passwords for lo

Maybe you can't. Everybody has their own risk tolerance, but at some point, everybody's going to have to draw a line. Maybe you're only storing passwords for local services, but almost all of the credentials in my password manager are for services run on some cloud. Even then, did you evaluate all of the code for each of those services? How about the compiler code or the chips? Dell shipped out machines with a hardware trojan in 2010. I have separate instances for work and personal accounts, so one breach wouldn't affect the other. Since my passwords are distinct, the number of accounts that would actually be useful to them is minimal, and fraud response is a pretty important metric in deciding what companies I do important business with. Identity theft is a problem, but all of this is probably more likely to be leaked in some other database, like the Equifax hack, than through an account compromised in a password manager cloud storage breach. My password manager being compromised would indeed be a huge time suck, but I don't think the long-term consequences would be any more severe than a few key individual accounts that are probably even more vulnerable. I think things like coordinated attacks where they social engineer their way through 2FA— which have been seen in the wild— to present a greater real-world concern.

ifyoubuildit 5y ago
> Maybe you can't. Everybody has their own risk tolerance, but at some point, everybody's going to have to draw a line. I'm in agreement with parent, I think putting your passwords in the cloud is a wild single point of failure. Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet. I think people (in aggregate) just don't care about the risk and will take the path of least resistance. They don't have to draw the line there, but they will. > My password manager being compromised would indeed be a huge time suck, but I don't think the long-term consequences would be any more severe than a few key individual accounts that are probably even more vulnerable. Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc). Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised? I'm a bit of a crank though. I don't do any of the smart home stuff. I see my phone as a necessary evil. If some company shoehorned an app or a WiFi connection into their product, I don't buy it. After being in tech long enough, I just want things that work for me, not for the company I bought them from.
- avianlyric 5y ago
  > you're always a silent update away from it all being dumped on the internet. This is true of all password managers that have any ability to connect to the internet. You’re one silent update away from your manager suddenly uploading all your passwords to a random endpoint in Russia.
  - ifyoubuildit 5y ago
    Theoretically, if you audit the source then you only really need to care about updates to the actual code. If it doesn't do silent updates then it can't change underneath you, even if it does some kind of network operations. Its not fool proof, but it feels better than a black box that could be a different black box tomorrow or after the next acquisition or round of investment.
- chefandy 5y ago
  > Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet. This is also true for your operating system updates, browser, browser extensions, compilers, the infrastructure for your email service provider, any libraries those things use etc. Not to mention your local password manager. Even if you don't accept push updates, do you evaluate the code? What if the vulnerability was timed to pop a few weeks after release? What if it was included in an update that patched a major vulnerability so you went faster than your normal process afforded? Even if you have a local firewall that stops external connections from unrecognized programs— what if it's a whitelisted program or the operating system or the firewall itself? Why would you a password manager's encryption less than you would trust your email service's encryption? I'd bank on the password managers' being a lot more robust. What about RATs that could access your local password database? RATs are a lot more common than cloud service breaches. And as I mentioned previously, Dell shipped a hardware trojan in 2010. There are tons of single-point attack vectors in this chain. I'm not a security expert, but storing encrypted data in cloud storage seems less likely than others be a viable target. > Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc). > Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised? Let's say they did compromise your email account. Since only a few of your accounts are genuinely consequential to nefarious criminals, the number of password resets they'd need to execute might set them back, what— 5 minutes if it's not scripted? And all of it is moot if you use a 2FA method aside from email? Beyond that, considering how much more frequently email accounts get compromised, singling out the storage location for password manager databases seems pretty arbitrary. I just don't see how the opposition stands up to a comparison of attack vectors.

ifyoubuildit 5y ago

> Maybe you can't. Everybody has their own risk tolerance, but at some point, everybody's going to have to draw a line. I'm in agreement with parent, I think putting your passwords in the cloud is a wild single point of failure. Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet. I think people (in aggregate) just don't care about the risk and will take the path of least resistance. They don't have to draw the line there, but they will. > My password manager being compromised would indeed be a huge time suck, but I don't think the long-term consequences would be any more severe than a few key individual accounts that are probably even more vulnerable. Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc). Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised? I'm a bit of a crank though. I don't do any of the smart home stuff. I see my phone as a necessary evil. If some company shoehorned an app or a WiFi connection into their product, I don't buy it. After being in tech long enough, I just want things that work for me, not for the company I bought them from.

avianlyric 5y ago
> you're always a silent update away from it all being dumped on the internet. This is true of all password managers that have any ability to connect to the internet. You’re one silent update away from your manager suddenly uploading all your passwords to a random endpoint in Russia.
- ifyoubuildit 5y ago
  Theoretically, if you audit the source then you only really need to care about updates to the actual code. If it doesn't do silent updates then it can't change underneath you, even if it does some kind of network operations. Its not fool proof, but it feels better than a black box that could be a different black box tomorrow or after the next acquisition or round of investment.
chefandy 5y ago
> Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet. This is also true for your operating system updates, browser, browser extensions, compilers, the infrastructure for your email service provider, any libraries those things use etc. Not to mention your local password manager. Even if you don't accept push updates, do you evaluate the code? What if the vulnerability was timed to pop a few weeks after release? What if it was included in an update that patched a major vulnerability so you went faster than your normal process afforded? Even if you have a local firewall that stops external connections from unrecognized programs— what if it's a whitelisted program or the operating system or the firewall itself? Why would you a password manager's encryption less than you would trust your email service's encryption? I'd bank on the password managers' being a lot more robust. What about RATs that could access your local password database? RATs are a lot more common than cloud service breaches. And as I mentioned previously, Dell shipped a hardware trojan in 2010. There are tons of single-point attack vectors in this chain. I'm not a security expert, but storing encrypted data in cloud storage seems less likely than others be a viable target. > Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc). > Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised? Let's say they did compromise your email account. Since only a few of your accounts are genuinely consequential to nefarious criminals, the number of password resets they'd need to execute might set them back, what— 5 minutes if it's not scripted? And all of it is moot if you use a 2FA method aside from email? Beyond that, considering how much more frequently email accounts get compromised, singling out the storage location for password manager databases seems pretty arbitrary. I just don't see how the opposition stands up to a comparison of attack vectors.