5 ms·

> Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on

> Even if you can tell a compelling story about how they carefully encrypt everything right now, you're always a silent update away from it all being dumped on the internet. This is also true for your operating system updates, browser, browser extensions, compilers, the infrastructure for your email service provider, any libraries those things use etc. Not to mention your local password manager. Even if you don't accept push updates, do you evaluate the code? What if the vulnerability was timed to pop a few weeks after release? What if it was included in an update that patched a major vulnerability so you went faster than your normal process afforded? Even if you have a local firewall that stops external connections from unrecognized programs— what if it's a whitelisted program or the operating system or the firewall itself? Why would you a password manager's encryption less than you would trust your email service's encryption? I'd bank on the password managers' being a lot more robust. What about RATs that could access your local password database? RATs are a lot more common than cloud service breaches. And as I mentioned previously, Dell shipped a hardware trojan in 2010. There are tons of single-point attack vectors in this chain. I'm not a security expert, but storing encrypted data in cloud storage seems less likely than others be a viable target. > Having your main email account compromised seems like an absolute nightmare where you potentially lose control of every single service that you subscribe to (banking, utilities, cell phone (so maybe 2fa is even broken), medical portals, social media, etc). > Having your entire set of passwords compromised is like that on steroids. Rather than your attacker having to use your email to get to each of those services one at a time, they just have them immediately. And who says you'll even know that your stuff was compromised? Let's say they did compromise your email account. Since only a few of your accounts are genuinely consequential to nefarious criminals, the number of password resets they'd need to execute might set them back, what— 5 minutes if it's not scripted? And all of it is moot if you use a 2FA method aside from email? Beyond that, considering how much more frequently email accounts get compromised, singling out the storage location for password manager databases seems pretty arbitrary. I just don't see how the opposition stands up to a comparison of attack vectors.

ifyoubuildit 5y ago
> This is also true for... Agreed, those are already risks, and ones that are a lot harder to mitigate (though I do try where I can). Does that mean I should add another one that I can easily avoid? There are risks in both local and cloud password managers. Maybe those risks seem equivalent to some folks, and the cloud features are useful enough for it to be a no brainer for them. For me, I don't at all mind manually backing up and manually copy/pasting credentials, and I don't miss the convenience of the cloud features. > Let's say they did compromise your email account ... This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials. In any case, I agree risks already exist in other places. For me in my specific set of circumstances this just seems like an easy one to skip.
- chefandy 5y ago
  Hey— whatever works for your setup. Especially for those who don't use a smart phone and have one machine, it's probably a minimal loss in functionality. > Does that mean I should add another one that I can easily avoid? All other things being equal? Avoid it, of course. I firmly oppose letting perfect be the enemy of good in the sense that more secure is better than less secure even if it's not perfectly secure. But I also oppose it in the sense that rejecting beneficial functionality because it's not perfectly secure, especially when it's not close to the biggest or most attractive attack surface, doesn't make sense. Even when password managers' servers were compromised— LastPass, for example— I don't think anybody ever got ahold of passwords. KeePass OTOH was broken with KeeFarce and RATs are a lot more common than cloud service server breaches. > This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials. Nope— If it was automated the distinction is even less significant. A script would only need to search your email for whatever specific types of logins it supported and fire off password resets. Non-email 2FA becomes even more of a hurdle without the option of social engineering it or some other human-touch fix. Consider this. (very) Roughly, this is the market penetration for these products: * computer: 90%+ * smart phone: 85% * tablet: 50% * computer, smart phone and tablet: 40% Most people (in this country, at least,) have multiple devices. Most people have internet access. Most people aren't going to be able to manage storing and sharing passwords among their devices at all, let alone more securely than cloud storage would do it. So for most people's use cases, it would be like citing health when refusing to put a teaspoon of sugar into the cup of tea they're having with cake and ice cream. So like I said, avoid it if it doesn't improve your life— I have no stake in your password management choice— but I will actively butt in to qualify the sentiments expressed in this thread because, a) many users, even on this site, aren't sophisticated enough to engage in the sort of cost/benefit analysis that we are, and b) to them, this conversation is unintentional FUD. Cloud-based password management is vastly superior to regular folks' existing methods. If they're put off by technically savvy people saying they're fundamentally insecure, that is the embodiment of perfect defeating good.
  - ifyoubuildit 5y ago

ifyoubuildit 5y ago

> This is also true for... Agreed, those are already risks, and ones that are a lot harder to mitigate (though I do try where I can). Does that mean I should add another one that I can easily avoid? There are risks in both local and cloud password managers. Maybe those risks seem equivalent to some folks, and the cloud features are useful enough for it to be a no brainer for them. For me, I don't at all mind manually backing up and manually copy/pasting credentials, and I don't miss the convenience of the cloud features. > Let's say they did compromise your email account ... This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials. In any case, I agree risks already exist in other places. For me in my specific set of circumstances this just seems like an easy one to skip.

chefandy 5y ago
Hey— whatever works for your setup. Especially for those who don't use a smart phone and have one machine, it's probably a minimal loss in functionality. > Does that mean I should add another one that I can easily avoid? All other things being equal? Avoid it, of course. I firmly oppose letting perfect be the enemy of good in the sense that more secure is better than less secure even if it's not perfectly secure. But I also oppose it in the sense that rejecting beneficial functionality because it's not perfectly secure, especially when it's not close to the biggest or most attractive attack surface, doesn't make sense. Even when password managers' servers were compromised— LastPass, for example— I don't think anybody ever got ahold of passwords. KeePass OTOH was broken with KeeFarce and RATs are a lot more common than cloud service server breaches. > This seems focused on the case of a dedicated attacker focused on you specifically. Id think each of us is more likely to be affected by various automated attacks that are backed by large dumps of account credentials. Nope— If it was automated the distinction is even less significant. A script would only need to search your email for whatever specific types of logins it supported and fire off password resets. Non-email 2FA becomes even more of a hurdle without the option of social engineering it or some other human-touch fix. Consider this. (very) Roughly, this is the market penetration for these products: * computer: 90%+ * smart phone: 85% * tablet: 50% * computer, smart phone and tablet: 40% Most people (in this country, at least,) have multiple devices. Most people have internet access. Most people aren't going to be able to manage storing and sharing passwords among their devices at all, let alone more securely than cloud storage would do it. So for most people's use cases, it would be like citing health when refusing to put a teaspoon of sugar into the cup of tea they're having with cake and ice cream. So like I said, avoid it if it doesn't improve your life— I have no stake in your password management choice— but I will actively butt in to qualify the sentiments expressed in this thread because, a) many users, even on this site, aren't sophisticated enough to engage in the sort of cost/benefit analysis that we are, and b) to them, this conversation is unintentional FUD. Cloud-based password management is vastly superior to regular folks' existing methods. If they're put off by technically savvy people saying they're fundamentally insecure, that is the embodiment of perfect defeating good.
- ifyoubuildit 5y ago