4 ms·

IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target.

by awill 5y ago

IMO it's strange that people use cloud-based password managers. Companies like 1Password have all your passwords in their cloud. So they are an enormous target. I use enpass, and am in charge of my own syncing and storing in the datastore of my choice. I personally prefer this model.

dbbk 5y ago
> Companies like 1Password have all your passwords in their cloud. But they are end-to-end encrypted, so if someone broke into their database they would be useless unless they also had access to your device.
- Ocha 5y ago
  source code is not open source so end-to-end encryption might not be there when you expect it.
- dustyharddrive 5y ago
  At the same time, the native and WebExtension clients are proprietary and autoupdate by default. Travel Mode can only be accessed by typing your decryption keys into the live website (my.1password.com). An infrastructure compromise would be even worse than a database dump.
teaearlgraycold 5y ago
You're right - although you can pick better or worse providers. At least 1Password doesn't have a long history of breaches (like LastPass lol).
Barrin92 5y ago
Because that's literally the entire point of cryptography, being able to move secret information across an insecure channel. 1Password (and any other mainstream password manager) has no access to your passwords because they're encrypted locally. People who go to extreme lengths to keep an encrypted file secret practice LARP security. To preempt the question of "how can you trust them to encrypt your stuff though?" The same way you trust Enpass to encrypt your stuff, I'd make a guess 99.9% of users have not personally audited their code.
- TillE 5y ago
  Right, there are two reasons to not trust such a program which remotely stores an encrypted blob for you: 1) Not actually understanding the technology or threat model. 2) Having incredibly sensitive information which absolutely cannot leak even by accident, and needs to be handled manually with extreme care. This describes vanishingly few practical scenarios.
  - BeefWellington 5y ago
    I read a story once, which may be apocryphal, about various intelligence services switching back to printed/typewritten records for incredibly sensitive stuff to avoid the possibility of it leaking without having planted a spy. It seems unlikely to me, but I could imagine situations where that level of concern might make sense.

by awill 5y ago

dbbk 5y ago

> Companies like 1Password have all your passwords in their cloud. But they are end-to-end encrypted, so if someone broke into their database they would be useless unless they also had access to your device.

Ocha 5y ago
source code is not open source so end-to-end encryption might not be there when you expect it.
dustyharddrive 5y ago
At the same time, the native and WebExtension clients are proprietary and autoupdate by default. Travel Mode can only be accessed by typing your decryption keys into the live website (my.1password.com). An infrastructure compromise would be even worse than a database dump.

teaearlgraycold 5y ago

You're right - although you can pick better or worse providers. At least 1Password doesn't have a long history of breaches (like LastPass lol).

Barrin92 5y ago

Because that's literally the entire point of cryptography, being able to move secret information across an insecure channel. 1Password (and any other mainstream password manager) has no access to your passwords because they're encrypted locally. People who go to extreme lengths to keep an encrypted file secret practice LARP security. To preempt the question of "how can you trust them to encrypt your stuff though?" The same way you trust Enpass to encrypt your stuff, I'd make a guess 99.9% of users have not personally audited their code.

TillE 5y ago
Right, there are two reasons to not trust such a program which remotely stores an encrypted blob for you: 1) Not actually understanding the technology or threat model. 2) Having incredibly sensitive information which absolutely cannot leak even by accident, and needs to be handled manually with extreme care. This describes vanishingly few practical scenarios.
- BeefWellington 5y ago
  I read a story once, which may be apocryphal, about various intelligence services switching back to printed/typewritten records for incredibly sensitive stuff to avoid the possibility of it leaking without having planted a spy. It seems unlikely to me, but I could imagine situations where that level of concern might make sense.