5 ms·

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they h

> They have above average security, but unlike a typical website they can’t just store a one-way hash of passwords that remains secure even when stolen, they have to store the actual password No, they don’t store directly the actual password, they store it encrypted by a encryption key derived from your master password. A leak of the database won’t reveal any password, as long as your master password stays secure (aka is not "hunter3")

SkyMarshal 5y ago
> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.
- leokennis 5y ago
  Do you understand the concept of a password manager? You only have to remember one password, and for that reason people can choose a longer and more complex one. Then your passwords are encrypted using that master password. So people cannot “reverse” your password if you pick a reasonably long master password. For reference, my master password is a 27 character sentence which would take somewhere between a millennium and the heat death of the universe to crack. It encrypts around 500 passwords, each in itself 25-35 character long pass phrases I do not know.
  - gigglesupstairs 5y ago
    This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.
    - leokennis 5y ago
      I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for). Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location. So should I forget my master password: drive to box 1. Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone somewhere, and I have access to all my accounts. Should my password manager go bankrupt overnight and take my vault with them: drive to boxes 1 and 2, then click “forgot my password” on all services and use my e-mail to recover access. Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them: at least I have my own e-mail domain, so I can set up a new mailbox elsewhere Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them, and my domain registrar go bankrupt overnight and take my domain with them: yeah…then I’m screwed. I’ll migrate to a wooded country and become a hermit.
      - CrendKing 5y ago
        Could you help me understand, that if you are this considerate and comprehensive about your risk factors and prepared at all sorts of possibilities, why still use a password manager solution that can "go bankrupt overnight and take my vault with them"? Why not just use KeePass and manage the vault yourself? If your answer is "I only need to do these safe box things once", then writing your own scripts to sync KeePass database between your devices is also only needed done once, right? Even if it's more hassles, considering you will never have the last 3 bullets listed, isn't that worth the trouble?
        leokennis 5y ago
        Because I think my password manager is far more competent in keeping my safe available “in the cloud” than I am in keeping my safe available.
      - GoblinSlayer 5y ago
        But the password to your domain was in the password manager.
- jolux 5y ago
  You can check this fairly easily with https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords. It's not exhaustive obviously but it's something. 1Password vaults are also encrypted with a separate secret key that is generated locally and never stored. So you'd need the password and the secret key to decrypt.
- dogman144 5y ago
  What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?
  - ejb999 5y ago
    you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.
    - RealStickman_ 5y ago
      But that's exactly why you use a password manager; so it can generate passwords for you, while you only need to remember one password to unlock it.
    - junon 5y ago
      You should probably think a little more critically about password managers. You don't reuse passwords at all. That is expressly the point of password managers. You generate a new password that is completely random and quite long for each independent website. If one of the sites is breached, no matter. Damage is contained to that site. The only password of yours that is leaked for that site. The only place that password can be used is - you guessed it - that site.
    - dogman144 5y ago
      A master password is the only pw in a PWM at real risk of reuse. However, without placing too much unwarranted trust in the user, consider the following: - extensive warnings during user onboarding about how to approach setting and safe keeping of the master password, especially around reuse.... ok, but some users are still hopeless with this, what then - taking Lastpass for instance, lock-out features for logging into the extension if you're coming out of a new geo-ip (proactive risk control) - taking LP again, alerting to the user for successful logins to the platform from new geo-ips (reactive risk control). - all the on-device security controls required to get into a PWM: touch/face-id logins for the apps, an official browser extension, on and on. I'd also imagine LP security is watching HIBP very closely. Put all that together, odds are you or the PWM security teams are able to filter pretty well for password reuse for master passwords. So yes I'd expect sources/stats to be out there, or at least counterpoints to the above which when put together map a decent defense-in-depth for PWMs which isn't present in most or almost any browser extensions, to include Tier 1 cryptocurrency browser extensions which are responsible for significant more funds and still maintain good security (think: Metamask).
whymarrh 5y ago
Even if your Master Password is “hunter3”, 1Password, as an example, will mix in a locally generated Secret Key to increase the entropy [1] [1]: https://blog.1password.com/what-the-secret-key-does/ https://blog.1password.com/what-the-secret-key-does/

SkyMarshal 5y ago

> as long as your master password stays secure (aka is not "hunter3") You mean, the master password that many people reuse across sites and has been leaked into the darknet by breaches of other sites? Or if not leaked directly, at least some entropy about it probably has been. I know these services don’t store the password in plain text, but it’s still stored in reversible format. That’s a juicy target.

leokennis 5y ago
Do you understand the concept of a password manager? You only have to remember one password, and for that reason people can choose a longer and more complex one. Then your passwords are encrypted using that master password. So people cannot “reverse” your password if you pick a reasonably long master password. For reference, my master password is a 27 character sentence which would take somewhere between a millennium and the heat death of the universe to crack. It encrypts around 500 passwords, each in itself 25-35 character long pass phrases I do not know.
- gigglesupstairs 5y ago
  This kind of dependence sometimes scares me to be honest, not that password dependent services have left much choice to us.
  - leokennis 5y ago
    I store the printed credentials to my password manager and my e-mail account in a safe deposit box (without mentioning on that paper what the codes are for). Then I store a YubiKey which is a second factor to these accounts in another safe deposit box in another location. So should I forget my master password: drive to box 1. Should my house with all my computers burn down: drive to boxes 1 and 2, find a pc or phone somewhere, and I have access to all my accounts. Should my password manager go bankrupt overnight and take my vault with them: drive to boxes 1 and 2, then click “forgot my password” on all services and use my e-mail to recover access. Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them: at least I have my own e-mail domain, so I can set up a new mailbox elsewhere Should my password manager go bankrupt overnight and take my vault with them, my e-mail provider go bankrupt overnight and take my mailbox with them, and my domain registrar go bankrupt overnight and take my domain with them: yeah…then I’m screwed. I’ll migrate to a wooded country and become a hermit.
    - CrendKing 5y ago
      Could you help me understand, that if you are this considerate and comprehensive about your risk factors and prepared at all sorts of possibilities, why still use a password manager solution that can "go bankrupt overnight and take my vault with them"? Why not just use KeePass and manage the vault yourself? If your answer is "I only need to do these safe box things once", then writing your own scripts to sync KeePass database between your devices is also only needed done once, right? Even if it's more hassles, considering you will never have the last 3 bullets listed, isn't that worth the trouble?
      - leokennis 5y ago
        Because I think my password manager is far more competent in keeping my safe available “in the cloud” than I am in keeping my safe available.
    - GoblinSlayer 5y ago
      But the password to your domain was in the password manager.
jolux 5y ago
You can check this fairly easily with https://haveibeenpwned.com/Passwords https://haveibeenpwned.com/Passwords. It's not exhaustive obviously but it's something. 1Password vaults are also encrypted with a separate secret key that is generated locally and never stored. So you'd need the password and the secret key to decrypt.
dogman144 5y ago
What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?
- ejb999 5y ago
  you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.
  - RealStickman_ 5y ago
    But that's exactly why you use a password manager; so it can generate passwords for you, while you only need to remember one password to unlock it.
  - junon 5y ago
    You should probably think a little more critically about password managers. You don't reuse passwords at all. That is expressly the point of password managers. You generate a new password that is completely random and quite long for each independent website. If one of the sites is breached, no matter. Damage is contained to that site. The only password of yours that is leaked for that site. The only place that password can be used is - you guessed it - that site.
  - dogman144 5y ago
    A master password is the only pw in a PWM at real risk of reuse. However, without placing too much unwarranted trust in the user, consider the following: - extensive warnings during user onboarding about how to approach setting and safe keeping of the master password, especially around reuse.... ok, but some users are still hopeless with this, what then - taking Lastpass for instance, lock-out features for logging into the extension if you're coming out of a new geo-ip (proactive risk control) - taking LP again, alerting to the user for successful logins to the platform from new geo-ips (reactive risk control). - all the on-device security controls required to get into a PWM: touch/face-id logins for the apps, an official browser extension, on and on. I'd also imagine LP security is watching HIBP very closely. Put all that together, odds are you or the PWM security teams are able to filter pretty well for password reuse for master passwords. So yes I'd expect sources/stats to be out there, or at least counterpoints to the above which when put together map a decent defense-in-depth for PWMs which isn't present in most or almost any browser extensions, to include Tier 1 cryptocurrency browser extensions which are responsible for significant more funds and still maintain good security (think: Metamask).

whymarrh 5y ago

Even if your Master Password is “hunter3”, 1Password, as an example, will mix in a locally generated Secret Key to increase the entropy [1] [1]: https://blog.1password.com/what-the-secret-key-does/ https://blog.1password.com/what-the-secret-key-does/