5 ms·

What sources do you have that indicate master pws in the pw manager context are getting leaked or reused?

ejb999 5y ago
you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.
- RealStickman_ 5y ago
  But that's exactly why you use a password manager; so it can generate passwords for you, while you only need to remember one password to unlock it.
- junon 5y ago
  You should probably think a little more critically about password managers. You don't reuse passwords at all. That is expressly the point of password managers. You generate a new password that is completely random and quite long for each independent website. If one of the sites is breached, no matter. Damage is contained to that site. The only password of yours that is leaked for that site. The only place that password can be used is - you guessed it - that site.
- dogman144 5y ago
  A master password is the only pw in a PWM at real risk of reuse. However, without placing too much unwarranted trust in the user, consider the following: - extensive warnings during user onboarding about how to approach setting and safe keeping of the master password, especially around reuse.... ok, but some users are still hopeless with this, what then - taking Lastpass for instance, lock-out features for logging into the extension if you're coming out of a new geo-ip (proactive risk control) - taking LP again, alerting to the user for successful logins to the platform from new geo-ips (reactive risk control). - all the on-device security controls required to get into a PWM: touch/face-id logins for the apps, an official browser extension, on and on. I'd also imagine LP security is watching HIBP very closely. Put all that together, odds are you or the PWM security teams are able to filter pretty well for password reuse for master passwords. So yes I'd expect sources/stats to be out there, or at least counterpoints to the above which when put together map a decent defense-in-depth for PWMs which isn't present in most or almost any browser extensions, to include Tier 1 cryptocurrency browser extensions which are responsible for significant more funds and still maintain good security (think: Metamask).

you don't really need a 'source' for that do you? - it's common knowledge that people reuse passwords across sites. It's not best practice for sure, but plenty of people do it. If some low quality site leaks your email and password and if you were dumb enough to use that as your master password for your password manage, you are at more risk than if the bad actor didn't have that information.

RealStickman_ 5y ago
But that's exactly why you use a password manager; so it can generate passwords for you, while you only need to remember one password to unlock it.
junon 5y ago
You should probably think a little more critically about password managers. You don't reuse passwords at all. That is expressly the point of password managers. You generate a new password that is completely random and quite long for each independent website. If one of the sites is breached, no matter. Damage is contained to that site. The only password of yours that is leaked for that site. The only place that password can be used is - you guessed it - that site.
dogman144 5y ago
A master password is the only pw in a PWM at real risk of reuse. However, without placing too much unwarranted trust in the user, consider the following: - extensive warnings during user onboarding about how to approach setting and safe keeping of the master password, especially around reuse.... ok, but some users are still hopeless with this, what then - taking Lastpass for instance, lock-out features for logging into the extension if you're coming out of a new geo-ip (proactive risk control) - taking LP again, alerting to the user for successful logins to the platform from new geo-ips (reactive risk control). - all the on-device security controls required to get into a PWM: touch/face-id logins for the apps, an official browser extension, on and on. I'd also imagine LP security is watching HIBP very closely. Put all that together, odds are you or the PWM security teams are able to filter pretty well for password reuse for master passwords. So yes I'd expect sources/stats to be out there, or at least counterpoints to the above which when put together map a decent defense-in-depth for PWMs which isn't present in most or almost any browser extensions, to include Tier 1 cryptocurrency browser extensions which are responsible for significant more funds and still maintain good security (think: Metamask).