5 ms·

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge st

by smt88 4y ago

Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. LastPass and its competitors theoretically have zero-knowledge storage of everyone's passwords, so even a full breach of their servers would fail to leak passwords.

jrm4 4y ago
That "theoretically" is carrying significantly more water in this example than is smart to assume.
autoexec 4y ago
> Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading to the cloud, but even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere, so there's no need to limit myself to one company's servers. I can use whatever works best for my needs and won't have to worry about what I'd do if the one I was using goes under or becomes unavailable. In exchange for a little extra work you gain a ton of utility and resiliency
- smt88 4y ago
  Yeah, again: all of this is great for you, but it doesn't change the fact that you are a very, very niche case. You can't just dismiss cloud syncing of passwords because you are the edge case who doesn't need it. > I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. That doesn't work for mobile devices. Most people have a work mobile device. > even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere This is literally how LastPass and 1Password handle it. If you lose your key, the file in the cloud becomes useless. > In exchange for a little extra work... "A little extra work" that is beyond the skills of the vast majority of users. > ...you gain a ton of utility and resiliency As someone who used KeePass for more than 10 years until recently, I can honestly say that it was a massive reduction of utility and had no resiliency benefits.
  - fezfight 4y ago
    You've picked a strange subset of 'most' for the people you're imagining. They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Are you sure its not just a few people like you?
    - HelloMcFly 4y ago
      > They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Not the person you responded to, but: I think that most people are savvy enough to know what a password manager is, and most people are not savvy enough to be interested in the work necessary to setup, personalize, and maintaining an offline password manager that functions well across multiple devices. That doesn't sound like a niche subset to me, but I could be way off.
      - fezfight 4y ago
        My point is to illustrate that the commenter is speaking out of their respective ass. None of us know what the average person thinks, we are a group of tremendous nerds who are engaging, not just reading, in the comments section to a post about a flipping password manager.
        smt88 4y ago
        I'm speaking out of personal experience trying to get non-average users (my friends and family, some of whom work in non-technical roles at software companies) to understand and use password managers. Most of them can't and won't invest the time just to switch to 1Password. The average person isn't going to exceed that bar by a margin that even I, a software developer, wouldn't bother with. When something is too technical for even an average developer to bother with (because it's unnecessary, not because it's hard), it is totally hopeless for the average user.
        nunez 4y ago
        it took a LOOOONG time to get my wife into using a password manager, specifically 1Pass. I'm super comfortable with an offline password manager, but there is not a chance in hell that I'd subject her to that for a large amount of people, tech and non-tech alike, LastPass and 1Pass are really really good.
- archi42 4y ago
  Copying files has the disadvantage of requiring some merge mechanism, or not permitting parallel modification. I found vaultwarden to be a nice alternative. It runs on my server at home, to which I connect the relevant devices by VPN. It still requires the server to be online for modification (& the VPN connected), which I find to be a bit annoying, but it solves the concurrent modification issue. Plus, passwords are encrypted at rest and the browser extension verifies I'm using the password on a legitimate website (anti-phishing). But if you're happy with your variant, I guess that's fine as well :)
AdamJacobMuller 4y ago
> even a full breach of their servers would fail to leak passwords This is a dangerous fallacy. Nothing fundamentally would prevent someone who attacked their infrastructure from pushing a malicious app update or a malicious extension update which exfiltrated the decrypted library from the client side.
- woojoo666 4y ago
  Are there any instances of this happening? I feel like it would be caught so fast it's not worth trying
  - asoberbeck 4y ago
    > As customers downloaded the update, they unwittingly pulled down and installed the backdoor at the same time. The malicious code was itself cleverly designed, would execute commands, and provided remote admin access. The hackers then used that foothold to create and cryptographically sign the necessary security tokens to hoodwink systems into believing subsequent access to other accounts and resources was legitimate. https://www.theregister.com/2020/12/15/solar_winds_update/ https://www.theregister.com/2020/12/15/solar_winds_update/
    - woojoo666 4y ago
      Wow that is worrying how long it took to catch....seems like companies need to be monitoring their releases more carefully
- smt88 4y ago
  I wasn't specific about that. I should have said a full dump of their database. Yes, if someone got into their supply chain, they could push a malicious update. That's also true of KeePass and every other password manager. There's no way to avoid that vector.
ta988 4y ago
A breach in the software distribution and signing servers would be quite disastrous.
armada651 4y ago
You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master password.
- vlan0 4y ago
  While this is true, and I did this for the better part of 2010s, it was pretty clunky. Especially if one needs a platform for their wife or children to also use. I'm gonna ride out LastPass until webauthn really takes off. Which could be soon based on what we're hearing from the mobile vendors.
  - armada651 4y ago
    Yeah I'm definitely not saying this is the right solution for everyone, but for my personal password database I'm willing to sacrifice a bit of polish to make sure the zero-knowledge claim is iron clad.
  - rlpb 4y ago
    > Which could be soon based on what we're hearing from the mobile vendors. I'd really like to see wider webauthn support, so I'm curious to know what you mean by what you're hearing from the mobile vendors please?
    - vlan0 4y ago
      https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/ https://www.apple.com/newsroom/2022/05/apple-google-and-micr...
- Timothycquinn 4y ago
  I sync my keepass using signal's 'note to self' feature.
deleted 4y ago
[deleted]
jackdawipper 4y ago
hack code, roll out app updates... you see where this is going?

by smt88 4y ago

jrm4 4y ago

That "theoretically" is carrying significantly more water in this example than is smart to assume.

autoexec 4y ago

> Most people use a work machine and a mobile device, so cloud syncing is absolutely necessary. I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. My personal passwords are stored on my own personal devices. Syncing between them can be done using any number of methods without uploading to the cloud, but even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere, so there's no need to limit myself to one company's servers. I can use whatever works best for my needs and won't have to worry about what I'd do if the one I was using goes under or becomes unavailable. In exchange for a little extra work you gain a ton of utility and resiliency

smt88 4y ago
Yeah, again: all of this is great for you, but it doesn't change the fact that you are a very, very niche case. You can't just dismiss cloud syncing of passwords because you are the edge case who doesn't need it. > I keep a password database on the company network with all my work passwords and I have no need to keep a copy of those credentials on a bunch of my personal devices or cloud servers. That doesn't work for mobile devices. Most people have a work mobile device. > even if I wanted to use somebody else's servers to do that a properly encrypted file with a very strong password could be safely stored anywhere This is literally how LastPass and 1Password handle it. If you lose your key, the file in the cloud becomes useless. > In exchange for a little extra work... "A little extra work" that is beyond the skills of the vast majority of users. > ...you gain a ton of utility and resiliency As someone who used KeePass for more than 10 years until recently, I can honestly say that it was a massive reduction of utility and had no resiliency benefits.
- fezfight 4y ago
  You've picked a strange subset of 'most' for the people you're imagining. They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Are you sure its not just a few people like you?
  - HelloMcFly 4y ago
    > They are savy enough to know what a password manager is, but not savy enough to deal with an offline one. Not the person you responded to, but: I think that most people are savvy enough to know what a password manager is, and most people are not savvy enough to be interested in the work necessary to setup, personalize, and maintaining an offline password manager that functions well across multiple devices. That doesn't sound like a niche subset to me, but I could be way off.
    - fezfight 4y ago
      My point is to illustrate that the commenter is speaking out of their respective ass. None of us know what the average person thinks, we are a group of tremendous nerds who are engaging, not just reading, in the comments section to a post about a flipping password manager.
      - smt88 4y ago
        I'm speaking out of personal experience trying to get non-average users (my friends and family, some of whom work in non-technical roles at software companies) to understand and use password managers. Most of them can't and won't invest the time just to switch to 1Password. The average person isn't going to exceed that bar by a margin that even I, a software developer, wouldn't bother with. When something is too technical for even an average developer to bother with (because it's unnecessary, not because it's hard), it is totally hopeless for the average user.
        nunez 4y ago
        it took a LOOOONG time to get my wife into using a password manager, specifically 1Pass. I'm super comfortable with an offline password manager, but there is not a chance in hell that I'd subject her to that for a large amount of people, tech and non-tech alike, LastPass and 1Pass are really really good.
archi42 4y ago
Copying files has the disadvantage of requiring some merge mechanism, or not permitting parallel modification. I found vaultwarden to be a nice alternative. It runs on my server at home, to which I connect the relevant devices by VPN. It still requires the server to be online for modification (& the VPN connected), which I find to be a bit annoying, but it solves the concurrent modification issue. Plus, passwords are encrypted at rest and the browser extension verifies I'm using the password on a legitimate website (anti-phishing). But if you're happy with your variant, I guess that's fine as well :)

AdamJacobMuller 4y ago

> even a full breach of their servers would fail to leak passwords This is a dangerous fallacy. Nothing fundamentally would prevent someone who attacked their infrastructure from pushing a malicious app update or a malicious extension update which exfiltrated the decrypted library from the client side.

woojoo666 4y ago
Are there any instances of this happening? I feel like it would be caught so fast it's not worth trying
- asoberbeck 4y ago
  > As customers downloaded the update, they unwittingly pulled down and installed the backdoor at the same time. The malicious code was itself cleverly designed, would execute commands, and provided remote admin access. The hackers then used that foothold to create and cryptographically sign the necessary security tokens to hoodwink systems into believing subsequent access to other accounts and resources was legitimate. https://www.theregister.com/2020/12/15/solar_winds_update/ https://www.theregister.com/2020/12/15/solar_winds_update/
  - woojoo666 4y ago
    Wow that is worrying how long it took to catch....seems like companies need to be monitoring their releases more carefully
smt88 4y ago
I wasn't specific about that. I should have said a full dump of their database. Yes, if someone got into their supply chain, they could push a malicious update. That's also true of KeePass and every other password manager. There's no way to avoid that vector.

ta988 4y ago

A breach in the software distribution and signing servers would be quite disastrous.

armada651 4y ago

You can sync the encrypted KeePass database using Dropbox and then your zero-knowledge cloud storage won't just be theoretical. Simply secure the database with a password and keyfile then copy the key file manually to your mobile devices and workstation. That way you can be certain that your cloud provider has zero knowledge of your key file and also doesn't control the application in which you enter the master password.

vlan0 4y ago
While this is true, and I did this for the better part of 2010s, it was pretty clunky. Especially if one needs a platform for their wife or children to also use. I'm gonna ride out LastPass until webauthn really takes off. Which could be soon based on what we're hearing from the mobile vendors.
- armada651 4y ago
  Yeah I'm definitely not saying this is the right solution for everyone, but for my personal password database I'm willing to sacrifice a bit of polish to make sure the zero-knowledge claim is iron clad.
- rlpb 4y ago
  > Which could be soon based on what we're hearing from the mobile vendors. I'd really like to see wider webauthn support, so I'm curious to know what you mean by what you're hearing from the mobile vendors please?
  - vlan0 4y ago
    https://www.apple.com/newsroom/2022/05/apple-google-and-microsoft-commit-to-expanded-support-for-fido-standard/ https://www.apple.com/newsroom/2022/05/apple-google-and-micr...
Timothycquinn 4y ago
I sync my keepass using signal's 'note to self' feature.

deleted 4y ago

[deleted]

jackdawipper 4y ago

hack code, roll out app updates... you see where this is going?