3 ms·
>If you're able to sneak into the supply chain and replace the _client_ with a modified, malicious version, you can make it send the master password AND the dat
by whatshisface 4y ago
>If you're able to sneak into the supply chain and replace the _client_ with a modified, malicious version, you can make it send the master password AND the database to a remote server
I've heard about this as a possibility for as long as I can remember, but while this remains a possibility, major online providers get hacked every year or so.
- nequo 4y agoMajor providers are more valuable targets because the potential loot is bigger. I wonder if major providers are also more likely to detect intrusions. This is the part that concerns me about non-cloud alternatives. For example, if KeePass got compromised, how long would it take for us to learn about it? (Although I don’t have much faith left in LastPass, and I don’t have strong reasons to think that 1Password is better since as an outsider to their operations I know just about as much about either.)
- alanfranz 4y agoAnd yet the impact is low since the databases are strongly encrypted. A client compromise would be devastating, instead.