3 ms·

This is ultimately a predictable outcome for any password manager that stores your credentials on someone else's server. Just like they say in crypto "not your

This is ultimately a predictable outcome for any password manager that stores your credentials on someone else's server. Just like they say in crypto "not your keys, not your crypto" - it applies here too. Not your storage, not your passwords. KeePass on an airgapped box, or an encrypted hardware password manager with no network interfaces is best, though frankly, I'd even be more comfortable writing down passwords on paper (at home) than I would be storing them on someone else's server. I say all this as a big tech red teamer, or, someone who breaches other people's servers for a living.

bombcar 4y ago
The idea of using crypto wallets as canaries is an interesting one, however. I bet you could set that up to only be tripped by a major compromise. And yes - there is basically no way to actually prove that your passwords on a server aren’t accessible to someone - especially if they can update software.
userbinator 4y ago
though frankly, I'd even be more comfortable writing down passwords on paper (at home) than I would be storing them on someone else's server. 100% agreed. Physical access is not something than an attacker, especially one likely to be in an entirely different country or even continent, can easily achieve.
tester457 4y ago
> KeePass on an airgapped box Sounds inconvenient for password retrieval when not home, how does this work in practice? How about an airgapped phone with GrapheneOS and Keepass?
- anonym29 4y ago
  Sounds like you just solved the inconvenience problem.
  - tester457 4y ago
    How is your setup though? Can you describe it in more detail please? Interested in the perspective of a security professional.
    - anonym29 4y ago
      For personal use, I use KeePass on my "offline box", which is an airgapped machine running Qubes with full disk encryption. KeePass is in it's own Qube, along with a few other offline things in their own qubes (hash cracking, archival storage for old media/files/projects, offline copy of wikipedia, offline maps/nav, tons of old training content for certs, so on and so forth). Is it inconvenient at times? Yes. But I spend so much time at my desk, that those times aren't super common. On mobile, my personal daily driver is running GrapheneOS, but I do not keep my passwords on it. I am unaffiliated with them, and this isn't an endorsement, but I just recently ordered a Mooltipass, which I intend to thoroughly audit. If it's security proves satisfactory to me, I may use one going forward in a limited capacity.
ryandrake 4y ago
A password manager is probably the worst possible candidate for being a cloud service. "Your entire list of passwords" is the one piece of data you absolutely, positively, do NOT want stored in the cloud. How these things gained such a following is mind-blowing.
- lacerrr 4y ago
  Honestly, though, it's not that bad of an idea. Provides just enough convenience for people to use unique, randomly generated passwords for each login. Much worse for a website to leak the credentials you use for a bunch of other accounts. Using a pw manager and 2fa is imperfect but still the sweet spot in my opinion.

bombcar 4y ago

The idea of using crypto wallets as canaries is an interesting one, however. I bet you could set that up to only be tripped by a major compromise. And yes - there is basically no way to actually prove that your passwords on a server aren’t accessible to someone - especially if they can update software.

userbinator 4y ago

though frankly, I'd even be more comfortable writing down passwords on paper (at home) than I would be storing them on someone else's server. 100% agreed. Physical access is not something than an attacker, especially one likely to be in an entirely different country or even continent, can easily achieve.

tester457 4y ago

> KeePass on an airgapped box Sounds inconvenient for password retrieval when not home, how does this work in practice? How about an airgapped phone with GrapheneOS and Keepass?

anonym29 4y ago
Sounds like you just solved the inconvenience problem.
- tester457 4y ago
  How is your setup though? Can you describe it in more detail please? Interested in the perspective of a security professional.
  - anonym29 4y ago
    For personal use, I use KeePass on my "offline box", which is an airgapped machine running Qubes with full disk encryption. KeePass is in it's own Qube, along with a few other offline things in their own qubes (hash cracking, archival storage for old media/files/projects, offline copy of wikipedia, offline maps/nav, tons of old training content for certs, so on and so forth). Is it inconvenient at times? Yes. But I spend so much time at my desk, that those times aren't super common. On mobile, my personal daily driver is running GrapheneOS, but I do not keep my passwords on it. I am unaffiliated with them, and this isn't an endorsement, but I just recently ordered a Mooltipass, which I intend to thoroughly audit. If it's security proves satisfactory to me, I may use one going forward in a limited capacity.

ryandrake 4y ago

A password manager is probably the worst possible candidate for being a cloud service. "Your entire list of passwords" is the one piece of data you absolutely, positively, do NOT want stored in the cloud. How these things gained such a following is mind-blowing.

lacerrr 4y ago
Honestly, though, it's not that bad of an idea. Provides just enough convenience for people to use unique, randomly generated passwords for each login. Much worse for a website to leak the credentials you use for a bunch of other accounts. Using a pw manager and 2fa is imperfect but still the sweet spot in my opinion.