4 ms·

Reusing passwords or having low entropy passwords is a larger risk. The thing is... Your password manager should be offline, not a cloud service.

yreg 4y ago
>Your password manager should be offline, not a cloud service. Why?
- TillE 4y ago
  There's this persistent vague myth on HN that there's something terrible about having an encrypted blob publicly exposed, which to me demonstrates a total lack of understanding about cryptography. Or they're just using weak passwords. Don't do that. The problem here is that a bunch of unencrypted data was exposed, which is really bad and dumb of LastPass.
  - feanaro 4y ago
    If you assume the strongest opposing argument, it's clear the "myth" isn't arising from a misunderstanding of cryptography. Rather, it's arising from the practical observation that password managers are not perfect, and therefore encryption is often not sufficient. In fact, you offer this argument yourself in your comment -- it is really bad and dumb of LastPass, and yet it happened, because these things happen in reality. Exploiting bugs in the end-user web application, accidentally exposing unencrypted data, unnecessarily collecting all data in a single location in the first place, a break in cryptography leading to a total break of security are all failure modes that only affect cloud password managers.
- taneq 4y ago
  Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?
  - yreg 4y ago
    Providing that the vault is fully encrypted/unencrypted locally, in what way is it going to be compromised? If someone wants to avoid having their vault in a LastPass/1Password/… cloud for some reason, it’s also possible to sync the vault through general use cloud solutions like Mega/Dropbox/…
    - feanaro 4y ago
      If the cryptography and its implementation is perfect, and you choose a high entropy, well-guarded secret, then encryption is enough on its own. However, being a security researcher, I observe that this is not how the world works in practice, and so encryption is only a single layer in a defence in depth approach. There's little reason to destroy another important layer by centralising all the passwords in a single lucrative bucket. An obvious way to attack typical cloud password managers is via their web apps, which is an endpoint attack and hence bypasses the encryption. This type of attack is much harder for native, offline password managers.
atq2119 4y ago
Agreed. The part I don't get about these discussions is that Firefox saves passwords offline for me just fine, and I have to trust my browser to handle my passwords already anyway. Sure, I have to manually copy a password between devices sometimes. Happens maybe three or four times a year, big f'ing deal. There's absolutely no reason to add more attack surface by using a password manager.

yreg 4y ago

>Your password manager should be offline, not a cloud service. Why?

TillE 4y ago
There's this persistent vague myth on HN that there's something terrible about having an encrypted blob publicly exposed, which to me demonstrates a total lack of understanding about cryptography. Or they're just using weak passwords. Don't do that. The problem here is that a bunch of unencrypted data was exposed, which is really bad and dumb of LastPass.
- feanaro 4y ago
  If you assume the strongest opposing argument, it's clear the "myth" isn't arising from a misunderstanding of cryptography. Rather, it's arising from the practical observation that password managers are not perfect, and therefore encryption is often not sufficient. In fact, you offer this argument yourself in your comment -- it is really bad and dumb of LastPass, and yet it happened, because these things happen in reality. Exploiting bugs in the end-user web application, accidentally exposing unencrypted data, unnecessarily collecting all data in a single location in the first place, a break in cryptography leading to a total break of security are all failure modes that only affect cloud password managers.
taneq 4y ago
Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?
- yreg 4y ago
  Providing that the vault is fully encrypted/unencrypted locally, in what way is it going to be compromised? If someone wants to avoid having their vault in a LastPass/1Password/… cloud for some reason, it’s also possible to sync the vault through general use cloud solutions like Mega/Dropbox/…
  - feanaro 4y ago
    If the cryptography and its implementation is perfect, and you choose a high entropy, well-guarded secret, then encryption is enough on its own. However, being a security researcher, I observe that this is not how the world works in practice, and so encryption is only a single layer in a defence in depth approach. There's little reason to destroy another important layer by centralising all the passwords in a single lucrative bucket. An obvious way to attack typical cloud password managers is via their web apps, which is an endpoint attack and hence bypasses the encryption. This type of attack is much harder for native, offline password managers.

atq2119 4y ago

Agreed. The part I don't get about these discussions is that Firefox saves passwords offline for me just fine, and I have to trust my browser to handle my passwords already anyway. Sure, I have to manually copy a password between devices sometimes. Happens maybe three or four times a year, big f'ing deal. There's absolutely no reason to add more attack surface by using a password manager.