3 ms·
Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single u
by taneq 4y ago
Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?
- yreg 4y agoProviding that the vault is fully encrypted/unencrypted locally, in what way is it going to be compromised? If someone wants to avoid having their vault in a LastPass/1Password/… cloud for some reason, it’s also possible to sync the vault through general use cloud solutions like Mega/Dropbox/…
- feanaro 4y agoIf the cryptography and its implementation is perfect, and you choose a high entropy, well-guarded secret, then encryption is enough on its own. However, being a security researcher, I observe that this is not how the world works in practice, and so encryption is only a single layer in a defence in depth approach. There's little reason to destroy another important layer by centralising all the passwords in a single lucrative bucket. An obvious way to attack typical cloud password managers is via their web apps, which is an endpoint attack and hence bypasses the encryption. This type of attack is much harder for native, offline password managers.