6 ms·
You shouldn’t use a weak password in your password manager, and rely on KDF. Even if the server is not hacked, the company could snapshot vaults and crack them
by aborsy 4y ago
You shouldn’t use a weak password in your password manager, and rely on KDF. Even if the server is not hacked, the company could snapshot vaults and crack them offline.
KDF is not a substitute for a good password.
- drexlspivey 4y agoWhy would the company want to crack your vault..? If they want your logins they can just push an update on the client app that skips encryption altogether.
- aborsy 4y agoBecause a company is not a single entity, rather hundreds or thousands of peoples. Some of them may wish to get your passwords, for instance, a disgruntled employee who might want to publish large number of passwords online (or provide access to attackers). Yes, they might also use other techniques as well, for example, push a bad update if they have such privileged access. However, that’s relevant more in targeted attacks; you can’t really push a bad update to everyone before getting caught quickly. Also, often several people have to sign the code (in the case of non-JavaScript code), and there is log trail.
- filleokus 4y agoWhile I agree with you that users should have a strong master password, the vendor is in a really privileged position and could do much more than just attempting to crack vaults offline. Why bother with cracking the vault when you can just modify the javascript sent to report back the master password? Especially if you only do targeted attacks, and/or heavily obfuscate the phoning home, the chances of getting away with it is probably pretty high.