3 ms·
Your passwords shouldn't leave your device. Chrome's password manager is pushing it. Everything else should be considered malware. I don't understand how suc
by Jerrrry 4y ago
Your passwords shouldn't leave your device.
Chrome's password manager is pushing it.
Everything else should be considered malware.
I don't understand how such a 'techy' crowd here on HN can be so belligerent with this security vs convenience trade off.
KeePass locally, gmail yourself an encrypted backup. That's it. FFS.
- eli 4y agoHow is "gmail yourself an encrypted backup" fine but "store a copy of the encrypted vault in a cloud service designed for this purpose" not?
- Jerrrry 4y ago>"designed for this purpose" I know my blob is encrypted, because I did it. Did you audit your password manager's source control? No? That is the difference.
- Accacin 4y agoI'm surprised someone as techy as the parent even uses Google if I'm honest.
- Jerrrry 4y agoBecause the amount of effort required in avoiding them is a signal stronger than the noise of appearing normal. Google is just as powerful as state actors, the same rules apply. Don't stick out.
- ffstroll 4y agoOne is an encrypted blob in the cloud, the other is an encrypted file in your email in the cloud. That’s it. FFS.
- thesh4d0w 4y agoIf the key to decrypt the vault never leaves your device, then the security implications are minimal. Well worth the convenience in my eyes, and many others apparently.
- Jerrrry 4y ago>If the key to decrypt the vault never leaves your device, >If And, if you get infected, it is all moot anyway.
- advisedwang 4y agoThis push is because there's a lot of people using weak, reused passwords out there, who are not willing (or capable in cases) of a self-managing a password manager. For the people in my life in this position, I would much rather them use lastpass or bitwarden or anything over continuing their current practice. The risk of a lost password from one of those services is much lower than of them getting hit by password stuffing or getting a password brute-forced. For a technical person I would advise a better solution, but the reason these solutions are being pushed is for widespread adoption of better password practices.
- Jerrrry 4y agoI understand and agree on the normie point; my point was geared towards the 'techies'
- probabletrain 4y agoKeeping your passwords on your device (and also in Gmail?) might work for you, but a password store that I can't conveniently access from both my computer and phone isn't useful to me, and I suspect, many others.
- RockRobotRock 4y agoYou don't know what you're talking about.
- Jerrrry 4y agoplease elaborate, all-knowing-one