4 ms·

Can someone explain it to me like I am 5 years old. Why would I take all my passwords, centralize them and place them onto a 3rd party site? Why is this securi

Can someone explain it to me like I am 5 years old. Why would I take all my passwords, centralize them and place them onto a 3rd party site? Why is this security best practice?

ejb999 4y ago
It's not.
sofixa 4y ago
It's a recommended practice (I hate the term "best", everything depends). Why? Quite easy actually - having random passwords is better than reusing the same everywhere. Random passwords are impossible to remember by a regular human, hence you need a password manager. Using a local file as a password manager poses a usability/availability risk (you have to sync it yourself, you have to back it up yourself, you have to make it available on all devices without putting it at risk, you have to secure it, etc.), hence cloud-based password managers are better for the average person, especially coupled with MFA for critical accounts (banks, email, etc.). If you're a highly technical or highly security conscious person, or under threat, the equation changes of course, but the recommendation for a cloud-based password manager isn't meant to apply to everyone, just most people.
daveoc64 4y ago
Because using a password manager as intended solves several well-known and very common password-related attacks like credential stuffing. A password manager makes it possible for the average person to have high length, completely random passwords for each and every site, and to have them available on all of their devices. That makes it a lot less likely that people will do bad things like re-using passwords, having short passwords, or writing them down. My LastPass account would have been in the breach, but as my vault was protected with 151,000 iterations and a very long password, it'd take an attacker a long time to be able to get to my Hacker News password, which they'd find was 50 random characters long and looked something like jtES^cqhPj3@&rgPW5#frmDpf#^gGyf3eRoPH#fUZWJQGNFJvW They'd also find that I've since changed it!
loudmax 4y ago
You have to consider what the security landscape looked like when LastPass got going in 2008. The common practice for non-technical people was (or still is) to reuse the same password everywhere. A password that's really easy to remember like "p@$$word". In this context, the common alternative to LastPass isn't best practice, it's worst practice.
npteljes 4y ago
It's not a security best practice, but a security "good enough".
silverlake 4y ago
You can publicly post an encrypted password file and dare hackers to break it, assuming your password is >80bits of entropy. All this worry about cloud storage and web access is due to ignorance about encryption.

Can someone explain it to me like I am 5 years old. Why would I take all my passwords, centralize them and place them onto a 3rd party site? Why is this security best practice?

ejb999 4y ago

It's not.

sofixa 4y ago

It's a recommended practice (I hate the term "best", everything depends). Why? Quite easy actually - having random passwords is better than reusing the same everywhere. Random passwords are impossible to remember by a regular human, hence you need a password manager. Using a local file as a password manager poses a usability/availability risk (you have to sync it yourself, you have to back it up yourself, you have to make it available on all devices without putting it at risk, you have to secure it, etc.), hence cloud-based password managers are better for the average person, especially coupled with MFA for critical accounts (banks, email, etc.). If you're a highly technical or highly security conscious person, or under threat, the equation changes of course, but the recommendation for a cloud-based password manager isn't meant to apply to everyone, just most people.

daveoc64 4y ago

Because using a password manager as intended solves several well-known and very common password-related attacks like credential stuffing. A password manager makes it possible for the average person to have high length, completely random passwords for each and every site, and to have them available on all of their devices. That makes it a lot less likely that people will do bad things like re-using passwords, having short passwords, or writing them down. My LastPass account would have been in the breach, but as my vault was protected with 151,000 iterations and a very long password, it'd take an attacker a long time to be able to get to my Hacker News password, which they'd find was 50 random characters long and looked something like jtES^cqhPj3@&rgPW5#frmDpf#^gGyf3eRoPH#fUZWJQGNFJvW They'd also find that I've since changed it!

loudmax 4y ago

You have to consider what the security landscape looked like when LastPass got going in 2008. The common practice for non-technical people was (or still is) to reuse the same password everywhere. A password that's really easy to remember like "p@$$word". In this context, the common alternative to LastPass isn't best practice, it's worst practice.

npteljes 4y ago

It's not a security best practice, but a security "good enough".

silverlake 4y ago

You can publicly post an encrypted password file and dare hackers to break it, assuming your password is >80bits of entropy. All this worry about cloud storage and web access is due to ignorance about encryption.