4 ms·

Honest question: what's the point of password managers? By migrating from one to the other, aren't you exposing yourself to the exact same risk?

tomsmeding 4y ago
The point is to allow oneself to use a different password for each website, and strong ones at that. The time required to memorise a large number of strong passwords is significant, and a password manager alleviates that.
- throw_pm23 4y ago
  Why not store them locally (in a file on your laptop) or on a piece of paper in your wallet?
  - foundart 4y ago
    What happens if your laptop is stolen or its hard drive fails or you lose your wallet?
    - throw_pm23 4y ago
      The same thing like when you lose your car-key or any other valuable.
  - x86x87 4y ago
    Lol. A piece of paper with 200 passwords?
  - a10c 4y ago
    I don't have my laptop with me everywhere I go and use my phone, iPad etc to log in to services.
selykg 4y ago
The alternative right now is to use the same password everywhere. That's even worse. If one site is breached you have to go change your password everywhere. By using a password manager if one site is breached you just have to change that one password for that site. Using the same password everywhere is a real concern that should be avoided at all costs. LastPass's breach is the exception to the rule. Generally speaking password managers have had a far better go of things than LastPass has. By far, using a quality (LastPass is not one of them and frankly never has been) password manager is likely going to be the most secure thing that any average user uses every day. This breach is much the same as the typical media stuff, hyperbole does no one any good. One bad thing happens and the sky is falling (hyperbole). No, the sky is falling for that app (LastPass) but not for every password manager. You have two really good options: Bitwarden and 1Password. I, personally, wouldn't touch any others that are cloud based. Local password managers are another matter, but they're simply a non-option for me and I'm not willing to give up the convenience, or the administration abilities that come with it in a business environment.
- Izkata 4y ago
  > The alternative right now is to use the same password everywhere. That's even worse. Or to just use the browser's saving functionality and never push your passwords online in the first place. They're probably only using one primary device like me; I generally don't log in to stuff on my phone, or personal stuff on my work laptop/work stuff on my personal laptop. If their habits are like mine then these cloud password services are pretty pointless.
  - fullstop 4y ago
    You're unlike most people in that regard. I'm signed into services on at least two or three devices -- a desktop, a laptop, and my phone. Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow? I don't know if this has changed, but a few years ago the stored passwords in Chrome were stored unencrypted in a sqlite3 database. (on Linux, at least) I'd use an audited service such as Bitwarden or roll my own Keepass thing before using the browser's saved password feature. All it would take is one RCE exploit in a browser to expose your passwords.
acdha 4y ago
Password reuse is the most common way people are breached. Until there’s pervasive WebAuthn passkey support, that means you need a way to store unique passwords for everything you use and that can’t be algorithmic because different sites have conflicting policies. Other password managers don’t have Last Pass’ long history of security concerns. They also have hardening against this specific scenario. For example, 1Password assumes they could be breached and includes a strong random key which is unique per-user so in an event like this the attacker would have to do a lot more work to break vaults: https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/
- deleted 4y ago
  [deleted]
jabroni_salad 4y ago
My work keepass has 68 credentials in it. I am not going to memorize all of that.
phonebucket 4y ago
> By migrating from one to the other, aren't you exposing yourself to the exact same risk? My main gripe with LastPass is that they did not encrypt everything. Vast amounts of important information (email addresses, billing addresses, telephone numbers, IP addresses, website URLS [0]) were not encrypted on user's local machines with the master password, and subsequently have fallen into the hands of a malicious actor. I would feel much better about LastPass if the security genuinely was safeguarded by a strong master password. But they've demonstrated that it's not. Other password managers, as far as I can see, provide much greater protection in terms of encrypting everything. That's why I'd feel better about using them. [0] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-...

tomsmeding 4y ago

The point is to allow oneself to use a different password for each website, and strong ones at that. The time required to memorise a large number of strong passwords is significant, and a password manager alleviates that.

throw_pm23 4y ago
Why not store them locally (in a file on your laptop) or on a piece of paper in your wallet?
- foundart 4y ago
  What happens if your laptop is stolen or its hard drive fails or you lose your wallet?
  - throw_pm23 4y ago
    The same thing like when you lose your car-key or any other valuable.
- x86x87 4y ago
  Lol. A piece of paper with 200 passwords?
- a10c 4y ago
  I don't have my laptop with me everywhere I go and use my phone, iPad etc to log in to services.

selykg 4y ago

The alternative right now is to use the same password everywhere. That's even worse. If one site is breached you have to go change your password everywhere. By using a password manager if one site is breached you just have to change that one password for that site. Using the same password everywhere is a real concern that should be avoided at all costs. LastPass's breach is the exception to the rule. Generally speaking password managers have had a far better go of things than LastPass has. By far, using a quality (LastPass is not one of them and frankly never has been) password manager is likely going to be the most secure thing that any average user uses every day. This breach is much the same as the typical media stuff, hyperbole does no one any good. One bad thing happens and the sky is falling (hyperbole). No, the sky is falling for that app (LastPass) but not for every password manager. You have two really good options: Bitwarden and 1Password. I, personally, wouldn't touch any others that are cloud based. Local password managers are another matter, but they're simply a non-option for me and I'm not willing to give up the convenience, or the administration abilities that come with it in a business environment.

Izkata 4y ago
> The alternative right now is to use the same password everywhere. That's even worse. Or to just use the browser's saving functionality and never push your passwords online in the first place. They're probably only using one primary device like me; I generally don't log in to stuff on my phone, or personal stuff on my work laptop/work stuff on my personal laptop. If their habits are like mine then these cloud password services are pretty pointless.
- fullstop 4y ago
  You're unlike most people in that regard. I'm signed into services on at least two or three devices -- a desktop, a laptop, and my phone. Also, with your setup, what happens if the computer with the browser containing all of the saved passwords is destroyed somehow? I don't know if this has changed, but a few years ago the stored passwords in Chrome were stored unencrypted in a sqlite3 database. (on Linux, at least) I'd use an audited service such as Bitwarden or roll my own Keepass thing before using the browser's saved password feature. All it would take is one RCE exploit in a browser to expose your passwords.

acdha 4y ago

Password reuse is the most common way people are breached. Until there’s pervasive WebAuthn passkey support, that means you need a way to store unique passwords for everything you use and that can’t be algorithmic because different sites have conflicting policies. Other password managers don’t have Last Pass’ long history of security concerns. They also have hardening against this specific scenario. For example, 1Password assumes they could be breached and includes a strong random key which is unique per-user so in an event like this the attacker would have to do a lot more work to break vaults: https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/

deleted 4y ago
[deleted]

jabroni_salad 4y ago

My work keepass has 68 credentials in it. I am not going to memorize all of that.

phonebucket 4y ago

> By migrating from one to the other, aren't you exposing yourself to the exact same risk? My main gripe with LastPass is that they did not encrypt everything. Vast amounts of important information (email addresses, billing addresses, telephone numbers, IP addresses, website URLS [0]) were not encrypted on user's local machines with the master password, and subsequently have fallen into the hands of a malicious actor. I would feel much better about LastPass if the security genuinely was safeguarded by a strong master password. But they've demonstrated that it's not. Other password managers, as far as I can see, provide much greater protection in terms of encrypting everything. That's why I'd feel better about using them. [0] https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/ https://blog.lastpass.com/2022/12/notice-of-recent-security-...