3 ms·
> I was specifically talking about _online_ password managers [...] considering the clients are web browsers Is that an actual thing?! I'm only familiar with p
by anyfoo 4y ago
> I was specifically talking about _online_ password managers [...] considering the clients are web browsers
Is that an actual thing?! I'm only familiar with password managers that use the Internet to synchronize, i.e. it's still 100% possible to apply the cryptography such that the service vendor or anyone else cannot read your passwords stored or in transit.
I can maaaybe imagine password managers with a web interface that however still decrypts locally, client-side.
- imiric 4y agoTLS does a good job at this, and I'm not assuming it's compromised. But it's complex to setup correctly, and I'd rather avoid the need to transmit sensitive data everytime I access my credentials, and entrust my most critical information with a 3rd party, all to support a service that shouldn't exist to begin with. Password managers are currently a necessary evil, so if you must use them, use an offline one, and sync across devices via any other secure mechanism.
- anyfoo 4y ago> TLS does a good job at this, and I'm not assuming it's compromised. But it's complex to setup correctly TLS has nothing to do with it. TLS is transport security, which is relatively useless for preventing the service provider to access your data. I'm sorry to say this, but this is just word salad, including the "I'm not assuming it's compromised" bit. > and entrust my most critical information with a 3rd party The point is you don't need to do that, and can still sync over the Internet.