2 ms·
The whole approach that LastPass uses of only encrypting the vault with the master password is just bad security - it really doesn't matter how many rounds of a
by hn_throwaway_99 3y ago
The whole approach that LastPass uses of only encrypting the vault with the master password is just bad security - it really doesn't matter how many rounds of a key derivation algorithm they use.
The 1Password approach provides much better security. The vault is protected with the master password together with a long randomly generated string. That random string is saved on device on first login, so subsequent decryptions just require the master password. Logging in on new devices require this "account key", but the added security of having a completely uncrackable encrypted vault, regardless of the entropy in the master password, is very much worth it.
- danparsonson 3y agoSerious question - I've never used 1Password - what happens if you only ever use one device and that device becomes permanently unavailable for some reason (stolen, destroyed, etc)?
- hn_throwaway_99 3y agoAs part of the setup process 1Password has you print out an "Emergency Kit" that contains your secret key, https://support.1password.com/secret-key-security/ https://support.1password.com/secret-key-security/. But you are absolutely correct, if you lose your device and the Emergency Kit you're SOL. It reality, though, that is mitigated by the fact that: 1. I think it's probably pretty rare to install 1P on only a single device, as the biggest benefit of any hosted password manager is syncing. I think the vast majority of people will install it at least on their phone and a laptop/PC. 2. I think the user experience for setting up the Emergency Kit is done well and most people are likely to do it.
- danparsonson 3y agoThanks!