4 ms·

You may feel safer that way, but it is not. If a dedicated attacker can breach Okta, they can surely breach your self-hosted, self-synced password manager you m

by mirzap 3y ago

You may feel safer that way, but it is not. If a dedicated attacker can breach Okta, they can surely breach your self-hosted, self-synced password manager you manage, which you forgot to update on time, or you don't get an update on time. Remember, these organizations fix the issues weeks, sometimes months, before they release the statement. If you use open-source and a critical bug is found, you'll get a patch with a press release, while all other large services fixed that already. For average Jane or Joe, the risk-benefit ratio favors services against self-hosted solutions.

offices 3y ago
>If a dedicated attacker can breach Okta, they can surely breach your self-hosted, self-synced password manager you manage They can't and they won't because these are different threat models with vastly different incentives.
waihtis 3y ago
False, because it's not only a matter of technical difficulty, but also one of economics. Very unlikely for your average person to be a victim of a deliberate targeted attack.
- mirzap 3y ago
  Not targeted, but a random attack and data leak is very likely. Much more likely than if they used the service. That's why 99.999% of people should stick with the services.
  - usrbinbash 3y ago
    A random attack that just happens to breach specifically my home server, that uses custom made service scripts to enable syncing to my devices, isn't reachable from the internet, and is airgapped from my DMZ? Which then somehow manages to exfiltrate and decrypt data that is still encrypted with a public key, the private key to which is not stored on that system, and itself encrypted symetrically? Yeah, that doesn't sound like a "random attack" to me, that sounds like a subplot in a Keanu Reeves Movie...
- blantonl 3y ago
  What is an "average person?" There is probably a half way decent chance that the vast majority of participants here, in singular, that would be economically gold mines for compromise.
  - mirzap 3y ago
    A bad term, I would say now, "most people." For me, hosting a password manager is like hosting an email server. There are situations where it makes sense. But for 99.99% of people, services are just good enough. Not to mention what a gold mine emails are if they get compromised.
- dubcanada 3y ago
  I suppose in that sense hanging out with a rich friend would mean you're very unlikely to be kidnapped. While probably true most of the time. It does give you a false sense of security, which makes you a very easy and potentially profitable catch. If you fail to update and a scripted bot catches you, the actor notified will certainly see what's in there. And if anything you're more likely never to find out. Which means they can just come after a few months later. Maybe they stole your first CC and then your second CC. I think there is possibilities there that make sense.
worksonmine 3y ago
> If a dedicated attacker can breach Okta, they can surely breach your self-hosted, self-synced password manager you manage, which you forgot to update on time, or you don't get an update on time. Why would you assume the self-hosted alternative even has a server to be breached? If this is the same Okta breach from this week it was a human support channel that was breached. There's nobody like that in front of my setup, and no server or open ports.
- mirzap 3y ago
  Good for you. But the average user wants a password manager on all their devices, including web and mobile browsers. They don't want keepassx and to keep track of a single file. There's nothing to gain, except a false sense of security.
  - worksonmine 3y ago
    The preferences of normal users aren't relevant for the privacy and security minded. They will always choose the easy route, which was the point of the comment you initially replied to. Here's a quote: > And people keep asking me why I use a self-hosted, self synced, password manager instead of using one of those super-easy, super-helpful online services to do it for me. The security of self-hosting and keeping the backups up to date (trivial to automate for computer-literate users) is not false compared to getting pwned by customer service with enough access to be dangerous. You're making it sound way more difficult than it is.
usrbinbash 3y ago
An attacker would first have to find my system, specifically, and then breach it. In terms of the most common method of breaching systems, social engineering, it is me, a single software engineer with a very solid background as a sysadmin, compared to a staff of many hundreds or thousands of employees at a large, visible company. So simply in terms of attack surface, exposure and discoverability, doing that is a REALLY tall order. Many animals on this world survive not because they are huge and strong, but because they are tiny, fast and next to invisible. Economics play a huge role in attacking systems. Targeted attacks are time consuming, costly, and if the end result is one guys passwords, usually not worth it. People carrying out such attacks want to use a dragnet, not a fishing rope. > If you use open-source and a critical bug is found ...then many many many large organisations have the same problems as I do, only while being a lot more exposed and visible than me. Because the software I use relies on the same standardized, battle tested, vetted and re-vetted for years technologies as many commercial products.

by mirzap 3y ago

offices 3y ago

>If a dedicated attacker can breach Okta, they can surely breach your self-hosted, self-synced password manager you manage They can't and they won't because these are different threat models with vastly different incentives.

waihtis 3y ago

False, because it's not only a matter of technical difficulty, but also one of economics. Very unlikely for your average person to be a victim of a deliberate targeted attack.

mirzap 3y ago
Not targeted, but a random attack and data leak is very likely. Much more likely than if they used the service. That's why 99.999% of people should stick with the services.
- usrbinbash 3y ago
  A random attack that just happens to breach specifically my home server, that uses custom made service scripts to enable syncing to my devices, isn't reachable from the internet, and is airgapped from my DMZ? Which then somehow manages to exfiltrate and decrypt data that is still encrypted with a public key, the private key to which is not stored on that system, and itself encrypted symetrically? Yeah, that doesn't sound like a "random attack" to me, that sounds like a subplot in a Keanu Reeves Movie...
blantonl 3y ago
What is an "average person?" There is probably a half way decent chance that the vast majority of participants here, in singular, that would be economically gold mines for compromise.
- mirzap 3y ago
  A bad term, I would say now, "most people." For me, hosting a password manager is like hosting an email server. There are situations where it makes sense. But for 99.99% of people, services are just good enough. Not to mention what a gold mine emails are if they get compromised.
dubcanada 3y ago
I suppose in that sense hanging out with a rich friend would mean you're very unlikely to be kidnapped. While probably true most of the time. It does give you a false sense of security, which makes you a very easy and potentially profitable catch. If you fail to update and a scripted bot catches you, the actor notified will certainly see what's in there. And if anything you're more likely never to find out. Which means they can just come after a few months later. Maybe they stole your first CC and then your second CC. I think there is possibilities there that make sense.

worksonmine 3y ago

> If a dedicated attacker can breach Okta, they can surely breach your self-hosted, self-synced password manager you manage, which you forgot to update on time, or you don't get an update on time. Why would you assume the self-hosted alternative even has a server to be breached? If this is the same Okta breach from this week it was a human support channel that was breached. There's nobody like that in front of my setup, and no server or open ports.

mirzap 3y ago
Good for you. But the average user wants a password manager on all their devices, including web and mobile browsers. They don't want keepassx and to keep track of a single file. There's nothing to gain, except a false sense of security.
- worksonmine 3y ago
  The preferences of normal users aren't relevant for the privacy and security minded. They will always choose the easy route, which was the point of the comment you initially replied to. Here's a quote: > And people keep asking me why I use a self-hosted, self synced, password manager instead of using one of those super-easy, super-helpful online services to do it for me. The security of self-hosting and keeping the backups up to date (trivial to automate for computer-literate users) is not false compared to getting pwned by customer service with enough access to be dangerous. You're making it sound way more difficult than it is.

usrbinbash 3y ago

An attacker would first have to find my system, specifically, and then breach it. In terms of the most common method of breaching systems, social engineering, it is me, a single software engineer with a very solid background as a sysadmin, compared to a staff of many hundreds or thousands of employees at a large, visible company. So simply in terms of attack surface, exposure and discoverability, doing that is a REALLY tall order. Many animals on this world survive not because they are huge and strong, but because they are tiny, fast and next to invisible. Economics play a huge role in attacking systems. Targeted attacks are time consuming, costly, and if the end result is one guys passwords, usually not worth it. People carrying out such attacks want to use a dragnet, not a fishing rope. > If you use open-source and a critical bug is found ...then many many many large organisations have the same problems as I do, only while being a lot more exposed and visible than me. Because the software I use relies on the same standardized, battle tested, vetted and re-vetted for years technologies as many commercial products.