> Ask HN: Why do people use [cloud-based] Password Managers? People use cloud-based password managers because they provide data resiliency. If you store your p

> Ask HN: Why do people use [cloud-based] Password Managers? People use cloud-based password managers because they provide data resiliency. If you store your passwords locally only, you will have a day when your hard drive crashes, you've lost all of your passwords, and you will be in a very bad situation. > The key difference here being that this is two way hashing so passwords can be decrypted. There's no such thing as "two-way hashing". If you're worried that the master password password-hashing algorithm is crackable, that's fair, but that's only a problem if you use a weak master password. If you use a, say, 96-bit master password (e.g., 16 random base58 characters), then honestly you're pretty damn safe with even if a site only uses a single pass of SHA-256. But no one's using a single pass of SHA-256, they're using a PBKDF, which means you can use a few less chars in practice for the same security guarantee. > In reality, there are a lot of attack vectors like MITM The security of a remote password manager will only be as secure as the transport encryption, this is true. But TLS is pretty solid these days, the risk of breaking it is much smaller than other risks involved here. > event logging or sometimes straight up storing data in plaintext You will need to trust that the cloud-based provider doesn't store anything in plaintext. I trust my provider. I don't trust all of them.