3 ms·

Password managers are very different. The details get encrypted using a passphrase, and only the encrypted data gets sent to the password manager. You don't hav

Password managers are very different. The details get encrypted using a passphrase, and only the encrypted data gets sent to the password manager. You don't have to trust the backend unless the frontend is changed to send non-encrypted data and/or your passphrase.

SoftTalker 2y ago
You have to trust the frontend though. And where did you get that from?
- __MatrixMan__ 2y ago
  And even if you audited its code, would you re-audit it if that code changed?
  - repelsteeltje 2y ago
    Contrary to what crypto fantastics might have you believe, software eco systems are always built on trust. Audits are but a means to try champion that trust. And, indeed by no means a silver bullet at that.
    - GTP 2y ago
      > software eco systems are always built on trust. Yes but, depending on how the ecosystem is built, the amount of trust needed can be smaller or greater. Reality isn't black or white, we also have shades and colors.
    - __MatrixMan__ 2y ago
      Of course. I'd just rather trust many people narrowly rather than trusting a few people with everything. And the people who can push updates to password manager front ends... we're trusting them with everything. It's a situation which calls for a bit of extra diligence.
- GTP 2y ago
  I use KeepassXC and synchronize the encrypted database across my devices using my own Nextcloud instance. But even if I used a mainstream cloud provider, that wouldn't matter since the db is encrypted and decrypted locally. Regarding trusting the frontend, in my case I just need to check that KeepassXC itself isn't sending data around. Which I admit I didn't do so far, but in my view the alternative of reusing password is much more likely to get you in trouble compared to the likelihood of KeepassXC sending your data to a tird party without anyone noticing.

3 ms·

Password managers are very different. The details get encrypted using a passphrase, and only the encrypted data gets sent to the password manager. You don't hav

by figmert 2y ago

SoftTalker 2y ago
You have to trust the frontend though. And where did you get that from?
- __MatrixMan__ 2y ago
  And even if you audited its code, would you re-audit it if that code changed?
  - repelsteeltje 2y ago
    Contrary to what crypto fantastics might have you believe, software eco systems are always built on trust. Audits are but a means to try champion that trust. And, indeed by no means a silver bullet at that.
    - GTP 2y ago
      > software eco systems are always built on trust. Yes but, depending on how the ecosystem is built, the amount of trust needed can be smaller or greater. Reality isn't black or white, we also have shades and colors.
    - __MatrixMan__ 2y ago
      Of course. I'd just rather trust many people narrowly rather than trusting a few people with everything. And the people who can push updates to password manager front ends... we're trusting them with everything. It's a situation which calls for a bit of extra diligence.
- GTP 2y ago
  I use KeepassXC and synchronize the encrypted database across my devices using my own Nextcloud instance. But even if I used a mainstream cloud provider, that wouldn't matter since the db is encrypted and decrypted locally. Regarding trusting the frontend, in my case I just need to check that KeepassXC itself isn't sending data around. Which I admit I didn't do so far, but in my view the alternative of reusing password is much more likely to get you in trouble compared to the likelihood of KeepassXC sending your data to a tird party without anyone noticing.