4 ms·
It's a matter of target payoff. Dropbox, Drive, etc. are not specific to just storing password DBs. If my account is compromised, the attacker has one DB for t
by lost_my_pwd 11y ago
It's a matter of target payoff. Dropbox, Drive, etc. are not specific to just storing password DBs.
If my account is compromised, the attacker has one DB for their effort. If a cloud storage is compromised, the attacker has to scan through everything looking for DB files.
LastPass cloud storage is meant only for storing password DBs, so an attacker knows that within a single target lies a large trove a specific type of data.
- savanaly 11y agoI don't understand this. So LastPass could increase their security by including a bunch of pictures of puppies in their folder for me? Why not do it then?
- acdha 11y agoI don't really buy it but I've heard the theory expressed that LastPass is more of a target because an attacker knows that a compromise could get millions of valid logins but something like Dropbox is less of a known quantity with more things to sift through. I'm skeptical that a) our hypothetical attacker couldn't search for files to get all of those synced 1Password files or b) that such a complete compromise wouldn't turn over enough interesting personal docs to make the potential resale value quite lucrative – “They got my tax return but fortunately not my nytimes.com password!”. In either case, pure worst-case analysis isn't terribly useful without some concept of relative likelihood.
- lost_my_pwd 11y agoIf one were looking to steal a bunch of jewelry, would it make more sense to hit a jewelry store or some large shopping mall?
- rwhitman 11y agoThere are several ways to expose data on dropbox as the result of human error that don't apply to lastpass