Password Manager Security
The cluster discusses the security risks and benefits of password managers like 1Password, LastPass, and KeePass, debating single points of failure, master password theft, client-side encryption, and breach resilience.
Activity Over Time
Top Contributors
Keywords
Sample Comments
It's still a single point of failure if the password manager is compromised.
You're assuming a compromised password == compromised 1Password vault which is clearly not going to be the case most of the time
The possibility of a site getting hacked or being attacked may be low but not unexpected. Many of these services don't know your actual passwords, they just have a file that's cryptographically secure with your passwords in there which in the case of an actual breach, only you (the owner/creator of said password list) has the keys to get into it. You just have to be responsible enough to know where your keys are to get at that list or it's lost for good. The likelihood of someone actually cracki
Unless someone steals the password to your password manager...
As long as they encrypt the stored passwords and you don't use your master password anywhere else, there's not much that can go wrong.
This strikes me as less secure then a password manager that stores passwords. Here, if someone gets my master password all is lost. With stored passwords, they'd have to get both my master password and the encrypted passwords.
This seems no better than a password manager that stores encrypted passwords but not the decryption key.
a security breach on the server wouldn't mean that your passwords are compromised.with the subscription model, they're protected by both your master password, and your account key (128? bit key generated at account creation).neither of those leave your computer.
It sounds like you're worried about theft of master password or theft of password database once gathered in one place.For the former, use auth app-based 2FA against your master password to guard against unwarranted access, preferably using a physical key.For the latter, review the security protocols your third-party provider specifies for how they protect your data. That should give you confidence about the likelihood of database leakage. If even that doesn't give you confidence,
Okay, but still, your pwd manager could get hacked