It seems to me (hence this question), that storing all your passwords online and accessing them with a single “unlock” password would be extremely dangerous. If the locker service is itself hacked, then the hackers will have ALL your passwords for the price of getting one password.
In: Technology
[removed]
[removed]
Why these are secure is somewhat complicated.
Firstly, the locker storing your passwords is no more secure than good security of passwords at your bank, or other best-practice following web apps. And…putting your password in the locker never makes it more secure than how it’s stored at some site. In fact, it ALWAYS makes it less secure – you’ve added a second vector for exploit, attack, poor management, etc.
What it IS more secure than is the real-world crap people do to keep track of passwords in a world that requires them to have so many. It’s more secure than having a cheat sheet on your computer, a post-it in your desk, a little note in your wallet. So…to understand the security of adding a second location for passwords – and one that stores all your important ones – you have to understand the alternative methods for storing lots of passwords.
If you can keep it all in your head, then that is more secure than a password locker.
Normal websites store your passwords. So if the database gets leaked it has everyone’s passwords.
Password managers use whats called zero access encryption, which means all of your data is encrypted using your master password, so the password is not stored anywhere and you can’t decrypt the data without it, which is why your password has to be long, complex, and most importantly not reused. Also avoid lastpass, because they store your master password.
What’s the alternative?
If you use the same password across multiple websites, then if *any* of those websites are hacked then your password could be compromised. Your password is only as strong as the weakest security amongst all the websites you use it on.
So you need to make sure you use a unique password for every site, how do you keep track of that?
Of course, keeping your password list entirely offline would be the most secure thing you can do, but at a certain point most people are willing to sacrifice some security for convenience.
Good password storage services try to mitigate the risk as much as possible.
– They should encrypt your password list with a master password that only you know
– They should let you use 2 factor auth to mitigate someone stealing your master password
– They should notify their customers immediately if there are any security breaches
Ultimately it comes down to who you can trust more: the password storage service or the weakest of all the sites that you use to store your single common password.
Ideally, everyone has a high strength password for every account.
But the thing is, everybody has tons and tons of accounts everywhere.
There are just too many passwords for a human being to remember.
This results in people using the same password in many places, or using easy to guess passwords, just so their ape brains can remember.
And not all websites are good with their security. Some no name forum with a security scheme that hasn’t been updated since 2008 might hold a password in plain text. This password being reused in a high security account. Stealing that password is easy and can be used to break into a stronger security account.
The password locker prevents this kind of attack, by doing the remembering for you.
They also presumably keep their security policies better than average.
A hacker would find a much much harder target, though the rewards would be much higher.
A human can also remember one password that is much stronger than you would normally put in a website.
Your “single password” isn’t just proof of identity the way it is on reddit. Your password collection is encrypted with your “single password” before being uploaded to the locker. It is mathematically impossible (unless some kind of breakthrough happens) to break it without knowing that master password. Even the password locker service doesn’t know the master password and are just holding onto this blob of encrypted data for you.
If the hacker breaks into the locker and gets all your encrypted passwords (and everyone else’s for that matter) they still need to break through the master password in order to get the real data. That’s why it’s so important to select a good password. And in the grand scheme of a big leak, each user’s master password must be attacked independently so a good master password means that you’re probably safe unless you’re being specifically targeted and get most of the hacker’s password cracking resource as a breach of millions will spread their efforts too thin.
If you use the method where you have a file saved to disk that is half your password, then even guessing passwords isn’t enough for the bad guy because that’s only half of it.
… But all this means that if you forget your master password, you’re out of luck unless you took precautions beforehand. There is no recovery.
A year or two ago lastpass got hacked so it has happened and everyone on the service had to go change their master password. Luckily they caught it fast.
Ultimately people have a lot of credentials, which leave a few options. You can use the same password everywhere, but if one account gets hacked they have the password to all your accounts. If you don’t do this they you are going to have a list of passwords. Online vaults are simply more secure then putting the password on a list on your computer, even if you encrypt your list, if the computer crashes you lose all your passwords.
To simplify, there is no zero risk when it comes to credentials but the online secure vault is the least risk for disaster recovery and being compromised. Secure only means more secure than other options.
Here’s what I do for a password:
The name of the website + either a semi-weak password for a website that has no financial information, or a pretty strong password I usually use for financial websites + some kind of a pin number (optional) + a word or something that you have written down, carried in your wallet or next to your PC or whatever (optional)
To put it in ELI5 terms: Imagine I tell you to think of a number but not tell me. Let’s say you pick 25. That is now your key (master password) and only you know it. When you need to give me a password to store, you first multiply the password by your master key and give me the end result.
Let’s say you want to store the password “1234”. You would take 1234 and multiply it by the master key you chose (25) and get the result: 30,850. I will now store “30,850” on my server as the password. Any time you need to access that password, I will send you 30,850. Since you know your master key is 25, you do 30,850 ÷ 25 and presto: you now see the password is 1234.
If a hacker were to break into my system and read your password, they would see the encrypted password 30,850. The only way for them to figure out the real password would be to know what your master key is.
Of course real encryption uses infinitely more math and added complications like hashing and salting, but that’s the incredibly dumbed down version of the system, enough that a kid could get it.
Latest Answers