It seems to me (hence this question), that storing all your passwords online and accessing them with a single “unlock” password would be extremely dangerous. If the locker service is itself hacked, then the hackers will have ALL your passwords for the price of getting one password.
In: Technology
Your “single password” isn’t just proof of identity the way it is on reddit. Your password collection is encrypted with your “single password” before being uploaded to the locker. It is mathematically impossible (unless some kind of breakthrough happens) to break it without knowing that master password. Even the password locker service doesn’t know the master password and are just holding onto this blob of encrypted data for you.
If the hacker breaks into the locker and gets all your encrypted passwords (and everyone else’s for that matter) they still need to break through the master password in order to get the real data. That’s why it’s so important to select a good password. And in the grand scheme of a big leak, each user’s master password must be attacked independently so a good master password means that you’re probably safe unless you’re being specifically targeted and get most of the hacker’s password cracking resource as a breach of millions will spread their efforts too thin.
If you use the method where you have a file saved to disk that is half your password, then even guessing passwords isn’t enough for the bad guy because that’s only half of it.
… But all this means that if you forget your master password, you’re out of luck unless you took precautions beforehand. There is no recovery.
Latest Answers