Why are password managers considered good security practice when they provide a single entry for an attacker to get all of your credentials?
In: 21390
I work in tech support. One day a lady calls in because after a phone update, her third-party password manager app stopped working. The app developer decided to stop supporting the app after the phone software update, and there is no option to roll back the phone software. Needless to say, she lost all her logins and passwords that she entrusted to this app, and there was nothing anyone could do about it.
You have 30 safes in different banks. Each needs a 6 digit number to unlock as the password.
Because there are so many safes, you tend to use easy passwords. Something like your date of birth like 180317 to be used in all safes. The problem: once someone gets the password on one safe, they can access all safes now.
So you think of something more clever. Maybe an iteration based on where the safe is. E.g. Safe A is 180301, Safe B is 180302, Safe C is 180303, etc. It’s definitely more secure but it’s still bad practice. Hackers just needs to crack 3 safes and get the pattern to access 30 safes.
These are by far the most typical ways people kept passwords before password managers. Either using the same passwords for everything or a basic iteration.
Hackers might just try to crack your safe too. They don’t need to try every combination, just your birthday. So instead of doing 999999 passwords, they perhaps just need to do 3650 (10 years worth of birthdays). In practice, this is a dictionary attack, where hackers try commonly used passwords to limit the number of passwords they need to guess to crack a system. So you need a password that is not commonly used, which means it tends to get forgotten
The solution is obviously to have a random number for each safe, and keep a notebook of the passwords. Now the cracking of one safe doesn’t affect other safes, and you can use a completely random password so it’s not subject to the birthday hack mentioned earlier.
Even better is to keep the notebook in one safe (locked / encrypted), in your house where only you have access (offline) and you don’t have the password written anywhere. So with one password, you secure 30 safes. Then you can add more layers to protect that main safe like CCTV, guard dogs, a moat if you want to. All of which are not feasible to maintain for 30 safes. That’s what the password manager is
Latest Answers