Plenty comfortable with LastPass here.
Ask HN: How comfortable do you feel using cloud-based password managers?
11–20 of 199 posts
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#12I'm using a self-hosted Nextcloud which stores my passwords. There are 'apps' for Firefox and Android. They're not perfect but work quite well for my use, I have both the benefit of cloud-based, centralised passwords and nobody-else-but-me can touch them.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#13Same way I feel about security domains at work: you either have to trust encryption, or never use any network. It’s that binary. At work I’ll see people — the security team, usually — taking some already-encrypted thing and re-hardening it to the nth degree. I think that’s stupid. If you don’t trust your encryption, don’t bother using it. If you do trust it, stop there. It’s maths. It’s proven. I feel the same about…
It's not about trusting the encryption, it's about trusting who does the encryption.
If you are encrypting a password store and using the cloud only for sync, you're trusting an encryption standard.
If you are using a cloud based password manager from a service provider, they may be using encryption, but your trust has to be in the company and their employees.
It's a rather large distinction.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#14The cloud is not the automatic solution to the problem of passwords- chiefly that third parties cannot be trusted to keep them secure.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#15For me: I don't trust them. You know how people often say "if you didn't want it to be public you shouldn't have put it on the internet"? Well, that. If there's anything worse than a breach that reveals my secure password it's a breach that reveals all of my passwords at once.
For other people, such as family members: I totally recommend it. It is way better than whatever password reuse they are doing now, and the chances of a breach are low enough.
My point being: I think they are overall better than not using anything, but if you have the knowledge and diligence to keep an offline encrypted file (and its backup!) up to date, then I would suggest doing that instead.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#16I'm not a big fan of putting my password (encrypted or not) somewhere where I don't have control. Therefore, I am using Passbolt[0] at work, since that gets me a browser addon plus web ui, while it also allows me to host it myself, i.e. where I can physically check what ends up written where in the database. Passbolt is open-source, encryption and sharing is GnuPG-based, and they have paid plans available.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#17I only trust them when they're open-source and I can self-host it on my own hardware. That's why I settled for Bitwarden (or to be more exact, bitwarden-rs).
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#18I think the important is for the client-side process to be fully trusted. If only encrypted data is going to a remote location and there isn't a risk of the process being hijacked on the client side you should be good to go.
That said, I use my own remote storage (not cloud) with keepass's sftp plugin.
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#19[deleted]
Re: Ask HN: How comfortable do you feel using cloud-based password managers?
#20Same way I feel about security domains at work: you either have to trust encryption, or never use any network. It’s that binary. At work I’ll see people — the security team, usually — taking some already-encrypted thing and re-hardening it to the nth degree. I think that’s stupid. If you don’t trust your encryption, don’t bother using it. If you do trust it, stop there. It’s maths. It’s proven. I feel the same about…
>maths. It’s proven.
No they are not. That’s one of the things that makes designing correct crypto systems difficult. Going the wrong way through most cryptographic trap doors is conjectured to be difficult but I’m unaware of a single one that’s proven.