Ask HN: How comfortable do you feel using cloud-based password managers?

I'm currently using LastPass, keeping my bank, anything that can control my bank, and my email(s), but I wouldn't mind switching to something less centralized.

It's my opinion that you end up having to trust someone, and having a password manager that I can arbitrarily make new identities with secure passwords automagically outweighs the small (imo) chance that the password manager is untrustworthy.

I don't trust clouds either. Using offline desktop software, making backups on HDDs and once in a few months on DVD-R. For data I don't care too much, like game accounts, saving passwords in browser.

> With the cloud, you can assume that the government has access to the encrypted database. If you have a strong password, it will take them longer to brute-force your database. We are talking about two governments here: the US government (most password managers are from US companies and are hosted in US clouds) and your own (who can attempt to ask for the data), this is no issue, but I believe you should by default not trust them. This is important because it should be part of your risk assessment.

If it were just the risk of brute-forcing, I have a hard time believing this to be a real problem. Use a secure enough passphrase etc (and if that's not good enough, they could also just brute force into most of your accounts anyway). IMO the relevant thread model is more that they can convince / coerce / do it themselves the provider to change the javascript that does the client side decryption.

I use bitwarden for a good fraction of my login data, because I don't currently consider this part of my thread model...

I'm not fully convinced by bitwarden, especially the 2nd factor integration IMO isn't good enough. But I've not had enough to time to look much further.

I wish there were something that used (as a second round of encryption) a key residing on a yubikey to decrypt the password of individual entries, without going through gpg. Going through gpg just seems to complicated and fragile to me, and has annoying restrictions like not really allowing multiple yubikeys.

It really surprises me that people are using pass or any other password manager developed as open source.

Yes, the code is open source, but unless you download the code yourself and compile it, which not many people do on desktop and no one does for mobile clients, you have to trust the deploy process of a random group of people. None of the people even have to be malicious. They just have to have an insecure deploy process (which allows an attacker to insert code), which is extremely common in open source. Very few if any open source projects have audited their deploy process and have monitoring for vulnerabilities or exploits happening. It's just too time intensive/expensive for a side project someone isn't getting paid for.

I prefer to trust an organization that has gone through tons of audits. Not just on whether the client is secure (can encrypt securely), but that their software development lifecycle is secure. They also have a huge financial incentive to keep things secure, which is not the case in open source.

I agree completely with your logic, especially that a password vendor can see passwords anyways. Introducing fewer parties reduces points of failure.

I save all money related passwords... Much safer than my faulty memory or having them listed in a doc somewhere.