Ask HN: How comfortable do you feel using cloud-based password managers?

It took me a while to come around, but Bitwarden finally convinced me. Both the clients and servers (there are third-party implementations) are open-source and besides the security audit they had some time ago, I also checked some components myself to reassure myself that all outgoing data is in fact encrypted and that the decryption is done client-side.

The only way I can see someone getting to my passwords is by getting malicious code into the browser extension and/or mobile app. That means the only viable attacks are through Mozilla and Google, who I already have to trust for my browser and mobile OS.

After I lost one copy of my passwords database in Dashlane, I've moved to Firefox Sync. Then years later, after switching to Vivaldi I've pick offline Enpass but I still have KeepassX as backup solution if they would decide to abandon their business.

I'm not a fan of cloud storage that much anyway - not after Dropbox invited C. Rice to board of directors. [1]

[1]- https://en.wikipedia.org/wiki/Criticism_of_Dropbox#April_201...

I don't.

I use KeePass, well now I guess it's KeePassXC, and I keep up with my onsite backups. There have been way, way more problems with 3rd party and cloud based services than I've had with my private system.

I've survived a couple of hardware failures, a few problems I created myself, and effortlessly migrated from Windows to MacOS to Linux in the meantime.

I'm not comfortable at all using them. For one thing, I can't tell how they're really storing the passwords, or what kind of encryption they're using there, so I end up being forced to merely trust they're doing the right thing rather than giving backdoors to others or rolling out their own crypto or using some setup that can be reversed on their side.

Additionally, I also believe that:

1. I should have access to all my passwords without a working or stable internet connection

2. And that I should leave as few ways for social media/cancel culture pressure to affect my life as possible.

Hence offline systems like KeePass work fine for me. I can trust they're not providing backdoors, I don't have to worry about a third party server getting hacked, they're accessible offline and if I end up in a controversy, my enemies can't do anything to get my account suspended or terminated.

I think it's just stupid to trust anyone with your passwords even when they are encrypted.

We all know how just after some years all encryption can be rendered useless by some technical advancement or mathematical brake-through (potentially).

In my opinion you are far better off with some device (mooltipass, yubikey) that holds your credentials because you have physical control over it and the chances your encrypted passwords are stolen are much lower than going with the cloud option.

This isn't about being paranoid but about minimizing the risk of ones credential being exposed/compromised.

We trust entities far too much for my taste and next to credentials I also don't feel comfortable with private pictures and videos of/with me being uploaded to some cloud.

1. Something could go wrong while transport (poor SSL/TLS, compromised devices in between (MITM) & weak crypto) 2. Something could go wrong on the companies side (failure to implement crypto properly, usage of weak crypto, bad server security) 3. Most encryption can be broken and it probably will be broken. This isn't about the fear of quantum computing but plain logic. Crypto often relies on some mathematical assumption that states that no one can break something in a realistic amount of time (e.g. discrete logarithms) which is rendered useless by superior equipment/power to calculate. Then there is implementation details which are too complex (or the people who implement it just don't take enough care) to be executed in the correct (=secure) way, easily.

This is a problem we can see on many waypoints in these scenarios and this fact for itself increases the risk of being compromised in a scale I'll always try to weigh in and to minimize.