Ask HN: Why do people use password managers?

From what I understand, password managers stores all your passwords in hashed format and uses your "master password" as the encrytor.

               master password
 H(password)  encrypted password

In reality, there are a lot of attack vectors like MITM, event logging or sometimes straight up storing data in plaintext. Through these hackers can generally get passwords of all users of these services.

So, why don't people use local password managers?

Just a txt file encrypted with "master password" should be pretty damning to break into. And the reward for breaking in would be password for 1 person. (compared to 100k businesses).

Obviously, this would be less convinient and wouldn't sync between devices. But would do the job.

And the best part is there are solutions already that do this: https://keepass.info/

So, why do people and companies use Okta, Lastpass, 1pass etc?

Using a cloud sync password manager allows me to follow best practices in having complex, unique passwords for each account.

Data breaches and password leaks at random websites are a much more common attack vector than all of your encrypted passwords being exposed via a password manager.

> Through these hackers can generally get passwords of all users of these services

I'm not sure that there's really evidence or history to back this up. As far as I know even the LastPass data breaches only exposed encrypted passwords, not decrypted ones.

For companies, the benefit is that shared credentials can be distributed to employees without people pasting them in slack, email, or other insecure services.

That access can be revoked by policy if say an employee leaves the company, and new credentials can be generated for all the employees who remain.

Seems like you answered your own question. While it is less secure, my password safe is synced across all devices. I can also easily share passwords with my family members and I can assist them with lockout issues. I don't think there's a nice solution for this with Keepass.

Also, a typical implementation is that the decryption is performed on your device. I don't think you send your key material to the provider but I don't know about all of them.

It is certainly a "keys to the kingdom" issue as you noticed, and I don't put 2FA reset credentials in the same place for example.

I use a password manager because I have multiple devices and a cross platform solution that I can access is a straightforward solution. A local password manager like Keepass is still vulnerable to attack by a compromised system. A well architected password manager is going to not store the decryption keys on their servers and only allow the password vault to be decrypted locally so if they get breached, they would still need to have your master password to gain access to the data. A malicious update could allow them to steal your information but so could a malicious Keepass or OS update.

Using a password manager with a strong password and multifactor authentication is mitigating so many security issues off the bat the new risks it introduces can be small.

Bitwarden has not had any of the problems you listed and can be self hosted.