11–20 of 45 posts
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what you have after you entered something you know , since the whole point of a password manager is to have one strong password that you need to remember, instead of tens or hundreds probably-not-so-strong individual passwords), would also be a game-over scenario i…
you're all idiots.
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.
In fact, I'd go further and say that you can do this with your login name. So for example:
myemail+by@gmail.com for eBaY
This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your info and even stealing your account:
https://medium.com/@espringe/amazon-s-customer-service-backd...
If you are hosting with AWS you should really consider doing that http://www.techinsider.io/hacker-social-engineer-2016-2
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
What are "reasonable security practices" for maintaining strong, unique passwords over several hundred sites?
Agree with the comment that the blogger doesn't understand what phishing is. This could be done against a huge number of people through various approaches with ad network code or targeted attacks controlling path to internet. That's all setting aside how trivial it would be for nation states.
They have a history of trying to explain away their security problems as not really their fault. That alone should give any LastPass user pause.
And there's nothing in their response that tries shifting the blame: https://blog.lastpass.com/2016/07/lastpass-security-updates....
Earlier quoted context omitted.
I thought the point of a password manager is to allow you to have separate passwords for numerous services which are protected by centralizing those passwords somewhere (preferably somewhere you control, such as your own phone) and protecting the result with one password. Your model of them seems to involve them replacing a password locally, which I don't think anyone would recommend.
I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password. In fact, I'd go further and say that you can do this with your login name. So for example: myemail+by@gmail.com for eBaY This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your i…
Earlier quoted context omitted.
I would say password reuse can be pretty good! Simply have your own rule such as "letters 2 and 5 of the domain name" and combine those with your reusable password. In fact, I'd go further and say that you can do this with your login name. So for example: myemail+by@gmail.com for eBaY This also helps mitigate those attacks where the attacker actually contacts support and socially engineers them into giving all your i…
This "clever" security measure would be annihilated in case of a well planned attack targeted against a single individual.
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
What are "reasonable security practices" for maintaining strong, unique passwords over several hundred sites?
Password managers exchange a strong secret, something you know, for a weak one, something you have. Once an attacker gets to your database you're completely owned. When they compromise a normal password the damage is more contained if you maintain reasonable security practices.
Simply using the browsers built-in password saving capability with random passwords is still better than nothing (Chrome can even generate random passwords for you). Changing the password for one compromised site is better than having to change it for every site because of password reuse.