Ask HN: Why do people use password managers?

A similar thing happened to me, but one day my keepass file was corrupted instead of 0 bytes. Quickly switched to 1Password after that.

I use iOS and my basic reasoning is that I’m already doomed if my device encryption is breached (it has wallet info, id, keys, etc). So if someone can access all my passwords it’s not much more damage. It’s kind of like the earth is doomed if hit by a certain size comet, so cares if it’s double the size.

And I think it actually improves security as while if my phone is breached, I’m screwed, I’m now able to use unique, high entropy passwords for the 200+ accounts I have. And I’d never be able to do that without a password manager.

I use iOS instead of lasspass, etc because 1) it’s included in the phone price; 2) apple’s security record is better; 3) the above reason about having a spof. If I use lastpass now I have two spots. And one spof is better than multiples.

Before using a password manager (1Password), I often reused passwords out of convenience in order to not have to remember a lot of them. After switching to a password manager, every password is a strong randomly generated password, I get autofill, syncs across all my devices and most importantly I only need to remember only one super long complicated password. I've got hundreds of stored passwords at this point and I honestly don't think I would be able to manage without it. The 1P family plan is great, shared vaults are super useful to allow me to share certain logins with my wife. Additionally, I like the ability to store arbitrary information securely into my 1P such as credit card info, bank account numbers, drivers license and insurance details, etc. One convenient place to store all my important info with an easy way to share it amongst those who matter most to me.

I'm not going back to a life without a password manager.

> Ask HN: Why do people use [cloud-based] Password Managers?

People use cloud-based password managers because they provide data resiliency. If you store your passwords locally only, you will have a day when your hard drive crashes, you've lost all of your passwords, and you will be in a very bad situation.

> The key difference here being that this is two way hashing so passwords can be decrypted.

There's no such thing as "two-way hashing". If you're worried that the master password password-hashing algorithm is crackable, that's fair, but that's only a problem if you use a weak master password. If you use a, say, 96-bit master password (e.g., 16 random base58 characters), then honestly you're pretty damn safe with even if a site only uses a single pass of SHA-256. But no one's using a single pass of SHA-256, they're using a PBKDF, which means you can use a few less chars in practice for the same security guarantee.

> In reality, there are a lot of attack vectors like MITM

The security of a remote password manager will only be as secure as the transport encryption, this is true. But TLS is pretty solid these days, the risk of breaking it is much smaller than other risks involved here.

> event logging or sometimes straight up storing data in plaintext

You will need to trust that the cloud-based provider doesn't store anything in plaintext. I trust my provider. I don't trust all of them.

KeePass is a password manager. People use other options because their usability is better.

Backup & password generation seem to be the big ones. Secondary is sharing of password and cross-device sync. Third tier is probably browser integration.

Tiers here represent the overall decrease in the security profile as you move to higher tiers.

Finally a small nit -- if it's reversible, it's not hashing. Password managers necessarily store encrypted plaintext (not hashed) passwords because you have to be able to enter your password onto a website.