Password managers less secure than promised
1–10 of 87 posts
Re: Password managers less secure than promised
#2Has there been a similar evaluation of 1Password?
Re: Password managers less secure than promised
#3That's why KeePass is still the king. Offline vault > online vault.
Re: Password managers less secure than promised
#4>cloud-based password managers
The main issue with these managers. I use an encrypted text file and Emacs, nothing on the cloud for me.
Re: Password managers less secure than promised
#5I’m not sure why anybody is surprised. Eventually, everything is proven to be less secure than promised, especially once they are online.
There are certain types of data I prefer to have complete control over. Passwords, no matter how encrypted they claim to be, are top of the list.
Re: Password managers less secure than promised
#6We will see when the attacks are public, a lot of the malicious server attacks we have seen in the past were kinda of overblown. Not discounting OP but it is very easy to get into clickbait territory.
Re: Password managers less secure than promised
#7Save you the click.
The researchers demonstrated 12 attacks on Bitwarden, 7 on LastPass and 6 on Dashlane
Re: Password managers less secure than promised
#8Has there been a similar evaluation of 1Password?
1Password wrote a response to the paper: https://1password.com/blog/eth-zurich-zero-knowledge-malicio...
Re: Password managers less secure than promised
#9caveat not properly addressed in the blog post: all "attacks" are assuming full takeover of web servers, which is certainly a scenario that should be protected against, but isn't really a vulnerability unless chained with something else.
almost all online services would be "vulnerable" in this way - take almost any login system. an RCE on a system hosting a login page would obviously be vulnerable to account takeover
better link here (the technical details): https://zkae.io/
Re: Password managers less secure than promised
#10Has there been a similar evaluation of 1Password?
It seems like 1Password is significantly more secure given the ratio of its market share to the number of articles I’ve seen like this one.