Encryption can be decrypted. A password manager encrypting your passwords is like saying your car has working brakes. It’s totally unsafe to even consider operating without but it doesn’t say much when it is there.
It’s not a matter of “why should I trust them” but “why should I trust them more than the system that already exists”. I get the appeal, but the hole is big.
If I forget a password I reset it. If I forget my manager’s password can it be reset? Is the reset option, if extent, susceptible to attack?
If an account gets compromised it could have moderate repercussions, but probably minimal depending on the account, with maybe a couple exceptions. If managed passwords get compromised that’s potentially everything. There has not, and likely never will be, an impenetrable system, so it is a possibility if not a concern.
Heres a novel I wrote since some may see this as a reason not to use password managers. There are several steps to mitigate all of these concerns. For instance, using a hardware security key for cloud based managers in order to basically stop the biggest threat to you which is phishing. For forgetting your master password, the solution is an emergency sheet, have at least one backup offsite. Arguably the best thing you can do to keep yourself safe is having multiple backups of your vault, just follow the 3,2,1 rule like how you should be doing to begin with other important documents. Its true that theres no absolutes in this world but “cracking” the encryption and bypassing any other security obstacles put in place by an actual reputable manager or yourself should be the very least of your concerns. Companies recognize that people dont practice good security thats why 2fa is pushed on to them but that shouldnt be a replacement for good security practices especially if the 2fa is weak to begin with. Thank god we will be using passkeys soon tho. Also to answer the question the password managers I used dont allow the vaults password to be reset as a security measure but do allow the vault to be deleted so keep your email at the very least protected as much as you can, as you should be doing already, since if that gets overtaken youre shit out of luck with all the accounts tied to that email which brings up the topic of email masking/alias but thats a different burrito altogether.
By “emergency sheet” are you suggesting writing the access-to-everything password down somewhere? If so I’m hard pressed to think of many things less secure. If not I’m genuinely curious what it is.
I can’t imagine a scenario in which I wouldn’t have backups, but I appreciate the mention.
I also am generally not concerned with someone pickpocketing my house keys, but that’s not to say it isn’t a possibility. Awareness is the first step to mitigation.
Email has to be the most protected, I absolutely agree. But I definitely wouldn’t be comfortable with the possibility of needing to reset everything else if I lost my master password. But I don’t know that I’m more comfortable with the ability to reset. It really kinda feels lose-lose to me.
I don’t think we’ll move to passkeys any quicker or easier than we moved to 2FA. I’m glad we’re getting better options but we’re bound by the weakest links and they don’t like change.
Your usage of “secure” is very vague so I’ll clarify thats its the safest and most secure way to still be able to access your master password physically without it being leaked digitally thats the purpose of the physical emergency sheet. I’m suggesting this since I agree the weakest link is always the person first (memory and injury being the main culprits) then actual threats, but it should be stated your masterpassword should be something like a 6+ word, randomly generated passphrase so memorization shouldnt be a problem for the healthy, average joe imo. Keep the emergency sheet in a bolted down safe and/or somewhere offsite like a trusted one’s bolted down safe or a safety deposit box as a means to protect against burglary and fires. You can always limit what you want to put on the emergency sheet or even obscure it if thats a concern however, I would avoid that in case something happens to you and your loved ones need access to your account credentials, like your death for example. All your other point I agree with especially about the passkeys I really hope that takes off. Happy trails
Encryption can be decrypted. A password manager encrypting your passwords is like saying your car has working brakes. It’s totally unsafe to even consider operating without but it doesn’t say much when it is there.
It’s not a matter of “why should I trust them” but “why should I trust them more than the system that already exists”. I get the appeal, but the hole is big.
If I forget a password I reset it. If I forget my manager’s password can it be reset? Is the reset option, if extent, susceptible to attack?
If an account gets compromised it could have moderate repercussions, but probably minimal depending on the account, with maybe a couple exceptions. If managed passwords get compromised that’s potentially everything. There has not, and likely never will be, an impenetrable system, so it is a possibility if not a concern.
Heres a novel I wrote since some may see this as a reason not to use password managers. There are several steps to mitigate all of these concerns. For instance, using a hardware security key for cloud based managers in order to basically stop the biggest threat to you which is phishing. For forgetting your master password, the solution is an emergency sheet, have at least one backup offsite. Arguably the best thing you can do to keep yourself safe is having multiple backups of your vault, just follow the 3,2,1 rule like how you should be doing to begin with other important documents. Its true that theres no absolutes in this world but “cracking” the encryption and bypassing any other security obstacles put in place by an actual reputable manager or yourself should be the very least of your concerns. Companies recognize that people dont practice good security thats why 2fa is pushed on to them but that shouldnt be a replacement for good security practices especially if the 2fa is weak to begin with. Thank god we will be using passkeys soon tho. Also to answer the question the password managers I used dont allow the vaults password to be reset as a security measure but do allow the vault to be deleted so keep your email at the very least protected as much as you can, as you should be doing already, since if that gets overtaken youre shit out of luck with all the accounts tied to that email which brings up the topic of email masking/alias but thats a different burrito altogether.
By “emergency sheet” are you suggesting writing the access-to-everything password down somewhere? If so I’m hard pressed to think of many things less secure. If not I’m genuinely curious what it is.
I can’t imagine a scenario in which I wouldn’t have backups, but I appreciate the mention.
I also am generally not concerned with someone pickpocketing my house keys, but that’s not to say it isn’t a possibility. Awareness is the first step to mitigation.
Email has to be the most protected, I absolutely agree. But I definitely wouldn’t be comfortable with the possibility of needing to reset everything else if I lost my master password. But I don’t know that I’m more comfortable with the ability to reset. It really kinda feels lose-lose to me.
I don’t think we’ll move to passkeys any quicker or easier than we moved to 2FA. I’m glad we’re getting better options but we’re bound by the weakest links and they don’t like change.
Thanks for the answers
Your usage of “secure” is very vague so I’ll clarify thats its the safest and most secure way to still be able to access your master password physically without it being leaked digitally thats the purpose of the physical emergency sheet. I’m suggesting this since I agree the weakest link is always the person first (memory and injury being the main culprits) then actual threats, but it should be stated your masterpassword should be something like a 6+ word, randomly generated passphrase so memorization shouldnt be a problem for the healthy, average joe imo. Keep the emergency sheet in a bolted down safe and/or somewhere offsite like a trusted one’s bolted down safe or a safety deposit box as a means to protect against burglary and fires. You can always limit what you want to put on the emergency sheet or even obscure it if thats a concern however, I would avoid that in case something happens to you and your loved ones need access to your account credentials, like your death for example. All your other point I agree with especially about the passkeys I really hope that takes off. Happy trails