News for hackers. Stuff that matters.

A comment on Flaws in deterministic password managers. Parent comment

Re:Flaws in deterministic password managers by hackuser on Tuesday November 22, 2016 @06:24PM (#13018586)
> This is only true for cloud based password managers

I agree, in the sense that one successful attack on the supposed centralized database containing all user credentials would have a high ROI.

But it also applies to local password managers. If 20 million people use the same password manager and I have an exploit for it, if I'm in the business of stealing data I'm likely to find a use for my exploit.

[ Parent | on HN ]
Re:Flaws in deterministic password managers by Gee19 on Tuesday November 22, 2016 @10:45PM (#13019802)
'If 20 million people use the same password manager and I have an exploit for it'

Someone is going to exploit my local password manager remotely?

[ Parent | on HN ]
Re:Flaws in deterministic password managers by countingteeth on Tuesday November 22, 2016 @11:38PM (#13020075)
Yes. If you don't think so, then just tell your browser to remember your passwords and don't bother with another tool.
[ Parent | on HN ]
Re:Flaws in deterministic password managers by hackuser on Wednesday November 23, 2016 @03:48PM (#13025735)
> Someone is going to exploit my local password manager remotely?

I don't know - who are you?

Even if you are not an especially valuable target, malware is pretty widespread. It steals credit card numbers and other data; if the attacker had a hack for a popular password manager, why wouldn't they go for it?

[ Parent | on HN ]