Re:Flaws in deterministic password managers
by CmdrSprinkles on Wednesday November 23, 2016 @06:01AM
(#13021659)
I have a similar fear of a lot of stuff like that
So I just use keepass (synced on spideroak, although I am considering alternatives as they still can't be arsed to do 2FA and I am still sceptical of some of their claims). No browser extension, just the app on my PC (and phone).
If it is a site I use regularly, I actually know the password because I generate it in a memorable way. if it isn't, I unlock the database, find the entry, copy it, and paste it.
To be compromised, I need:
1. My device to already be compromised, at which point I am boned anyway
2. Someone to get a hold of the database through stealing my device: I would know about this and would take action for the more sensitive passwords while filing a police report. The hope is that it would take long enough to compromise the database that I would have time
3. Someone to compromise spideroak and get the database. This is my big worry right now as I won't know about this (see my concerns over spideroak), but I put this in the "it is worth the risk" category as it avoids desync between my devices. But, as mentioned, I am looking in to alternatives or at least an extra layer of security/encryption to add in between.
So I just use keepass (synced on spideroak, although I am considering alternatives as they still can't be arsed to do 2FA and I am still sceptical of some of their claims). No browser extension, just the app on my PC (and phone).
If it is a site I use regularly, I actually know the password because I generate it in a memorable way. if it isn't, I unlock the database, find the entry, copy it, and paste it.
To be compromised, I need:
1. My device to already be compromised, at which point I am boned anyway
2. Someone to get a hold of the database through stealing my device: I would know about this and would take action for the more sensitive passwords while filing a police report. The hope is that it would take long enough to compromise the database that I would have time
3. Someone to compromise spideroak and get the database. This is my big worry right now as I won't know about this (see my concerns over spideroak), but I put this in the "it is worth the risk" category as it avoids desync between my devices. But, as mentioned, I am looking in to alternatives or at least an extra layer of security/encryption to add in between.