Re:Password Managers: Under the Hood of Secrets Management
by UncleMeat on Wednesday February 20, 2019 @12:14PM
(#19209636)
Is that different? "Eventually get all of your passwords" sounds just as bad to me, especially since only some passwords are worth anything and my email password can be used to reset all other passwords.
[ Parent
| on HN ]
Re:Password Managers: Under the Hood of Secrets Management
by oarsinsync on Thursday February 21, 2019 @06:00AM
(#19215992)
You can't reset my online banking login password by email.
You can't reset my online banking operation password by email.
You can't reset my crypto wallet passwords by email.
If you can read all of these from memory without me ever having interacted with the password, you can take all my money and then what do I do?
Re:Password Managers: Under the Hood of Secrets Management
by UncleMeat on Thursday February 21, 2019 @12:24PM
(#19218519)
The malware just waits until you use one of these passwords? The threat model of "I have these crazy essential passwords that I literally never use" is worthless. It costs the malware author nothing to wait.
Re:Password Managers: Under the Hood of Secrets Management
by oarsinsync on Friday February 22, 2019 @05:11AM
(#19224251)
Malware is like any other threat to any system. The longer it persists, the more likely it is to be detected and purged.
Malware that exists purely transiently in my system is a lot more likely to be successful and remain undetected, than malware that persists.