Re:I'm sure LastPass setting the delete account to display: ...
by taneq on Saturday December 24, 2022 @10:12PM
(#34123806)
Think about it for a moment. Which is more likely to be compromised: A widely advertised central location storing thousands of peoples’ passwords, or a single user’s passwords on their local computer accessed through an app which doesn’t even access the internet?
[ Parent
| on HN ]
Re:I'm sure LastPass setting the delete account to display: ...
by yreg on Sunday December 25, 2022 @10:20AM
(#34127942)
Providing that the vault is fully encrypted/unencrypted locally, in what way is it going to be compromised?
If someone wants to avoid having their vault in a LastPass/1Password/… cloud for some reason, it’s also possible to sync the vault through general use cloud solutions like Mega/Dropbox/…
Re:I'm sure LastPass setting the delete account to display: ...
by feanaro on Saturday December 31, 2022 @05:26AM
(#34195197)
If the cryptography and its implementation is perfect, and you choose a high entropy, well-guarded secret, then encryption is enough on its own. However, being a security researcher, I observe that this is not how the world works in practice, and so encryption is only a single layer in a defence in depth approach. There's little reason to destroy another important layer by centralising all the passwords in a single lucrative bucket.
An obvious way to attack typical cloud password managers is via their web apps, which is an endpoint attack and hence bypasses the encryption. This type of attack is much harder for native, offline password managers.