Re:Android "Password Store" client for pass discontinued
by Etheryte on Monday October 21, 2024 @03:31AM
(#41901596)
The idea is to sell the dump, this is the case for nearly every dataset you see reported on Have I Been Pwned. I'm not really sure how there is even any question about oh why would anyone do this?
Re:Android "Password Store" client for pass discontinued
by grouchypumpkin on Monday October 21, 2024 @03:26AM
(#41901561)
Isn’t it the same threat model as Lastpass breach? Login credentials seem to be worth money, and crypto keys even more.
Re:Android "Password Store" client for pass discontinued
by pantulis on Monday October 21, 2024 @04:15AM
(#41901843)
The comment was referring to Keepassium and Strongbox, which do not store credentials on their servers so it's not exactly the same. While conceivably a compromised Keepass wrapper could decrypt and send the dump of each and every file it opens, I doubt it would pass unnoticed.
What's your threat model here? Some kind of mass hacking attempt? It would be easier to attack the service providers, rather than steal legitimate logins.
A targeted attack on a specific person? It would be easier to, as the famous XKCD suggests, drug and/or hit them with a wrench until they voluntarily hand over whatever information you want.
It's difficult to conceive of a situation where hacking password managers is the path of least resistance.