Hacker News new | ask | show | jobs
by nixgeek 1275 days ago
Or, just have a unique password for every site stored in a password manager, and then they can all be “good” passwords, with no big concerns about how they are stored!
1 comments

Other than your eggs in one basket password apps being hacked and exfiltrating them all which would never happen.

https://www.macrumors.com/2022/12/02/lastpass-hacked-second-...

"Our customers' passwords remain safely encrypted due to LastPass’s Zero Knowledge architecture."

I take your point but I'm not aware of any hack of a major provider which resulted in exfiltration of decrypted customer secrets. Providers often enumerate how they prevent exactly this scenario [1][2], but you'd be correct that if your endpoint were compromised, it's probably game over. To be fair in this scenario just typing in your password (not using a manager) would also be game over.

If you want other options, it is possible to self-host (i.e. Vaultwarden). Personally I've been using 1Password for a long time, and their "Families" offering [3] is exceptional for me and has meaningfully improved my family security since the UX is easy enough my loved ones don't find a unique password per site "a chore".

[1] https://support.1password.com/1password-security/ [2] https://1passwordstatic.com/files/security/1password-white-p... [3] https://1password.com/families/

All it takes is a supply chain attack and it's all gone