Technology

It's clearly a risk, but if you have dozens of accounts and passwords it's hard to come up with a feasible alternative.

breech

breach, right?

That's why I liked password store, no servers, just my encrypted password files on my own computer, that I sync over to my other devices.

Apparently it's dying soon through, so I need an alternative.

Password managers are supposed to be designed to resist a situation where they're compromised, and are only ever supposed to see a mysterious blob of encrypted data without ever having access to any information that would help decrypt it. The headline's more like M1 Abrams Tanks Vulnerable to Small Arms Fire - it'd be totally expected that most things die when shot with bullets, but the point of a tank is that it doesn't, so it's a big deal if it does.

Things you should know: Your car won't drive after it's broken down.

If you don't have to use your passwords from multiple locations, your hints are intelligible only to you, and you don't leave the paper anywhere too obvious, this isn't a bad solution.

These password managers claim your passwords are secure, even if their servers get compromised, which is what is expected from a security standpoint. But that is apparently not the case.

Are you trying to say the front fell off?

Well the specific point here is that these companies claim that a server hack won't reveal your passwords since they're encrypted and decrypted on your local device so the server only sees the encrypted version. Apparently this isn't completely true.

Yeah, the title there really doesn't reflect the article text. It should be "you probably can't trust your password manager if the remote servers it uses are compromised".

And glosses over what it claims are the two that dominate market (combined market share of 55%) which negates their headline, since it's likely the reader is using one of those two password managers.

Source

These attacks are more around the encryption and all require a fully malicious server. It sounds like Bitwarden is taking these seriously and personally I'd still strongly prefer it to any closed source solution where there could be many more unknown but undiscovered security concerns.

Using a local solution is always most secure, but imo you should first ask yourself if you trust your own security practices and whether you have sufficient hardware redundancy to be actually better. I managed to lose the private key to some Bitcoin about a decade ago due to trying to be clever with encryption and local redundant copies.

Further, with the prevalence of 2FA even if their server was somehow fully compromised as long as you use a different authenticator app than Bitwarden you're not at major risk anyways. With how poorly the average person manages their password security this hurdle alone is likely enough to stop all but attacks targeted specifically at you as an individual.