My fear is that OnePassword will be next on the hitlist. I used to love using it when it was local and knew it was under my control, then they decided to move the data into online storage and it's like a spot you can never heal, just there not causing serious problems but bothering you that it might one day turn into a nasty boil! Ha ha!

My family loves it, the family ticket is cheap enough and my kids are useless with passwords so this stores them and auto-generates sensible complex, unique passwords for every site without any effort from them, so swings and roundabouts I guess.

You can't trust a closed source password management solution. You can't trust someone else storing your passwords.

LastPass is both. Their response is full of equvocation:

'Devs can't push to prod' - This is a half truth designed as a full deception. They want you to hear 'they couldn't have modified prod' but that's not what they actually said. Just because a dev can't push to prod, doesn't mean that code can't enter prod. An attacker can slip stuff into Dev, and then *normal, authorized process* can push the hidden poison patch to prod.

Once the code is in prod, one of the unspoken assumptions they hope you don't notice in their whitepaper is the *assumption* that they can't see your password. If a bad actor can modify the code that you can't see or know what changed in, then yes, *it* can see what you're typing and can *certainly* sent your master password to an attacker.

What we have here is *both* the theft of the password database, *and* the potential for the key for it to have been captured. They're hoping you don't connect the dots there.

The reason I lead with 'can't trust a closed source password manager' isn't because we're all devs who would have the foggiest notion about what is contained in a given patch. It's that it is unlikely to be taken private and do what you say onepassword did because someone could just fork it and cut them off at the knees.

In short, I love KeePass, but whatever solution you use, I'd recommend it be open source and local-only. Online password managers are tasty targets that attackers can't resist, and it's only a matter of time before they're compromised, as the story of LastPass shows. Clever whitepapers with cute plans don't survive contact with stupid humans.

Keeping the password vault on local storage only relies on your storage and backup system being at least as reliable as that provided by the cloud service (Lastpass or whatever). That may be true for many of the people who read The Register, but it is definitely not true for the vast majority of computer users.

I use Keepass with a hybrid storage system. The vault exists on my main computer (plus local backup) and also on pCloud. If either breaks I still have the vault.

The key file only exists on my computers, my phone and my tablets. The master password only exists in my head and in an envelope to be opened if I die.

So if someone breaks into my pCloud account and exploits a bug to see me type my password they still have to get hold of my key file.

This setup won't be perfect, but it's a good compromise that works for me.

Plest, flatten your OnePassword account if you're concerned. Burn it to the ground. Then nuke it from space.

Follow Cybersaber's advice, it's sound. (Local install, FOSS.) If you don't have a home server, you could probably stick USB storage in your router and share the database out from there. Others will know better about good password managers that can do this, mine's home grown.

It is only a matter of time. Of that I am certain.

Let's hear from Cybersaber whether his "local-only" recommendation is the same as your "Local install" recommendation.

"you could probably stick USB storage in your router and share the database out from there" -- I wouldn't try this myself, I'm not sure I could do it securely.

I've no particular reason to push the USB/router idea forward, but a least it's LAN-side. Certainly wouldn't be my go-to, I was throwing it out there as a non-super-techie option.

I'm pretty sure Cybersaber and I are of similar minds (poor Cybersaber!) - but I'm happy to be told otherwise.

It sounds like the same thing. The only compute that operates on my KeePass database is my local computer. It's a fair question, but yeah, I was referring to the database, input of the master key, and the compute that processes the two are right here on the computer I'm posting from. Nothing is bullet-proof, but in my personal risk asssessment, I reckon that if my machine were compromised such that an attacker could then get into my database, it wouldn't matter if I was using KeePass, LastPass, or AnyOtherPasswordManager - I'd be compromised. But I would know it, I would know the scope, and I would be incontrol of remedial actions. I can live with that.

As for data resliency? yes, I move the database copies to cloud storage, because that's how encryption at rest work. I'm OK with that security story. LastPass isn't wrong when they say that having access to an encrypted file without the key is pretty low-risk. That's not the weakness in their overall plan.

Personally I use Password Safe. Actually I use a database in Password Safe format with various different apps - there are many, for all platforms. Some apps are FOSS if that is what you want, some are tightly integrated with Android and IoS (for example with "keyboards" for transferring passwords into apps), others are little more than databases.

I handle the sharing separately - outside the apps. I normally keep the master version of the database on my home PC. Devices sync by a variety of mechanisms, some of which only work at home, others are protected by OTP access so I can access them from anywhere if I have my phone.

However, all that is quite complicated. I normally recommend friends and family to use one of the commercial password managers. Even if it can be broken into, it is going to be more safe overall than using a word document!

As was pointed out by some in the comments following the recent [1]NardPass password article , using an online service like this just creates another attack vector. And a tasty one too, for the vagabonds out there.

Why on Earth, if you're going to use a password manager, would you use a service like this? Convenience of sharing across devices? Can be done with a local store, but a little more techie to arrange the sharing - hence the 'convenience'.

Yep, your local machine is (almost certainly) connected to the net, so is somewhat vulnerable. But that probably requires a targetted attack on you rather than a, drive-by, or a huge neon sign hanging over the service provider saying "Go on then!".

Heck, you are better off writing your passwords on parchment and locking it in a drawer of your computer desk. No, we don't advise this! But if the crims can access that, they have access to your physical rig, and we know that's Game Over.

And defo screw browser based password storage. Do the devs really think they're helping here?

I do appreciate the pro/am divide, but sheesh!

[1] https://www.theregister.com/2022/11/25/infosec_roundup/

I like your title. The whole problem is, as you put it, the pro/am divide. In short, if you make access *reasonably* secure, the pros will look for ways to make it *more* secure, the ams won't use it *at all*. ExtraHop says "implement controls that balance usability and security". Balance, ha! It's like the pros and the ams are fighting over a thermostat, each one wanting to turn the dial all the way in a different direction.

Professionals are just as likely to make bad password security decisions as amateurs. I know this deep in my bones from long experience in the field. In the early parts of my quarter-century-long IT security I *was* one of those people. It doesn't take a genius to figure out jumping out of a moving plane at altitude is a potentially life-altering decision, yet skydivers exist, including actual geniuses. Characterizing it in simple terms referring to anyone who doesn't take security seriously an amateur is unhelpful. It is neither correctly characterizing the problem, nor helpful in pursuing solutions,

I get why it's tempting to think that everyone who is paid to do IT security work is a paragon and champion of password security, and anyone who doesn't 'get it' can't possibly be knowledgeable about it (and thus an amateur,) but I can tell you it's just not so. It's a problem that's millennia old. The ol' Mark I human is just not good at prioritizing actions that are annoying or uncomfortable unless the risk is made 'real' to them. We need a decade of the equivalent of the 'this is your brain on drugs' ads. Security never has been, nor ever will be something desirable to do in a vacuum where the risks aren't viscerally 'real' to people.

I do not disagree. As yetanotheraoc says, balance.

Admittedly when saying pro/am I was pointing out an outlook difference, rather than stating "anyone on a payroll in IT knows, or even cares, what they're doing". I'm expect we've all worked alongside to total arse-biscuits. So my apologies for that. I guess it'd be more accurate to say "those-that-give-a-toss/those-that-don't" but it's a bit windy!

I know some hugely knowledgable amateurs.

A cat has four legs. Your dog has four legs. Your dog is a cat. I try not to fall for fallacies.

[Icon: beers are on me!]

Lawl! Mind if I borrow that?

Actually, the 'don't store your password on a post-it' advice is another example of a good adage being repeated after the wisdom that underpins in not necessarily applying anymore.

Why is it a good idea not to write your passwords down on a post it? Well BEFORE when we all worked in an office it was because then they'd all be there in easily 'decrypted' form in an insecure and monitored place where your work mates could come by and unlock your computer to change your screen saver or do something slightly less harmless. Very much the 'all the passwords are here in one place you can grab all at once, so come at me, bro!' paradigm you correctly associated with LastPass.

At home though? Your physical security and ACL on who can be in your home are effective compensating controls in many cases. Do I do that? No, I still use keepass, but I would come down less hard on someone leaving post-its on their wfh 'office' desk than i would if I found it under a keyboard in pre-COVID days.

I could probably be persuaded, after a sit down with the person involved about why they're being given the TRUST and PRIVILEGE of doing so, and the ways it hedge against it going wrong. I mean yeah, there's risks, but for REAL security, where that user might just instead use Password123Aug2022 to defeat complexity checkers... eh, it's a devil's bargain I could maybe live with.

Dunno, maybe. Kills my soul, but maybe. Probably not, but... you know, there's this IT Benevolence fund we have, and donors get perks... ;)

...But humor aside the real take-away of this reply is: Always evaluate whether the basis of your good practices has changed, and if/how that affects the 'goodness' of the practice.

Agreed.

Summery: choose (a) make informed decisions or (b) don't.

Store your password/phrases:

(a) WAN side

(b) LAN side

(c) Off line

Actually, browser password storage isn't a particularly bad idea. Sure it has weaknesses (device can be stolen or hacked, ..) but they are targetted weaknesses. The crim has to be either physically close or deliberately targetting you. Unless you are a prominent person, that is your best protection. Random hacker targetting company databases is unlikely to get your passwords.

Again, horses for courses.

Browser devs are fallible, users install third party, unaudited extensions, browsers leak. Each to their own, I prefer not to introduce an attack surface if possible, and don't recommend it generally.

I take a backup of Lastpass data monthly to be squirreled away on a USB drive in a drawer.

That's a data resiliency plan, not a data security plan. What you have there is a system for protecting and recovering a database full of passwords that could be (and one should assume are) currently being sold in the usual places for such things.

Use that instead - https://pwsafe.org/. It's free, open source, uses strong encryption and you can save your keys locally or in the cloud if you prefer through drive, dropbox etc. Obviously if you save the file to the cloud you want to use a strong passphrase on the file, and not share it with the cloud account.

>credentials are safely encrypted