# Is a password manager safe from hacking? Or else I'll be as screwed as SD is now... **URL:** \ **Category:** Factual Questions\ **Created:** [January 8, 2014, 12:07am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199 "2014-01-08T00:07:57Z")\ **Posts on this page:** 20\ **Page:** 2
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [January 8, 2014, 8:48pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/21 "2014-01-08T20:48:30Z")
> [@Mangetout](#): > > The key security benefit of a password manager is the same security benefit of a wallet - having placed all your eggs in one basket, you tend to carry it more carefully. Hearing so much about people not wanting to keep all their eggs in one basket lately, I’m wondering how these people actually store their eggs. I don’t use a basket, but all of the eggs in my apartment are stored together, and seem pretty safe that way. 🙂 I see opposition to password managers based on the idea that they might be hacked as similar to opposition to seat belts because your car might plunge into a lake and the seat belt might jam preventing you from escaping. Yes, by taking the action (using a PM/buckling your seat belt) you are introducing a scenario where you will be worse off (PM stolen and decrypted/car in lake with seat belt jammed), but you are also protecting yourself in other situations (passwords compromised on remote site/normal car accident) that are a _lot_ more likely to actually occur. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 8, 2014, 9:06pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/22 "2014-01-08T21:06:20Z")
> [@leahcim](#): > > Hearing so much about people not wanting to keep all their eggs in one basket lately, I’m wondering how these people actually store their eggs. I don’t use a basket, but all of the eggs in my apartment are stored together, and seem pretty safe that way. 🙂 I heard someone (can’t remember who, but someone reputable) lately suggest to keep your passwords in your wallet - because you’re good at securing your wallet. I use a password manager app on my smartphone - I think probably the biggest risk is in choosing which one to trust - you might pick an app written by some Fred in a shed, that just leaks all your private data back to the mothership. ---
**Author:** ![jacobsta811](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/jacobsta811/32/2893_2.png) [@jacobsta811](https://boards.straightdope.com/u/jacobsta811)\ **Post date:** [January 8, 2014, 9:29pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/23 "2014-01-08T21:29:05Z")
> [@drewtwo99](#): > > Password managing services like LastPass are gauranteed to be safer in at least one way: their hashing and/or salting algorithms for how they store the passwords are going to be the best available. If you choose a secure password in the first place, even if hacked, no hacker is going to be able to brute force their way to your password since all they will have is an extremely well-hashed and salted version of it. While the password you use to Login to LastPass _itself_ is probably hashed and salted, they can’t possibly hash and salt your passwords to other sites - they have to get the actual password back to you and thus the password is, at best encrypted, not hashed. So a lastpass hack could theoretically expose all your passwords. I personally prefer a combination of Dropbox and Password safe, which is not as easy to use but relies less on 3rd parties security. The biggest thing with using any password manager is that the password should be complicated and something you have _NEVER_ _EVER_ _EVER_ used before, and never ever use anyplace but the password manager. ---
**Author:** ![Tastes\_of\_Chocolate](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/tastes_of_chocolate/32/3232_2.png) [@Tastes\_of\_Chocolate](https://boards.straightdope.com/u/Tastes_of_Chocolate)\ **Post date:** [January 9, 2014, 12:24am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/24 "2014-01-09T00:24:40Z")
Can anyone recommend a password manager that does not offer a cloud option? Ideally, I want something I can load on my phone, and sync with my desktop, as well as download to a spreadsheet. That’s it. I have no plans to keep a cloud version. If I was a hacker going for maximum accounts+passwords, I’d totally be trying to find a way to hack a cloud based version of one of these. My chances of having a cloud account hacked seem much higher than someone breaking into my house and spending time search my hard drive, or even the top of my desk. ---
**Author:** ![Ximenean](https://avatars.discourse-cdn.com/v4/letter/x/aca169/32.png) [@Ximenean](https://boards.straightdope.com/u/Ximenean)\ **Post date:** [January 9, 2014, 12:36am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/25 "2014-01-09T00:36:06Z")
> [@jacobsta811](#): > > While the password you use to Login to LastPass _itself_ is probably hashed and salted, they can’t possibly hash and salt your passwords to other sites Also, how do we know that LastPass’s security policies are “guaranteed to be safer”? I mean, I’m fairly confident that LastPass know what they’re doing, considering the up-front way they dealt with that possible (I stress “possible”) security breach they had a couple of years ago, and I would use their services myself, but there are no guarantees. What’s to say they don’t get bought out by a company less concerned with security? ---
**Author:** ![Alan\_Smithee](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@Alan\_Smithee](https://boards.straightdope.com/u/Alan_Smithee)\ **Post date:** [January 9, 2014, 2:00am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/26 "2014-01-09T02:00:50Z")
> [@jovan](#): > > **Mangetout** already answered this but I’l reiterate: > > **NO! NO! NO!** > > Password crackers _most definitely_ take such recipes into account. I linked to this article before, it’s a little long but highly informative insight into how actual crackers operate. > > [Anatomy of a hack: How crackers ransack passwords like “qeadzcwrsfxv1331” - Ars Technica](http://arstechnica.com/security/2013/05/how-crackers-make-minced-meat-out-of-your-passwords/) > > One of the take-home point is that it takes only a few minutes to brute-force all 6-character passwords. Beyond that, there are various tricks, but trying various recipes plays a big part, and it will take only a few more minutes to brute-force yours. In practice, it’s going to be even less because no part of your password is random. > > Really, most security experts seem to agree that some form of password management system is the best form of defence. Unless you’re able to memorise dozens of either very long or very random passwords. Having read that article, I’m reasonably convinced that my passwords are secure enough that I wouldn’t benefit significantly from using a password manager. For starters, my actual passwords are longer and less predictable than the examples I used, though they aren’t actually random. (I suppose I could create a truly random “base” password to make them more secure.) More importantly, though, even using a password manager doesn’t make your passwords 100% secure–someone using a password manager for the SDMB would still need to change their password now that the SDMB has been hacked. From what I can tell, the benefits of a manager are twofold: first, they create truly random passwords that are harder to crack (but still not impossible when the site you’re using it on has poor encryption), and second, they allow you to use a different random password on every site. I am certain I could achieve a comparable level of security by using a single strong password that I memorize and then customize for each site using a simple but non-obvious technique (like a rot-cyphered tag inserted in the middle) and/or changing all passwords when any is hacked. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 9, 2014, 2:18am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/27 "2014-01-09T02:18:03Z")
> [@Alan\_Smithee](#): > > Even using a password manager doesn’t make your passwords 100% secure–someone using a password manager for the SDMB would still need to change their password now that the SDMB has been hacked. This is a good point. The advantage of the password manager (or your own means of coming up with unique and hard-to-crack passwords, assuming they are truly hard to crack) is that it is unlikely someone can crack your password faster than you can change it, and in the event that the break-in is undetected, there’s a better chance that they won’t crack at it all. But note I say “better”, not “good” chance - you of course want to change your password if you know the site was hacked, no matter how good you think your password was. It’s a bit like the joke about the bear and the two hikers - you don’t have to run faster than the bear, you just have to run faster than the other hiker. Your passwords will never be completely impervious to being cracked, but the odds are on your side if yours is one of the hardest in the database to crack. The diminishing returns means the hackers crack the easy ones and forget about the last 5%. ---
**Author:** ![jovan](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jovan](https://boards.straightdope.com/u/jovan)\ **Post date:** [January 9, 2014, 2:43am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/28 "2014-01-09T02:43:33Z")
> [@Alan\_Smithee](#): > > Having read that article, I’m reasonably convinced that my passwords are secure enough that I wouldn’t benefit significantly from using a password manager. For starters, my actual passwords are longer and less predictable than the examples I used, though they aren’t actually random. (I suppose I could create a truly random “base” password to make them more secure.) More importantly, though, even using a password manager doesn’t make your passwords 100% secure–someone using a password manager for the SDMB would still need to change their password now that the SDMB has been hacked. From what I can tell, the benefits of a manager are twofold: first, they create truly random passwords that are harder to crack (but still not impossible when the site you’re using it on has poor encryption), and second, they allow you to use a different random password on every site. I am certain I could achieve a comparable level of security by using a single strong password that I memorize and then customize for each site using a simple but non-obvious technique (like a rot-cyphered tag inserted in the middle) and/or changing all passwords when any is hacked. I still think you’re playing with fire. It’s trivially easy for crackers to add new rules to their software, and it’s something they do all the time. Sure, they might miss your rule, but are you sure? I think it’s much, much safer to just assume that any scheme that is easy enough to remember is also easy enough to crack. I just checked my password manager and I have over 70 different logins. Many of those are for sites I hardly if ever visit. Without a manager, if I want to be really safe, I need to keep a list of those sites, and once I’ve done that, well, I’m sort of building my own password manager. I tried various schemes in the past, but really password managers offer the best balance of security and usability. Sure, it’s a single point of failure, but it also means that you only need to focus your efforts on protecting that single point. ---
**Author:** ![Alan\_Smithee](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@Alan\_Smithee](https://boards.straightdope.com/u/Alan_Smithee)\ **Post date:** [January 9, 2014, 2:55am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/29 "2014-01-09T02:55:51Z")
> [@jovan](#): > > I still think you’re playing with fire. It’s trivially easy for crackers to add new rules to their software, and it’s something they do all the time. Sure, they might miss your rule, but are you sure? I think it’s much, much safer to just assume that any scheme that is easy enough to remember is also easy enough to crack. > > I just checked my password manager and I have over 70 different logins. Many of those are for sites I hardly if ever visit. Without a manager, if I want to be really safe, I need to keep a list of those sites, and once I’ve done that, well, I’m sort of building my own password manager. > > I tried various schemes in the past, but really password managers offer the best balance of security and usability. Sure, it’s a single point of failure, but it also means that you only need to focus your efforts on protecting that single point. If I bury a lightly encrypted tag (TENC for SDMB) in the middle of a truly random 10 character password, you really think there is any “rule” that a hacker would realistically follow to access my bank account before I get around to changing the password anyway? I mean, it’s _possible_, but I think it’s less likely than the password manager getting hacked, or me reciting my paswords in my sleep while dozing on public transportation. ---
**Author:** ![jovan](https://avatars.discourse-cdn.com/v4/letter/j/0ea827/32.png) [@jovan](https://boards.straightdope.com/u/jovan)\ **Post date:** [January 9, 2014, 3:16am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/30 "2014-01-09T03:16:15Z")
> [@Alan\_Smithee](#): > > If I bury a lightly encrypted tag (TENC for SDMB) in the middle of a truly random 10 character password, you really think there is any “rule” that a hacker would realistically follow to access my bank account before I get around to changing the password anyway? I mean, it’s _possible_, but I think it’s less likely than the password manager getting hacked, or me reciting my paswords in my sleep while dozing on public transportation. Sure. One of your passwords gets stored in plaintext somewhere (see Rock You!) and now your random sequence is out in the open. Someone does statistical analysis of the trove, finds a ROTed token in your password (easy because you get it from the website name) and retrieves your “random” base. It’s better than what most people use but still weaker than a properly used password manager. If you don’t sync via the cloud, then in order to access you password manager, a hacker would need both access to one of your devices and crack the encryption. With a good strong password, not even the NSA could realistically manage it in reasonable time. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 9, 2014, 3:18am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/31 "2014-01-09T03:18:10Z")
A lightly encrypted tag in the middle of a random 10 character (preferably more) is probably fine. A tag at the end of a common word like “swordfish” in your earlier example is less so, even with a couple digits added on. I realize that was probably just a simple example and your real one is likely better. ---
**Author:** ![TroutMan](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/troutman/32/6721_2.png) [@TroutMan](https://boards.straightdope.com/u/TroutMan)\ **Post date:** [January 9, 2014, 3:24am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/32 "2014-01-09T03:24:43Z")
> [@jovan](#): > > Sure. One of your passwords gets stored in plaintext somewhere (see Rock You!) and now your random sequence is out in the open. Someone does statistical analysis of the trove, finds a ROTed token in your password (easy because you get it from the website name) and retrieves your “random” base. You’re right, there’s still a risk. But it’s pretty low. Unless the hacker is specifically targeting you, they aren’t going to look at password patterns individually and try to infer what you might use on other sites. There are plenty of people who use the same passwords everywhere, and hackers will have more than enough targets with those. As for sites that store passwords in plain text, it’s a good idea to have different schemes for the important commerce sites versus something like a bulletin board. The latter are more likely to have poor security or unencrypted passwords, so in the very unlikely event that a hacker does try to derive your rule, they still can’t do much damage. ---
**Author:** ![j\_sum1](https://avatars.discourse-cdn.com/v4/letter/j/8baadc/32.png) [@j\_sum1](https://boards.straightdope.com/u/j_sum1)\ **Post date:** [January 9, 2014, 3:42am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/33 "2014-01-09T03:42:51Z")
I have just done a bit of an audit on my passwords (as well as a bit of reading on the current ability of hackers and their techniques). I am reasonably happy with my practices although I realise that the “correct horse battery staple” approach that I kind of like has certain limitations. My biggest problem at this stage is one that a password manager won’t be able to help me with – when there are limitations on the kinds of passwords that are allowed. One site that I would love to have more secure limits passwords to 8 alphanumeric characters. That means that there are just over 62[sup]8[/sup] allowable combinations. If what I read is correct, with some encryption algorithms that puts it within the realms of an exhaustive brute-force attack with a 100% harvest rate. So, what are the options with sites like this? I have written a letter, but I am pretty much at the mercy of their security policies. ---
**Author:** ![Steve\_MB](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/steve_mb/32/5339_2.png) [@Steve\_MB](https://boards.straightdope.com/u/Steve_MB)\ **Post date:** [January 9, 2014, 3:52am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/34 "2014-01-09T03:52:45Z")
> [@Duckster](#): > > I do not use online password managers. > > My password manager is [Keepass](http://keepass.info/). It exists in a thumb drive at home (duplicated with another thumb drive elsewhere). It cannot be hacked. More precisely, it cannot be hacked unless someone gains access to the files, which would require either access to the thumb drives or backdoor the computer where you use them. That said, even if someone _does_ gain access to the files, it’s almost certainly impossible to read the password database unless you used a weak password. ---
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [January 9, 2014, 3:58am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/35 "2014-01-09T03:58:40Z")
> [@TroutMan](#): > > You’re right, there’s still a risk. But it’s pretty low. Unless the hacker is specifically targeting you, they aren’t going to look at password patterns individually and try to infer what you might use on other sites. There are plenty of people who use the same passwords everywhere, and hackers will have more than enough targets with those. I can think of a fairly straightforward way that these could be done en masse: What if two sites **Alan** uses are compromised at the same time (or years apart, but the first one is never discovered so no one knows that they need to change passwords)? Then it is obvious what the “base” password is, and what the varying characters are, and that there are only a few of them no matter where they occur. That would make it easy to brute force on the next compromise. The “root with a few varying chars” pattern is common enough that I’m certain that given two dumps, it is worthwhile to automatically scan for it. Just look for corresponding accounts with passwords that are the same except for a few chars. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [January 9, 2014, 4:01am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/36 "2014-01-09T04:01:30Z")
> [@Tastes\_of\_Chocolate](#): > > Can anyone recommend a password manager that does not offer a cloud option? > Ideally, I want something I can load on my phone, and sync with my desktop, as well as download to a spreadsheet. That’s it. Check out keepass.info. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [January 9, 2014, 4:06am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/37 "2014-01-09T04:06:04Z")
> [@Alan\_Smithee](#): > > If I bury a lightly encrypted tag (TENC for SDMB) in the middle of a truly random 10 character password, you really think there is any “rule” that a hacker would realistically follow to access my bank account before I get around to changing the password anyway? I mean, it’s _possible_, but I think it’s less likely than the password manager getting hacked, or me reciting my paswords in my sleep while dozing on public transportation. I agree that your scheme will probably keep you safe but it’s not even close to being as secure as using a good PW vault. It’s a calculated risk on your part but if you think it’s as good (or better) than a vault then you are not basing your calculations on correct data. ---
**Author:** ![Alan\_Smithee](https://avatars.discourse-cdn.com/v4/letter/a/2acd7d/32.png) [@Alan\_Smithee](https://boards.straightdope.com/u/Alan_Smithee)\ **Post date:** [January 9, 2014, 4:35am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/38 "2014-01-09T04:35:33Z")
> [@leahcim](#): > > I can think of a fairly straightforward way that these could be done en masse: What if two sites **Alan** uses are compromised at the same time (or years apart, but the first one is never discovered so no one knows that they need to change passwords)? Then it is obvious what the “base” password is, and what the varying characters are, and that there are only a few of them no matter where they occur. That would make it easy to brute force on the next compromise. > > The “root with a few varying chars” pattern is common enough that I’m certain that given two dumps, it is worthwhile to automatically scan for it. Just look for corresponding accounts with passwords that are the same except for a few chars. Ok, I’ll grant you that. That still relies on a 10+ character random password being decoded successfully on two separate occasions, but that’s liklier than a password manager getting compromised, especially one that stores passwords locally. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 9, 2014, 8:36am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/39 "2014-01-09T08:36:20Z")
> [@Duckster](#): > > I do not use online password managers. > > My password manager is [Keepass](http://keepass.info/). It exists in a thumb drive at home (duplicated with another thumb drive elsewhere). It cannot be hacked. It probably could be hacked as follows: [ul] [li]Steal the keepass.info domain (this can happen)[/li][li]Starting with the existing open-source code, publish a ‘new version’ of KeePass containing new code that covertly sends the decrypted version of your stored data back to the hacker[/li][li]Versions 1.05 and later of KeePass automatically check for updates - so these are at risk[/li][/ul] ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 9, 2014, 8:45am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/40 "2014-01-09T08:45:53Z")
Here’s a real-world example of that happening (not with a password storage solution, but the principle is the same): > **[Shareaza | Domain takeover](https://en.wikipedia.org/wiki/Shareaza#Domain_takeover)** > > On 19 December 2007 the project's domain name, shareaza.com, was redirected to a site claiming to be "The Official Home of Shareaza", promoting the download of a client known as Shareaza V4 (which had become V6 in October 2009, V7 in August 2010, and V8 in November 2011\[update\]) unrelated to releases by the Shareaza development team, an iMesh clone with only small graphical modifications, and using Shareaza v1 logo. The domain owner Jon Nilson was forced to sell it as a part of a settlement w Ver... [Previous page](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199.md?page=1) [Next page](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199.md?page=3)