# Is a password manager safe from hacking? Or else I'll be as screwed as SD is now... **URL:** \ **Category:** Factual Questions\ **Created:** [January 8, 2014, 12:07am UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199 "2014-01-08T00:07:57Z")\ **Posts on this page:** 4\ **Page:** 3
**Author:** ![leahcim](https://avatars.discourse-cdn.com/v4/letter/l/b4bc9f/32.png) [@leahcim](https://boards.straightdope.com/u/leahcim)\ **Post date:** [January 9, 2014, 3:00pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/41 "2014-01-09T15:00:53Z")
> [@Alan\_Smithee](#): > > …That still relies on a 10+ character random password being decoded successfully on two separate occasions… I’d suggest that that is not as rare as you might think. There are plenty of “unimportant” sites that don’t do proper password security – even storing passwords in plain text, or unsalted MD5, or other stupid things that sites do. The problem is not to protect yourself against two average security sites being hacked. It is to protect yourself against the two worst-security sites you use being hacked. > [@Mangetout](#): > > It probably could be hacked as follows: > > [ul] > [li]Steal the keepass.info domain (this can happen)[/li][li]…[/li][/ul] It could happen, but it would certainly be noticed (and big news) if it did. No hacker could rely on the passwords thus received for being valid for long. This is unlike more traditional site compromises that are not discovered immediately. ---
**Author:** ![Mangetout](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/mangetout/32/19_2.png) [@Mangetout](https://boards.straightdope.com/u/Mangetout)\ **Post date:** [January 9, 2014, 6:29pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/42 "2014-01-09T18:29:43Z")
True - they would only snag the credentials of those people who updated in the window between hijacking the site and when/if someone eventually shut them down - I guess it would depend on how long they managed to hold onto the stolen domain. Another risk (for other password keeper solutions such as those appearing as smartphone apps) is the publisher going turning rogue and sending out an update with a backdoor in it - in this case, they could bide their time until sufficient penetration had been achieved, then steal a vast amount of personal data all at once. ---
**Author:** ![Kalimero](https://avatars.discourse-cdn.com/v4/letter/k/aca169/32.png) [@Kalimero](https://boards.straightdope.com/u/Kalimero)\ **Post date:** [January 9, 2014, 7:00pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/43 "2014-01-09T19:00:46Z")
What I like about KeePass is the possibility of using a key-file alongside your password. I want my passwords to be accessible from my desktop computer, my smartphone and tablet. I have my KeePass File on Dropbox for easy synchronisation and my key-file stored locally on each device. Combined with a strong password I believe this to be a fairly secure solution. ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [January 9, 2014, 7:09pm UTC](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199/44 "2014-01-09T19:09:37Z")
> [@Kalimero](#): > > What I like about KeePass is the possibility of using a key-file alongside your password. I want my passwords to be accessible from my desktop computer, my smartphone and tablet. I have my KeePass File on Dropbox for easy synchronisation and my key-file stored locally on each device. > > Combined with a strong password I believe this to be a fairly secure solution. That’s good advice. I might take that up. [Previous page](https://boards.straightdope.com/t/is-a-password-manager-safe-from-hacking-or-else-ill-be-as-screwed-as-sd-is-now/678199.md?page=2)