# Why do people assume that password protection programs are safe? **URL:** \ **Category:** Factual Questions\ **Created:** [March 3, 2014, 8:04pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775 "2014-03-03T20:04:54Z")\ **Posts on this page:** 16\ **Page:** 1
**Author:** ![Nars\_Glinley](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/nars_glinley/32/8177_2.png) [@Nars\_Glinley](https://boards.straightdope.com/u/Nars_Glinley)\ **Post date:** [March 3, 2014, 8:04pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/1 "2014-03-03T20:04:54Z")
From time to time, a thread will popup about the best strategy for online passwords. Invariably, the discussion will devolve into the xkcd comic approach versus random characters. Also, password protection programs such as KeePass will be mentioned for those that don’t wish to use the same password on each site. Why is it (or is it?) assumed that password programs are safe? Wouldn’t it be trivially easy for the creator of such a program to insert malicious code that would upload the user’s password file whenever they wanted it? When someone wants to put a program on a site like [Download.com](http://Download.com), is the source code reviewed and re-compiled or are only the executables uploaded? ---
**Author:** ![Claverhouse](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Claverhouse](https://boards.straightdope.com/u/Claverhouse)\ **Post date:** [March 3, 2014, 8:27pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/2 "2014-03-03T20:27:08Z")
Well, many of such things are Open Source which means, not at all theoretically, that anyone who reads the code can _see_ it has been tampered with ( those who don’t, such as I trust those who do ); on a version-control site such as Git they could also work out _when_ it was tampered with. With proprietary stuff one just trusts the maker. And should one download from a site which has inserted bad stuff, the lesson is to download from good sites. I don’t use password managers. ---
**Author:** ![HipGnosis](https://avatars.discourse-cdn.com/v4/letter/h/76d3ee/32.png) [@HipGnosis](https://boards.straightdope.com/u/HipGnosis)\ **Post date:** [March 3, 2014, 8:54pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/3 "2014-03-03T20:54:59Z")
Not everyone assumes everything downloadable is safe. I think your subject is a bit short sighted. A better question would be: Why do some people trust everything and click on anything? Links for anything, like a free wallpaper, can load malware that can do all sorts of mischief. ---
**Author:** ![Blakeyrat](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@Blakeyrat](https://boards.straightdope.com/u/Blakeyrat)\ **Post date:** [March 3, 2014, 9:06pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/4 "2014-03-03T21:06:56Z")
1. Open source password managers can be downloaded, the code inspected, and built by your own compiler on your own computer if you’re paranoid. Or you can rely on the fact that surely enough people are doing this to keep the projects on their toes. 2. Your question is kind of beside the point: the real question should be, “is this password manager more secure than not using it?” To answer that, you need to ask yourself, “am I the type of person who, without using a password manager application, will pick strong, unique passwords for every website I visit?” It doesn’t have to be perfect to be worthwhile, just better than the alternatives. ---
**Author:** ![Ethilrist](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ethilrist/32/4604_2.png) [@Ethilrist](https://boards.straightdope.com/u/Ethilrist)\ **Post date:** [March 3, 2014, 9:09pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/5 "2014-03-03T21:09:26Z")
If I can come up with a secure password for the password manager, I can come up with secure passwords, so I don’t need the password manager. The only reason I’ve ever seen for a password safe is while working on a group that had about 20 people in it and everybody had to have access to them, without resorting to a sea of post-it notes on all the monitors. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [March 3, 2014, 9:11pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/6 "2014-03-03T21:11:25Z")
> [@Nars\_Glinley](#): > > Why is it (or is it?) assumed that password programs are safe? Wouldn’t it be trivially easy for the creator of such a program to insert malicious code That’s also true of the manufacturer of your computer, operating system, drivers, browser, keyboard, phone, and probably others. To a lesser degree you’re also trusting the operators of the web sites you’re logging into, the manufacturers of their servers, their data centre, and so on. A password manager is one of several tools that let you reduce the number of parties you have to trust in order for things to remain secure. Obviously if you don’t think they’re trustworthy then you shouldn’t use it. But make sure you pay the same attention to everything else listed above. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [March 3, 2014, 9:12pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/7 "2014-03-03T21:12:46Z")
> [@Ethilrist](#): > > If I can come up with a secure password for the password manager, I can come up with secure passwords, so I don’t need the password manager. Can you remember a unique and unrelated secure password for each and every site you use? ---
**Author:** ![Claverhouse](https://avatars.discourse-cdn.com/v4/letter/c/13edae/32.png) [@Claverhouse](https://boards.straightdope.com/u/Claverhouse)\ **Post date:** [March 3, 2014, 9:43pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/8 "2014-03-03T21:43:16Z")
One can use a password generator to create strong passwords. I’m looking to 24 characters by now ( although some time ago amusingly Microsoft at least _accepted_ very long passwords but truncated them to only the first x number of characters for some sites. So people had the false confidence of using 20 characters, but only the first [say] 8 mattered… ). Then one can rely on Firefox storing them, which I suppose is a minimal password manager. One can export them as a txt file should the computer croak. ---
**Author:** ![tellyworth](https://avatars.discourse-cdn.com/v4/letter/t/977dab/32.png) [@tellyworth](https://boards.straightdope.com/u/tellyworth)\ **Post date:** [March 3, 2014, 9:45pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/9 "2014-03-03T21:45:44Z")
> [@Claverhouse](#): > > Then one can rely on Firefox storing them, which I suppose is a minimal password manager. Make sure you set a good [master password](https://support.mozilla.org/en-US/kb/use-master-password-protect-stored-logins) if you do this please. Otherwise they’re stored in plain text. ---
**Author:** ![Ethilrist](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/ethilrist/32/4604_2.png) [@Ethilrist](https://boards.straightdope.com/u/Ethilrist)\ **Post date:** [March 3, 2014, 9:57pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/10 "2014-03-03T21:57:03Z")
> [@tellyworth](#): > > Can you remember a unique and unrelated secure password for each and every site you use? So far, yep. ---
**Author:** ![Ferret\_Herder](https://avatars.discourse-cdn.com/v4/letter/f/e47774/32.png) [@Ferret\_Herder](https://boards.straightdope.com/u/Ferret_Herder)\ **Post date:** [March 3, 2014, 10:02pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/11 "2014-03-03T22:02:00Z")
> [@Ethilrist](#): > > So far, yep. Geez, you’re better at this than I am. I have around 100 websites with different login/password requirements (maybe a third of those for work purposes) and I gave up and got LastPass, which saves my sanity. Especially when certain of them have frequent change and obscure password rules to follow. ---
**Author:** ![Chronos](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/chronos/32/134_2.png) [@Chronos](https://boards.straightdope.com/u/Chronos)\ **Post date:** [March 3, 2014, 10:10pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/12 "2014-03-03T22:10:55Z")
While you’re at it, make sure you trust Ken Thompson, too, because even if you trust the companies you’re doing business with, and the programmers who work for them, and the programmers who wrote the compilers those programmers are using, those compilers were still compiled with some compiler, and so on. ---
**Author:** ![Blakeyrat](https://avatars.discourse-cdn.com/v4/letter/b/ecd19e/32.png) [@Blakeyrat](https://boards.straightdope.com/u/Blakeyrat)\ **Post date:** [March 3, 2014, 10:48pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/13 "2014-03-03T22:48:00Z")
> [@Ethilrist](#): > > So far, yep. Well then you’re Superman of passwords. The rest of us need the password manager, or similar tool. 🙂 ---
**Author:** ![beowulff](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/beowulff/32/542_2.png) [@beowulff](https://boards.straightdope.com/u/beowulff)\ **Post date:** [March 3, 2014, 11:02pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/14 "2014-03-03T23:02:03Z")
> [@Chronos](#): > > While you’re at it, make sure you trust Ken Thompson, too, because even if you trust the companies you’re doing business with, and the programmers who work for them, and the programmers who wrote the compilers those programmers are using, those compilers were still compiled with some compiler, and so on. [Linky](http://c2.com/cgi/wiki?TheKenThompsonHack) (worth reading!). ---
**Author:** ![Deeg](https://sea3.discourse-cdn.com/straightdope/user_avatar/boards.straightdope.com/deeg/32/2955_2.png) [@Deeg](https://boards.straightdope.com/u/Deeg)\ **Post date:** [March 4, 2014, 4:41pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/15 "2014-03-04T16:41:16Z")
> [@tellyworth](#): > > To a lesser degree you’re also trusting the operators of the web sites you’re logging into, the manufacturers of their servers, their data centre, and so on. I’d say it’s even more important that you trust the operators of the web sites. It doesn’t matter how good your password is if the web site gets hacked and CC#'s are leaked to the internet. ---
**Author:** ![Quercus](https://avatars.discourse-cdn.com/v4/letter/q/7ab992/32.png) [@Quercus](https://boards.straightdope.com/u/Quercus)\ **Post date:** [March 4, 2014, 4:55pm UTC](https://boards.straightdope.com/t/why-do-people-assume-that-password-protection-programs-are-safe/682775/16 "2014-03-04T16:55:30Z")
To the OP, check out: [Choosing Secure Passwords - Schneier on Security](https://www.schneier.com/blog/archives/2014/03/choosing_secure_1.html) A key quote "I’m recommending Password Safe for Windows because I wrote the first version, know the person currently in charge of the code, and trust its security. There are ports of Password Safe to other OSs, but I had nothing to do with those. " So if you trust Bruce, here’s a recommendation.