I know someone who won't use Password Safe and instead has a physical notebook with his passwords in obfuscated form. But I wouldn't store every password in there make an effort to memorize your most important ones, like online banking. Now, for most people these risks are acceptable, and I would suggest that the approach of using a password manager like LastPass for most of your passwords is better than using the same password everywhere - which seems to be the main alternative. Partly that the online database could be breached (whether by hacking, court order, malicious insider, etc.) Also because LastPass integrates with browsers, it has a larger attack surface, so there could be technical vulnerabilities (which are unlikely with a standalone app like Password Safe).
Online password managers have the significant benefit that your passwords are available on anyone's computer, but they also carry somewhat more risk. I feel comfortable trusting widely used password managers, like Password Safe. But then, who cares about the ones you never use? It is theoretically possible that the password manager could be trojaned, or have a back door - but this is true with any software. With a password manager, it's slightly worse, because once the malware has captured the master password, it gets all your passwords. Without a password manager, malware can quietly sit and capture all the passwords you use. The most likely cause of a breach is getting malware on your computer. But then, your computer is a single point of failure too.
It is true that the saved passwords are a single point of failure. Offline password managers carry relatively little risk. We should distinguish between offline password managers (like Password Safe) and online password managers (like LastPass).
0 kommentar(er)
