Are services like “LastPass” less secure, as they have all my passwords protected by a single password?

Question

If the LastPass service has all my passwords and someone gets access to my LastPass password, this person will have access to all my passwords. Isn't that bad for security?

Answer 1

That's why you need to make sure you change that password regularly and make it incredible strong. (I try to surpass 128 bits)

If you don't use passwordmanagers and need to insert a lot of different passwords, you might end up re-using passwords, which is even worse. I personally always recommend to use password managers once you have to remember a lot of passwords.

Personal opinion: However I don't really like LastPass because it's webbased. Call me paranoia/conservative about it, I prefer to use a Keypass database (which is encrypted) offline or synced with Dropbox.

Answer 2

This concentration of password power is consubstantial with the concept of a password manager. A password manager is a tool to "remember" more passwords than what the human mind can cope with. With a password manager, it suffices to remember one password to gain access to all the others. But this means that knowing that one password is sufficient to gain access to all the stored passwords. This is unavoidable: I am just stating the obvious, twice, with two slightly distinct points of view.

To live with that, make your master password strong enough to deter attacks. 15 random letters and digits ought to be enough to thwart CPU-based attackers: if your password gets stolen, it will not be through a brute force attack. The usual rules for password hygiene still apply: generate your password(s) with randomness, not wit; don't type a password on a machine which could be infected with a key logger; beware of shoulder surfers.

Password renewal is a controversial issue. Changing your master password may "kick out" attackers would could steal your master password, but this would not change the site-specific passwords stored in the password manager, so the attacker is not totally evicted. Also, the possibility of an attacker stealing your master password is already serious enough: if the attacker got to that point, you are already in deep trouble. Password renewal is like protesting against the ambient wetness while on board the Titanic.

Answer 3

There are two primary problems with sharing passwords for multiple accounts. Yes, one problem is that if one password gets figured out, then it gives much more access as a single point of failure, but the bigger problem is that the same password is stored in many different places. Thus, the surface area to attack is MUCH larger. If I use my same password on every site I visit, if ANY of those sites is compromised, now all sites are compromised.

If I have a different password everywhere and/or use a single set of credentials through the use of something like OAuth, then the surface area of attack is limited to the single OAuth provider or keystore. Using a keystore means that normally only single passwords would have to be changed for a compromised site and if your keystore is compromised, you have documentation of all the accounts that you have that need changing. If you are using OAuth, then only one place has to be changed to actually change all the login credentials.

Sure, both options are weaker than pure random passwords for every site with no record linking them anywhere, but they are also far more useable and balancing usability and risk mitigation is a big part of security. The "most secure" (ie most risk mitigation) is not always the best security decision.

Answer 4

They are not necessarily less secure in the theoretical sense, but they are less secure in the purely pragmatic sense.

In theory, one good password is as humanly difficult to crack as 100. If you choose a good password and the password is handled cryptographically properly, it should offer a barrier against attack that is far beyond anything humans could achieve in the foreseeable future. One password or many separate passwords, it's just a question of whether the attacker is estimated to need a few millenia or many more millenia to get all your passwords. It's a moot distinction.

It's worth noting that using one encryption key to wrap multiple other encryption keys, which is analogous to passwords wrapping passwords, can be acceptable practice. There's nothing inherently bad about it.

Pragmatically speaking, though, it's obviously impossible for one password to be anything but less secure than many distinct ones. The most secure password manager we currently have is (all else equal) your brain; a software adjunct can only detract from it. It creates a choke point where one problem could compromise a lot of passwords. A mistake in password manager could leave all passwords in the clear, an evil agency need only install one backdoor, etc.

How do you make your password-manager as safe as possible? Broadly speaking:

• Ensure the password-protection-password is high quality.

• Ensure the password management software performs correctly. (For most of us, this simply comes down to trusting the author, the design they used, and independent audits.)

• Ensure your usage of both the password and password manager is proper.

The practical answer to the question is: A password manager is not inherently less secure if you can meet all three of these broad requirements, but the last two are far easier said than done. You are probably going to need to do research on the exact password-manager you want to use.

Answer 5

depends how they are managing their private keys. Even if the encryption is happening client side, the db is still prone to rainbow table attack, as opposed to SmartSignin I work for SmartSignin, so i am going to be little biased here. What SmartSignin offers over other password managers is 100% air-tight security by making sure all the encryption happens client side, and that your public key never leaves the system. In addition to that, the SmartKey patent offers a unique key against each stored password, meaning even one record gets compromised, the other stay vaulted. The public key exchange takes place over an encrypted SSL tunnel ensures that the public key stay safe during the mandatory key exchange. If you are looking for convenience along with air tight security, you ought to look at SmartSignin.