Security of cloud-based password manager (Dashlane, LastPass) vs. federated login (OpenID, Google, Yahoo, Microsoft, Facebook)

Question

Many websites offer the option to log in with your existing Google or Facebook account (among others). For a long time I've resisted doing this because I use a password manager and I figured it was more secure to create a separate account for each website with a strong, pseudorandom password. The browser integration for some cloud-based password managers is great, and I started to wonder why nobody had created a server-side version. Then it dawned on me that federated login basically is the server-side equivalent of a password manager (assuming you don't reuse passwords for the password manager).

Purely from a security standpoint, is there any good reason why I should prefer creating unique login credentials and storing them in a password manager vs. using federated login, or vice-versa? (assume I want to use a cloud-based password manager)

Answer 1

At least one way to look at this is to consider the strength and quality of the authentication offered at the target site against the Identity Provider (IDP) you intend to federate with.

For example, consider if you have a choice between opening a new account with a plain old password (which you will store in your Password Manager app) vs. redirecting to an IDP that performs Risk-Based Authentication (RBA) in addition to your password for the IDP. The system with RBA potentially will consider a variety of factors to score the authentication session, such as the IP address of the client, the characteristics of the browser, the "normal" pattern of the behavior for that user, etc. If the risk score turns out to be high, you may get prompted for answering some questions or another step up method already configured at that IDP.

In this case, which option do you prefer? Just the plain-old password, or an IDP with Password+RBA? Services such as Facebook are gradually deploying risk-based capabilities on top of the authentication service (which is why you may get prompted with a picture of a friend to name, etc). You can read more about RBA in this report:

http://www.landsbankinn.is/library/Documents/Frettir/The_Forrester_Wave_Risk-B1.pdf

a more generic definition is available from here:

http://whatis.techtarget.com/definition/risk-based-authentication-RBA

Regards.

Answer 2

This question discusses the difference between offline and online password managers.

So how does an online password manager compare to a federated identity provider?

The two have a similar risk profile In both cases you are fully trusting your provider. This isn't a bad thing - you get to choose you provider, so choose one you trust, even if this means running your own server. Both approaches have a fair risk of implementation flaws, and the types of flaw would be very different, but there is nothing that makes one approach inherently better than the other.

The difference is user experience. Federated login generally has a slightly nicer flow, but you are reliant on each web site to support it. Online password managers need a browser plugin, which may be problematic if you frequently use different machines.