9

Assuming somebody has managed to get your encrypted password database. If the encryption and the password are strong I assume it will be almost impossible to crack the encryption in a lifetime, but anyway what could be the worst thing happening in such a situation?
I think the worst thing is not noticing the data breach. As long as you don't know about it you are not able to act and this means more time for the attackers. As soon as you know about the data breach you can change all your passwords, so the encrypted and stolen data will be worthless.

In this scenario I want to consider two ways of storing your password database. Local on your machine (any device you own) or online on the servers of a password manager company.
Who will notice such a data breach more likely and quicker? In which scenario is the user able to act quicker?

The question is not, how the data breach is done or what has a higher risk of getting hacked.

  • 1
    Just throwing it out there, you could enroll in haveibeenpwned.com and get the updates as soon as they know about it. – MikeSchem Feb 22 '18 at 23:44
  • @MikeSchem I've always found funny to give your secret info away to check if that secret has been breached... – Xenos Jun 29 '18 at 12:29
  • Personally, I think this question is perhaps a little opinion-based and thus is going to cause discussions and a lot of answers some of which may or may not be useless, others potentially useful nonetheless all opinion-based. – J.J Jun 29 '18 at 13:39
  • 5
    @Xenos the "secret" info you're giving away is just your email address, the actual secret info you're worried about is your encrypted password vault. – AndrolGenhald Jun 29 '18 at 13:39
5

Unless you're actively managing your password database on a regular basis, an online password manager company is probably more likely to notice the "breach" (as you've called it) sooner. That said, even though they may notice it sooner, they may not take action or notify you right away - which would impact your ability to act. So, I'd say it's probably fairly even in a users ability to react to a breach event (locally stored vs stored in the cloud by a vendor) IF they are actively monitoring their password usage. If they're not actively monitoring their passwords/password manager, then the obvious answer would be that they'll act once they're informed by a vendor that a breach has occurred (hopefully).

  • What do you mean with "managing your password database on a regular basis"? I don´t understand how this would help me to notice a data breach. – David Feb 23 '18 at 7:34
  • Online password managing might lead to data breach if your connection is broken (MITM or so). Local vault (on a USBKey or so) would be vulnerable if your computer is already hacked, but then, using an online storage or a local one, you'll certainly get your data breached too. Online company could stop a breach, but it's a breach threat you're adding over the top of a local stuff IMO. – Xenos Jun 29 '18 at 12:28
1

Well, I would say it depends.

The best case is probably the full theft on a serious online password organization. It is likely to be noticed and if the organization is serious it should warn its users as soon as possible.

Immediately below is the theft of your smartphone holding a local password database. You should notice it very soon (this could even be a better use case than previous one)

It is probably possible that an attacker manage to get the device containing the password database through a software attack. Simply the attack will have to be specifically targetted at the theft of your password vault. I have never heard of such attacks, maybe because they happened to be undetected, or were not massively spreaded. I admit that a massive attack is extensively analyzed and if it send password vaults it would be detected. My opinion is that the risk of encountering such an attack is quite low, but the possibility of detection would be very low too.

The possibility of a temporary physical theft of the device is slightly higher. The attacker has just to 1 take your phone, 2 extract the vault, 3 put it back in place. What has to be taken into account here is who could be interested in stealing your password vault, because this kind of attack has to be specifically targetted againt you. As far as I am concerned I would gladly accept it because I think the probability is close to 0, but it can be different if you are known to have access to highly sensitive data.

The last risk is that a member of the staff of the online password organization(including members of the staff of its datacenter) decides to take revenge on his boss because of any reason and steals some data including your own password database. As he can have legitimate access to the encrypted data the theft is likely to be undetected.

It is now up to you to decide what risks are acceptable and what are not. For my own use case, I have chosen a local vault, but it really depends on how you leverage the different risks.

1

You are comparing apples and oranges.

An online password manager is usually much more likely to be the target of a directed intrusion attempt than, say, a home PC. OTOH, the former are more likely to have tools/data/controls in place to detect an intrusion and a dedicated technical team providing 24x7 monitoring.

But a further consideration is that an organization whose business model is entirely based around secure management of data are likely to be reticent in admitting that they failed to do the job they promised.

-1

An online password manager would most likely notice it first because 1) the maintainers are likely interacting with it as a daytime job or something similar, so they would be better at recognizing unusual activity 2) assuming that other users are using the online service, someone other than yourself will likely get attacked first, alerting everyone else that something fishy is going on (in other words: there are a lot more "canaries" when using a shared service)

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.