Who will notice a data breach more likely, me or an online password manager?

Question

Assuming somebody has managed to get your encrypted password database. If the encryption and the password are strong I assume it will be almost impossible to crack the encryption in a lifetime, but anyway what could be the worst thing happening in such a situation?
I think the worst thing is not noticing the data breach. As long as you don't know about it you are not able to act and this means more time for the attackers. As soon as you know about the data breach you can change all your passwords, so the encrypted and stolen data will be worthless.

In this scenario I want to consider two ways of storing your password database. Local on your machine (any device you own) or online on the servers of a password manager company.
Who will notice such a data breach more likely and quicker? In which scenario is the user able to act quicker?

The question is not, how the data breach is done or what has a higher risk of getting hacked.

Answer 1

Unless you're actively managing your password database on a regular basis, an online password manager company is probably more likely to notice the "breach" (as you've called it) sooner. That said, even though they may notice it sooner, they may not take action or notify you right away - which would impact your ability to act. So, I'd say it's probably fairly even in a users ability to react to a breach event (locally stored vs stored in the cloud by a vendor) IF they are actively monitoring their password usage. If they're not actively monitoring their passwords/password manager, then the obvious answer would be that they'll act once they're informed by a vendor that a breach has occurred (hopefully).

Answer 2

Well, I would say it depends.

The best case is probably the full theft on a serious online password organization. It is likely to be noticed and if the organization is serious it should warn its users as soon as possible.

Immediately below is the theft of your smartphone holding a local password database. You should notice it very soon (this could even be a better use case than previous one)

It is probably possible that an attacker manage to get the device containing the password database through a software attack. Simply the attack will have to be specifically targetted at the theft of your password vault. I have never heard of such attacks, maybe because they happened to be undetected, or were not massively spreaded. I admit that a massive attack is extensively analyzed and if it send password vaults it would be detected. My opinion is that the risk of encountering such an attack is quite low, but the possibility of detection would be very low too.

The possibility of a temporary physical theft of the device is slightly higher. The attacker has just to 1 take your phone, 2 extract the vault, 3 put it back in place. What has to be taken into account here is who could be interested in stealing your password vault, because this kind of attack has to be specifically targetted againt you. As far as I am concerned I would gladly accept it because I think the probability is close to 0, but it can be different if you are known to have access to highly sensitive data.

The last risk is that a member of the staff of the online password organization(including members of the staff of its datacenter) decides to take revenge on his boss because of any reason and steals some data including your own password database. As he can have legitimate access to the encrypted data the theft is likely to be undetected.

It is now up to you to decide what risks are acceptable and what are not. For my own use case, I have chosen a local vault, but it really depends on how you leverage the different risks.

Answer 3

You are comparing apples and oranges.

An online password manager is usually much more likely to be the target of a directed intrusion attempt than, say, a home PC. OTOH, the former are more likely to have tools/data/controls in place to detect an intrusion and a dedicated technical team providing 24x7 monitoring.

But a further consideration is that an organization whose business model is entirely based around secure management of data are likely to be reticent in admitting that they failed to do the job they promised.

Answer 4

An online password manager would most likely notice it first because 1) the maintainers are likely interacting with it as a daytime job or something similar, so they would be better at recognizing unusual activity 2) assuming that other users are using the online service, someone other than yourself will likely get attacked first, alerting everyone else that something fishy is going on (in other words: there are a lot more "canaries" when using a shared service)