1

I am going to use one of them for my password management.

The thing is, what about if one day, the password management company is hacked or destroyed.

What would be my recourse?

3 Answers 3

3

It shouldn’t be too much of a serious problem.

What I guess you are referring to is that your password database on one of those service’s servers is gone/cracked.

The cracked possibility

If the servers were to be cracked and your database to be released in the wild, then you’d probably be safe, depending on the security of your password. As databases are encrypted, only someone with the password (you) can unlock it. However, if someone was to use password cracking on your database and that you used a weak password, it could be cracked. That’s why it’s recommended to have a VERY SECURE PASSWORD that you’ll still remember (no forgot my password function here). I’d still recommend changing your passwords tho, but you don’t have to rush it.

The server shutdown possibility

If it happens, then don’t worry, because the app probably stored your database locally, and you’ll be able to export it. lHowever, I’d still recommend doing backups regularly, and storing them somewhere safe, and even better, doing 2 backups and storing them separately.

Another option

If you don’t trust the company’s servers, you can use a serverless solution called master password that works without any server whatsoever, but doesn’t really let you choose a password. For a more traditional style, there’s keepass, an open source database file format for which multiple different softwares/apps (keepass 2, keepassxc, keeweb, etc.) were developed, and therefore lets you have the freedom of host, like dropbox or google drive.

1

This is a bit broad, and your actual outcome may vary depending on jurisdiction, escrow details etc., however:

If you use the online version only, then you must assume that you will lose access to all your passwords stored in that service. Not great. This will require a lot of password reset activity.

Additionally, depending on how the data is stored with the 3rd party, you should also assume that the attacker can gain access to your passwords. Once again - get them changed immediately!

Those situations assume you have used the online version. If however you only use a local version then you are in a better situation. As long as you don't allow the app to be updated (potentially introducing an attack route to your device through a malicious update) then you still have the data on your device. You'd still want to move off it, but at least this can be done in a controlled manner, rather than as an emergency.

1

This question might be too opinon-based but I'll try to answer it anyway:

Generally, your problem here is not the providers per se but your "all eggs in one basket" approach. Your best recourse would be to prepare for these eventualities and adopt a good backup- and restore concept.

The most common guideline would be a 3-2-1 backup:

3 copies of your data. 2 on site, 1 off site.

Usually that would treat the off site backup as a long-term cold storage. In the case of password managers however, your offsite data is your "hot data". Nevertheless, you should aim to have two off-offsite backups (i.e. NOT on the password managers' servers). Usually these services also offer backup and restore options to download/upload your data. Depending on the automatability of this process you can either set up a cron job or do it manually every X intervals. Once you downloaded your backup you treat it just like every other file that you want to backup: have copies locally and off site.

4
  • Ocasionally I would "export" passwords from allpass and put it in excel with password? Is that what you're saying?
    – user4951
    Oct 1, 2018 at 8:39
  • I am not familiar with the export format of those services but saving your passwords in plaintext in a spread sheet is not secure. The backup should of course be encrypted and stored securly as well. Oct 1, 2018 at 8:48
  • ...should of course be encrypted and stored securly. I don't fully agree. I would say ...should of course be stored securely. I would never encrypt a backup stored in a physical safe, because when I will need it, I do not want an additional risk for Availability at decryption time. And I trust the physical safe to be enough for both the Confidentiality and Integrity of the security triad. Of course if the backup is stored on a laptop, then encryption is necessary. Oct 1, 2018 at 10:28
  • Very valid point, Serge! It was just my assumption that we're talking about digital-only backups. Depending on the size of the spread sheet and the frequency of the analog backup, a hardcopy stored in a safe would also be a viable last resort solution for this scenario. (restoring the passwords will most likely be a pain in the a even with OCR) Oct 1, 2018 at 12:20

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .