What are most dangerous vulnerabilities of users of password management? [closed]

Question

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how?

Basically, I sort of know the typical vulnerabilities of password management (or more likely their users). In particular I am interested in problems that have actually happened.

I wonder if there is any case where people used 1Password or LastPass and got hacked anyway and lost money or something significant.

The hack doesn't have to be the password managers' fault. It could be the users' own fault, which I want to avoid making.

I want to see examples so I can better understand all the vulnerabilities.

What I mainly look for is case where someone with a bitcoin account lost bitcoin even though he used 1Password, AllPass, for example.

Most likely it's the users' own fault. I want to know what sort of faults I need to worry about when I am using password managers.

I am aware that AllPass got hacked, but nobody lost their money because of that.

This includes any points of failure, such as forgetting master passwords. Anything "undesirable" that's not deliberate and not deliberate.

Answer 1

In June 2018, ZDNet reported that the password manager OneLogin was hacked, exposing sensitive customer data. A few months prior to this another popular password manager, LastPass, also suffered from a troublesome security issue as this article from the UK Independent describes (LastPass had previously been hacked two years earlier .)

Bottom line: The potential security you gain from using a password manager outweighs any potential security issues on their end.

My personal favorite is 1Password.

PCMag.com awarded both Dashlane and Keeper their Editor's Choice:

The Best Password Managers of 2018

Answer 2

These are the threats that I have identified when dealing with password managers.

• It's a single point of failure. If you forget the master password or it is ever stolen, everything is going to be compromised. You need backups like everything else, but then you need to make sure the backups are at least as secure as everything else, otherwise that will become the weakest link in the chain and an even worse single point of failure.
• Password managers, like all applications, can have bugs that lead to security vulnerabilities or can be corrupted to add hidden backdoors.
• Popular password managers, since they are commonly used by a lot of people, can become a specific target even in generic attacks. For example this means that if PopularManager stores all passwords in ~/popularmanagers/passwords.db, it is more likely that malware will be written to check that path (and probably steal the database, etc.). The same is true of phishing and everything that can target a specific popular password manager.
• Online password managers can be compromised in even more ways, not only by attacking the user or their client, but also by attacking the server or the people that provide the service.

I can't think of any others at the moment. Whether those threats are worth being considered or not, depends on the "threat model", which in turn depends on a few trade-offs. If you decide not to use a password manager to avoid the above threats, you are going to face other specific threats. Today there are just too many passwords to remember, from at least a dozen to about a hundred on average, I would say. Some people as part of their jobs might have to use even more than a hundred passwords. How do deal with this?

• Use the same password everywhere, or similar passwords based on a pattern. Then this means that the administrator of StackExchange would be able to access all your accounts (since the passwords will be the same or very similar), and the same is true of any attacker that managed to compromise StackExchange, and the same is true of any other service where you have an account.
• Write them down somewhere. Which means that you will be using some kind of "password manager" anyway. If you write them down on a piece of paper, then that piece of paper will be your "password manager". If you write them in a file on your computer, then that file will be your "password manager". And these "password manager" will face all the threats discussed above, plus more threats depending on how much they suck. For example, if you write passwords on a piece of paper, then what are you going to do when you need to enter a password? You will take out the piece of paper and type it. But if you are in an office (or at home), everyone around you will see where you keep all your passwords. You would have to lock it somewhere, but then you will have to keep the key with your all the time. Plus while you are typing the passwords, everyone could easily glance at the piece of paper (or take a picture) and see your password. Oh, and don't forget the backup of the piece of paper. These are just some examples, just think of all the scenarios and you will realize there are a lot of threats.

As you can see, in most cases, not using a password manager is going to introduce a lot more threats that are hard to mitigate, so that's why password managers are recommended anyway.