2

For cloud-based password managers, is it safe to login when using public WiFi?

To help get good answers to this question, let's define 3 terms:

  1. Cloud-based password managers = Password managers such as LastPass, Bitwarden, Enpass, and Dashlane, when all usernames/passwords/data are stored in the cloud.
  2. Login = Access a web-based password vault/safe or access password data via a web browser extension/plug-in on your own hardware. Assume access is via HTTPS, but always assume no HSTS data is already stored on the local client.
  3. Public WiFi = Open internet access available to anyone without a password. Always have to assume it is being operated by someone with malicious intent or that it has already been compromised.

I'm not sure whether or not we can assume that DNS is controlled by the client because I'm not familiar enough with every operating system to know what DNS it uses for new open WiFi connections. If you can include this issue in your answer, all the better.

  • These providers seem to cover this exact question in their FAQs, was there something about their answers that confused you? – Don Simon May 14 at 20:31
  • 1
    @DonSimon I think people here might be more knowledgeable. Plus, many companies unfortunately are completely unaware of vulnerabilities, or choose not to disclose them. Also, I don't see this exact question answered in FAQs for each product mentioned. Finally, where it is mentioned, it is impossible to tell if they are assuming previous access that would establish HSTS data (which is not a safe assumption), or if DNS control might be an issue. This question is more in-depth and detailed than any FAQ currently available. – RockPaperLizard May 14 at 23:46
  • 1
    @DonSimon if you make the claim, then the responsibility is on you to at least provide a path to verify the claim, especially when it is clear that someone tried to follow the path and found nothing. A single link to the material you reference would suffice. – schroeder May 15 at 18:48

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.