0

I read that Password Managers are a more secure option than remembering passwords. I am currently evaluating Passwords Managers with cloud synchronization and there is something that really confused me.

For cloud synchronization platforms, usually not free, you first need to create an account with a platform account password password-1. This account is mainly used for billing purposes. Then, you have to create a second password password-2, named Master Password, which is used to generate all the other passwords. So initially, you have 2 passwords.

In this situation, is it a good practice to replace password-1 with a password generated from password-2?

4
  • Why is there a chicken/egg problem? The Master Password isn't used to generate anything.
    – schroeder
    Commented Feb 20, 2023 at 8:53
  • 1
    @schroeder: I think it would be correct to say the Master Password is used to generate (via key-stretching such as PBKDF) the symmetric key which protects the encrypted password storage, no?
    – Ben Voigt
    Commented Feb 20, 2023 at 22:31
  • @BenVoigt sure, if you're exceeding the context. My question is "where is the chicken/egg problem?"
    – schroeder
    Commented Feb 20, 2023 at 22:34
  • The Chicken and Egg part was just a little pleasant to write down, but I was referring to a kind of bootstrap process: 1) Create an account for let's say NordVPN or other (password-1 chosen manually) 2) Create a Master Password 3) Replace password-1 by a generated one. So it's difficult to create a robust strong 32-character password-1... if you don't have the Password Generator in a first place. Thanks to every body, this topic seems a little bit more clear on my side, I will need more time to think about it.
    – Robert
    Commented Feb 21, 2023 at 5:04

3 Answers 3

1

[Disclosure: I work for 1Password]

Do not reuse your password manager Master Password for anything, including for other services that the password manager vendor might offer.

I am not sure which password manager you are describing with a separate billing service, but I very much understand how a service could be designed that way. (We don't do it that way at 1Password, but this is a trade-off, which others may do differently.)

In all likelihood, your billing account password is a password used for authentication while the master password is used for encryption. Because people mostly encounter passwords for authentication and the metaphors we that are used for talking about passwords and unlocking are all better metaphors for authentication, most people don't see the distinct security properties of passwords used for encryption.

In a well-designed system, the vendor of your password manager is not able to reset your Master Password. If you forget it and you haven't set up some alternative recovery mechanism, you will be forever locked out of your data. That is good design for a password manager because it means that the operators of the service can't get into your data if they are compromised (or evil.) A password used for authentication can always be reset by the service.

Different password managers that offer a synching or on-line service have taken different strategies dealing with the fact that users need both a way to authenticate with the service and a way to decrypt their data. Some, like the one that you describe, has you use two separate passwords. I know that at one point Dashlane worked this way and had set up contradictory password requirements for the authentication and Master Password password in order to prevent people from reusing the same one for both. I don't know if they still do this.

With 1Password, we are weren't going to change our name when we launched our service. So we designed an authentication system around a PAKE, which means that no information about a user's one password is transmitted to the server during authentication. While I naturally think our design choice is better, I understand the rational for the two password design. And if the two password design is set up as I imagine it might be, then you should definitely not use the same password for each.

2
  • You don't have a separate account password, Lastpass doesn't, Bitwarden doesn't. I wonder what service the OP is talking about.
    – schroeder
    Commented Feb 20, 2023 at 22:37
  • This answer is very clear, it really help me clarify things. NordVPN have a first email/password to create an account on their platform (products: NordVPN, NordPass and NordLocker). When you first open NordPass, you are asked for a Master Password. Then you can use NordPass to generate passwords. My initial question, unclear, was: is it best practice to use NordPass to generate password for the initial NordVPN account? From what I understood, yes it is OK and not risky because it will be possible to reset that password.
    – Robert
    Commented Feb 21, 2023 at 1:53
1

Password managers are not a more secure option than remembering passwords, they just generate more complex passwords (that cannot be easily cracked/are not in wordlists) and store them. If you could remember high-entropy/complexity passwords without computer help, that is technically the most secure option.

Assuming you cannot remember random alphanumeric strings, using a password manager to store your password for the cloud account carries the same advantages as any other account - decreased susceptibility to various bruteforcing attacks. In summary, yes, replacing it is, for most users, more secure.

2
  • My question was a little bit more specific, after the registration process I end up with 2 human-passwords: password-1 (web platform for billing) and password-2 (Master). Is it best practice to replace password-1 with a generated one?
    – Robert
    Commented Feb 20, 2023 at 5:57
  • 1
    It depends on how good password-1 is. If it brings you no added complexity to re-generate it (password-1 is already strong and memorable), then it doesn't matter. Otherwise, it is indeed best practice.
    – belkarx
    Commented Feb 20, 2023 at 6:06
1

password password-2, named Master Password, which is used to generate all the others passwords

The widely used password managers don't generate passwords based on a single one. The can generate, but you define rules for a new password: What characters are to be used, length, some additional requirements.

The master password is used to unlock other passwords, not to generate passwords.

is it a good practice to replace password-1 with a password generated from password-2?

No. Making one password depending on the other is a bad practice. For instance, you may suspect that your password-1 was leaked (e.g. you believe that smb. has seen as you type it in). In such case you can easily change this password. Or the website may have a policy to force users change their passwords regularly, e.g. every 3 months or every year. Again, if one password is generated based on another, this can lead to difficulties.

But in case you question is based on misunderstanding (password-1 is actually not generated based on password-2 as you supposed, but is actually stored in the password database that is locked with password-2), then it is fine to store it in the password database together with all other passwords. Even if there is a technical problem in the password manager and you need help, and you have no access to your account password because password-1 is stored in the password manager, you can still reset it, depending on provider, they can use your email and the 2nd if you configured it.

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .