Hacker News Reader

Comment by ocdtrekkie | Hacker News Reader

It's worth noting that the likelihood of someone hacking your preferred password manager is drastically higher than the likelihood of someone breaking into my house and rifling through my drawers. (My passwords aren't there either, because my memory is REALLY good at passwords, but I'd rather put them in my desk drawer than a password manager.)

View on HN

Depends on who's trying to get your passwords.

Hackers from an enemy state, rival company, or government agency? Yea, they'll probably hack your password manager.

Co-worker, ex-girlfriend, etc? They'll break in your house, office, or desk.

Sure, but again, it depends what you're most worried about. All of the examples you gave are specifically of targeted attacks, but the issue with password managers is much larger: Automated, non-targeted attacks on everyone putting their passwords in a commonly understood place.

Agreed, but that's why I like the model of 1Password (or KeePass, theoretically, although it apparently had some issues?) where the only thing stored online is an encrypted vault and the decryption only happens on local devices.

KeePass doesn't store anything online by default and doesn't run any servers at all (people use their choice of online file folder provider [Dropbox, Box, OneDrive, Resilio, private servers, etc] if they want online access/sync), so you may be confusing it with something else.

I understand. 1Password (in its classic model, not sure about the team/family/web product thing or how that works) doesn't store anything online by default either. In both cases (1Password and KeePass), you can combine with an online file folder provider to achieve sync across your devices. And I like that model.

What happens if you're incapacitated somehow (say - car accident and coma for a few days, or worse)?

You can use the "I forgot my password" feature

That'd suck, and I'd imagine whether or not I remembered all my passwords would no longer be my top concern in my life. Everything eventually filters down to an account tied to my real identity that has customer service (I don't rely on Google anymore), so presumably I could prove my identity outside of the Internet.

I think the point was more if you have family that would need the password then.

The same is applicable. Even if I were to die, a death certificate and a family member can get into an account. In most cases though, it's unlikely they'd need to. Close out my credit card, and everything else is going to, by very nature, shut off (eventually).

I mean to expand. Yes, that works and is honestly what I rely on.

I will add that it is more cumbersome than it needs to be for family. I highly encourage everyone to make sure immediately family is joint owner of critical things. Makes transitions much easier. (Though, yes, there are valid reasons not to do that.)

Reply on news.ycombinator.com