Comment by replete | Hacker News Reader

Comment by replete | Hacker News Reader

Parent Full thread

There is a fairly big difference, you are decrypting a local file using a master password NOT stored on the internet. No data is going over the wire, no 'other peoples computers'.

Even if someone got your vault file, with a _very strong_ master password it's just not going to get brute forced any time soon. [1]

With an online-only solution you have no idea how they are storing your data. I think 1p local vault (only) with db sync with an extremely strong master pw is adequate, but indeed for most use cases, it could be better to simply one-way sync from your main computer to your mobile device with something like Resilio Sync and avoid Dropbox entirely.

I cannot bring myself to trust any online service with this kind of data. Nobody is getting my master password without hacking my machine, brain, or government backdoor. There is a lot of peace of mind to be had with a local system IMO.

[1] https://support.1password.com/pbkdf2/

I would disagree with your premise. LastPass get hacked you hear all about it (this thread being a perfect example). You also then get group minds chasing solutions and spotting issues.

If you get hacked, you wont even know, and when you try to figure out how your genius security solution was foiled, you are on your own there too.

The only way your data is safer is in your mind, which is the first mistake of security; you dont get hacked because you knew about the weakness, you get hacked because you didn't.

PM's are, in most cases, a lot more advantageous for many reasons. But you can't really compare the solo solution at all, imo.

> There is a fairly big difference, you are decrypting a local file using a master password NOT stored on the internet.

That's the same thing that LastPass does AFAIK. According to their site: "Your data is encrypted and decrypted at the device level. Data stored in your vault is kept secret, even from LastPass. Your master password, and the keys used to encrypt and decrypt data, are never sent to LastPass’ servers, and are never accessible by LastPass."

So they pull down the encrypted vault to the local machine before decrypting it, it's never on the wire in an unencrypted form, nor keys leave your local machine.... which is essentially exactly the same thing that you do with 1Password + Dropbox for sync, just in one service. (At least that's my understanding, I might be interpreting the LastPass statements wrong, in which case please do correct me.)

Reply on news.ycombinator.com