Hacker News Reader

Comment by xg15 | Hacker News Reader

> So no matter if it's in Dropbox, 1Password's servers, or your own hard drive, if anyone obtains a copy of the password file they still have to crack it before they gain access to anything.

Except that they control the client that I'm entering the master password into. So either the password is sent to their servers anyway or a malicious actor could simply update the client to do so.

View on HN

You're of course free to use whatever software you want or do whatever you want. But I think assuming that you're going to see a malicious actor updating your password manager to steal all your data shouldn't be too high on your list of things that you think will realistically happen. I'm not saying it's impossible, just one of the least likely things to happen.

This is true of any password manager.

But you can take your device off the network when running the password manager to ensure it isn't able to do that, for example. (Or more realistically, you can watch with something like Little Snitch or WireShark to ensure it isn't happening.) That's something you can't do when the password manager requires the network to do its main function.

But my wife can't do this. She doesn't know how.

It's absolutely incredible to me that people ignore one of the biggest sides of the argument for pre-baked, user friendly products like 1Password: usability for as many people as possible.

You're trusting the client whether or not it can talk on the network. A malicious update that starts generating predictable passwords for websites doesn't need a network connection.

Reply on news.ycombinator.com