Am I the only one who thinks it's crazy to put all of your passwords on a companies cloud where every single one of their other customers password vaults also lives?
Aside from putting the burden for file management of the vault on the customer, help me understand how local storage (with backups) isn't the safest place to keep my passwords from being compromised.
You’re not the only one, but that doesn’t make it crazy.
There’s a lot of confidential data stored on S3. This data is intermingled with other confidential data from lots of other companies at the storage layer. But encryption and proper access controls mitigate the risks you’ve described.
As with anything it’s a judgement call. I trust AWS to implement this correctly, and they send out all the correct signals to back this up. 1Password does as well. However lastpass never has, and so it would be a poor call to use their cloud service.
Ghost/spam traffic is a real problem for GA. UA codes are public and can be targeted with spam referrals or simply randomly hit (especially for UA codes that end in -1).
Filtering spam and getting useful data on GA is a never ending job that Google keeps making harder. (re removal of Service Provider / Network Domain [1])
Are those fees also present for transactions that are refunded immediately before they batch (i.e. testing). Let's say a stripe IP wasn't whitelisted on the server and started being denied coming back, causing transactions to fail. If I want to do a quick live environment test on this it now costs my client money, which is not ideal.
You can do that using Stripe test environment and test cards without any fees. Refunds can take over a week to get processed by some banks, so testing on live data doesn't sound like a great idea. But even if you have to do a couple of live transactions I don't see how the cost of refunds could be significant.
Yes live tests are useful for integration issues or as a final verification before going live. But I only do it once or twice with a 99% off coupon or similar so the cost is a matter of cents plus fees. Easy to ignore.
What volume and dollar value are you testing at? I ask because assuming your time is billed back fully loaded to the client at $200/hr - and you spend 4 hours doing some sort of testing your time is $800... what are the fees relative to this?
Better in terms of less immediately destructive, sure. But I've gone to more funerals from deaths of adrenaline junkies than drug ones. The holes they leave when they're gone are the same.
The number of funerals you have attended could be a poor proxy for the number of lives lost. Drug junkies tend to have fewer friends and be less vocal about their addictions because society, culture and laws.
But in my 43+ years of living, I've known enough of all of the above to come to think that the specific what of addiction matters less than the core pathology itself. The patterns are too similar across the board.
There's nothing inspirational about wondering if your friend is going to survive yet another dangerous stunt, just because they can't feel alive without risk. It's a shit situation for all involved.
This isn't the first time that LastPass has had security issues and it seems like a fools game to use a password manager that keeps you data in the cloud.
I don't think that's a fair criticism of Lastpass for having "security issues" for the following reasons:
1. In the blog post you linked, no user passwords were at risk. They were being abundantly cautious, which makes sense since they hold everyone's passwords.
2. In the talk you linked, this is a inherent problem with storing keys on your local filesystem and not a problem with Lastpass. 1password is also "vulnerable" to this attack.
3. This current phishing attack is not a vulnerability in Lastpass itself, or anything wrong with their cryptography. As the author points out, anyone who falls for this will receive an automatic email notice (if 2FA is not on) from Lastpass and if you have geographic restrictions enabled this attack won't work at all (note 1password does not have these features).
4. Storing encrypted data in the cloud is not inherently a vulnerability, although it increases your attack surface. Many users of 1password also do this with features like Dropbox sync, and Dropbox provides much less rigorous access control compared to Lastpass.
5. 1password has had it's own share of security blunders. The most recent being their database format that leaks all of your account names and the URL they are for, which 1password defended was for "performance reasons". http://myers.io/2015/10/22/1password-leaks-your-data/
EDIT: Updated to mention that alert emails are only sent if 2FA is disabled.
Thanks for the link to the 1password compromise, although, I stand by my point, that compromise is due to extraneous features as opposed to the core functionality. Being conservative myself, that's not a feature I use.
I see 1password's main vulnerability being that someone could gaining access to a device and vault passcode or obtaining that passcode through a keylogger.
I'm not sure how difficult it would be to brute force into 1Password locally but either way it's a low benefit game compared to the potential access with a compromise to a cloud based scenario like LastPass.
> I'm not sure how difficult it would be to brute force into 1Password locally but either way it's a low benefit game compared to the potential access with a compromise to a cloud based scenario like LastPass.
I'm not sure if you're familiar with how Lastpass works in general, but all of the data you store with Lastpass is encrypted in almost an identical manner to your 1password vault. They can't read your passwords.
A "compromise" of Lastpass would require brute forcing each user's vault in order to gain any actual passwords, which would require an extraordinarily long time.
I know it sounds concerning saying "put all your passwords in the cloud" but the reality is that it's no different than using 1Password with sync enabled.
>the reality is that it's no different than using 1Password with sync enabled.
Except that a users LastPass vault lives in the "cloud" so that a compromise of that password can likely open the door and makes it a more enticing target to begin with. Compared the likely hood of merely getting at the 1password vault (assuming it's not synced to the cloud) being a significant barrier.
Again, for me this discussion is educational, I'm curious how having this data in the cloud could ever be considered more secure than local storage.
> I'm curious how having this data in the cloud could ever be considered more secure than local storage
It's not, I didn't mean to give that impression. It increases your attack surface, which is a tradeoff that 99.99% of users are happy to make for the convenience of having instant and strongly secured access to all of their passwords from anywhere.
I meant to point out that this is no different than how the vast majority of 1Password users configure their database: with Dropbox syncing.
For me, this is a required feature to using a password manager. If you do not need this feature, local storage only is better. However, I'll argue that if you have that level of concern then you should also not be using any closed source password manager in the first place.
I think you may be wrong about #3. The author argues that anyone with 2factor turned on will NOT receive email notification, and I'm not sure what you mean by geographic restriction. You can disallow Tor IPs but that is about it.
