7 ms·

But the most common alternative is Keepass in Dropbox... Which is effectively very similar

nindalf 10y ago
Not that similar. The reward-to-effort ratio for attacking LastPass is much better, you'll gain access to the passwords of so many users. With Dropbox, its less likely that you'll find something valuable and therefore less worthwhile to try. Most users would store their vacation photos, perhaps income tax info which might be useful but not as instantly exploitable as passwords.
- patrickk 10y ago
  Plus the password database is likely encrypted with a decently long master password and encrypted with AES (assuming this if the user has gone to the trouble of using a PW manager with Dropbox sync, hopefully with Dropbox 2FA also). That should be enough to keep out virtually all hackers, barring perhaps a nation state. For an extra level of security, you can (with KeePass at least) require a master password and key file (perhaps stored offline on a USB key), which will likely keep out virtually anyone.
creshal 10y ago
There's self-hosted team solutions around, they just don't get as much exposure. (Like mine: https://pave.software/ https://pave.software/ )
josephcooney 10y ago
Not really. If dropbox is compromised and they get your .kdbx file they've still got to be able to break that (unless you use the same password for dropbox and your kdbx file....which is not a good idea).
WorldMaker 10y ago
One difference is that Dropbox isn't the only option: there's Google Drive, Amazon Drive, OneDrive, Box, OwnCloud, Syncthing, Resilio Sync, SFTP, and many other "plain dumb file sync" tools to choose from. That certainly increases the security footprint some. You might know I synchronize a KeePass file with a cloud provider, but you might not know which cloud provider, and while the chances of any one particular cloud provider being hacked are somewhat large it seems, the chances of all of them being hacked enough at the same time that you find the KeePass file needle in my particular cloud footprint haystack is hopefully pretty rare. It's also something that if you get wind of an attempt in progress you can mitigate/defend by switching sync services or removing it from sync altogether until the attempt ends... Because it's "dumb file sync" with a number of options, there are also some really interesting options with interesting security footprint trade-offs of their own. Resilio Sync, for instance, originally known as "BitTorrent Sync", supports peer-to-peer sync and more interestingly supports "encrypted peers" where you can have a cloud provider participate that "knows nothing" about what is inside the synced folder but can still share/sync it with your devices that do. Similarly, if someone develops something crazy like a killer secure and somehow user friendly IPFS sync option tomorrow, you could switch immediately.

Not that similar. The reward-to-effort ratio for attacking LastPass is much better, you'll gain access to the passwords of so many users. With Dropbox, its less likely that you'll find something valuable and therefore less worthwhile to try. Most users would store their vacation photos, perhaps income tax info which might be useful but not as instantly exploitable as passwords.

patrickk 10y ago
Plus the password database is likely encrypted with a decently long master password and encrypted with AES (assuming this if the user has gone to the trouble of using a PW manager with Dropbox sync, hopefully with Dropbox 2FA also). That should be enough to keep out virtually all hackers, barring perhaps a nation state. For an extra level of security, you can (with KeePass at least) require a master password and key file (perhaps stored offline on a USB key), which will likely keep out virtually anyone.

creshal 10y ago

There's self-hosted team solutions around, they just don't get as much exposure. (Like mine: https://pave.software/ https://pave.software/ )

josephcooney 10y ago

Not really. If dropbox is compromised and they get your .kdbx file they've still got to be able to break that (unless you use the same password for dropbox and your kdbx file....which is not a good idea).

WorldMaker 10y ago

One difference is that Dropbox isn't the only option: there's Google Drive, Amazon Drive, OneDrive, Box, OwnCloud, Syncthing, Resilio Sync, SFTP, and many other "plain dumb file sync" tools to choose from. That certainly increases the security footprint some. You might know I synchronize a KeePass file with a cloud provider, but you might not know which cloud provider, and while the chances of any one particular cloud provider being hacked are somewhat large it seems, the chances of all of them being hacked enough at the same time that you find the KeePass file needle in my particular cloud footprint haystack is hopefully pretty rare. It's also something that if you get wind of an attempt in progress you can mitigate/defend by switching sync services or removing it from sync altogether until the attempt ends... Because it's "dumb file sync" with a number of options, there are also some really interesting options with interesting security footprint trade-offs of their own. Resilio Sync, for instance, originally known as "BitTorrent Sync", supports peer-to-peer sync and more interestingly supports "encrypted peers" where you can have a cloud provider participate that "knows nothing" about what is inside the synced folder but can still share/sync it with your devices that do. Similarly, if someone develops something crazy like a killer secure and somehow user friendly IPFS sync option tomorrow, you could switch immediately.