Is it recommended to use a password manager?

Question

Hi,
I've recently installed a password manager (PasswordSafe) after having mixed thoughts about using a password manager. The thing I'm scared of is that it creates a single point of failure, where if someone figures out the password to my database, they will have access to all my passwords. Are these unbased fears? Where else should I keep the passwords if not here? I'm paranoid by nature and value privacy highly.
Last edited by Median (2015-06-07 01:02:38)

Answer 1

Median:
Password managers are introducing the single point of failure — that's true! But the risk is not only overestimated, but also greatly outweighted by the profits.
First of all, if your password manager database is stolen AND the passphrase to it is known, this implies your computer has been compromised. If it is so, then most probably passphrases are leaked anyway. There is a difference is in the size of the leak if the time window in which the attacker was able to log your passphrases was short. But it should be emphasized, that that's the only difference. It's not about "100% vs 0%", but more like between "100% vs much".
And the profits are considerable:
With a password manager you actually can have unique passphrase to every service you're using, and chenge it as often as you want.
You're no longer bound to memorable passphrases. You can just output as much as you need from /dev/urandom and use it.
Note that I assume that you're already using the passphrases only on trusted machines. Otherwise the question and the answer makes no sense. If you're — for example — leaking your bank account passphrase on your college workstation — then the security holes are on a much more basic layer than the question of using or not using a password manager. In such case password manager may not be the good solution, as you will indeed leak everything pretty fast.
Aerial Boundaries:
Correct horse battery staple is even simpler than diceware, provides better security and is easier to memorize. However, the OP asked not about how to generate passphrases, but about their storage. Whether you're using diceware, Randal;'s c.h.b.s. or any other generator, human's memory is capable of holding only a few to a dozen of good passphrases on average, and only to the often used resources (home pc, pc at the work, favourite fora, facebook or other marketing networks, banking, …). But nowadays we're having much, much more accounts everywhere. This is way beyond capabilities of our brains. An external storage is needed. Otherwise you'll start to re-use passphrases, which is bad from security pov. Re-use both spatially — between resources — and temporally — between passphrase changes on a single resource. Password managers are the answer.