Security of browser only password managers [closed]

Question

There are password managers like KeePass which store all the passwords in an encrypted container on the local machine. I would have to copy this container over to other machines to be able to have my passwords there as well.

Then there are password managers which are essentially like KeePass but store the password container online.

And then there are algorithmic password generators which, based on a master password, create the password for the currently visited website on the fly. Examples for such online password managers are SupergenPass and PWDHash. All I need to carry around with me is a tiny bookmarklet (which gets synced across browsers) and the master password in my head.

What are the advantages or drawbacks, security-wise, when using the online password managers of the 3rd category? Is there an online password manager which addresses these drawbacks while providing the advantages?

Answer 1

I personally like the hosted manager a bit better as long as the security is implemented properly. Take LastPass for example (my favorite), they don't store an un-hashed version of your master password so without deliberately cracking your passwords, even the site host can't access your information. This is of course only as good as your trust in the third party which is where the security concerns come into play. Long story short, as long as they don't keep an un-hashed copy of your password, I don't mind using the hosted password managers.

Answer 2

Well, they are all implemented differently some are more secure and some less.

For example, I use Clipperz.

The way Clipperz works is it encrypts/decrypts an encrypted blob that the server stores in javascript. This means that if your blob finds its way to an evil hacker they will not be able to decrypt it (if you decided on a reasonable password)

The code for it is open source, something that fills me with a bit more confidence cause I can audit it.

LastPass uses the same approach so it is fairly safe.

I would be less likely to use stuff like https://www.pwdhash.com/ cause it means that if I want to change my master password I will need to change it on all sites. Also, it is less secure as if people know the rules I use to build the password they can brute force my master password.

Answer 3

2018 update

I've learned much in the 8 years since I originally wrote this answer. What I once thought was a secure password really wasn't all that secure. Today I use 1Password with "diceword"-style generated passwords. Still offline and for the same reasons, but more secure than my mental algorithm based on the domain name. The only passwords I need to remember any more are the one to log into my computer, and the one that opens my 1Password vault -- both of which are noted in my wife's 1Password vault in case something were to happen to me. Everything else is only a few keystrokes away.

Using a hosted password manager means that your passwords are stored somewhere in the cloud, and somewhere nearby to that (in the code that creates/edits/uses them) is explicit instructions on how to decrypt them. Should the site be compromised, it wouldn't be hard to get access to thousands of accounts.

For that reason, I'm leery of online password managers. Personally, I use a solution that I made up for myself: I have an algorithm that is simple enough to run in my head, that generates a secure password (upper & lower case characters, numbers, and special characters) based on the domain name and my chosen username.

In addition, I try to use oAuth and OpenId wherever possible, so that I have fewer passwords to remember and can be surer that the sites that DO have my password (e.g. Facebook, and my OpenId provider) are properly securing it (salt + hash, etc).

If I had to use a password storage utility of some sort, I would probably go with KeePass and store the encrypted file in Dropbox to sync between computers.