up vote 0 down vote favorite
share [g+] share [fb]

Which one is more secure and why?

For online one, there is concern about whether your password is encrypted locally or not or can Uncle Tom or whatever get an access to it, if needed. Above all do you feel secure saving your password online?

For desktop managers, a trojan, or a virus can take all your password.

Would you prefer an old type chit keeping, where you write down all you passwords in a small paper flash card or small dairy and keep it in your wallet!

This question is inspired by this question.

link|improve this question
feedback

2 Answers

up vote 1 down vote

If you have malware on your local machine, it will compromise any cloud based service that you log on to anyway. Based on this, I would say that using a local password manager is better simply because unless you know the source code of the service you are using, anything is possible.

The real question is, are you willing to to sacrifice security for ease of use?

I have never used a password manager of any sort (other than the one built in to Firefox) as I use other techniques for remembering my passwords, however, I am quite impressed and like Keepass. You could always back up your password database to a service such as Dropbox or Mesh.

link|improve this answer
2  
I use KeePass + Live Mesh, works like a charm. KeePass encrypts its database so the part of it living in the cloud is safe. – Graeme Donaldson Feb 23 '10 at 15:03
@ Will, Say I use Keepass, then sometime if my computer get infected with a trojan or a virus, are my passwords safe? i mean it does not get stolen by that virus. Assume that I already have a backup copy. Just curious! – munnaBhai Feb 23 '10 at 18:31
That depends, technically yes as long as you have a strong password protecting it - however, if the virus is some kind of keylogger, it will know your password - however you will have the exact same problem by using lastpass or any other product. – William Hilsum Feb 23 '10 at 19:59
feedback
up vote 0 down vote

An encrypted database uploaded via an encrypted connection into a secure database (With proper hashing and salting algorithms) is pretty much just as secure as a desktop solution, providing you don't have a password that can be bruteforced or guessed.

Either way, it's not that secure if the attacker has access to your PC.

link|improve this answer
You mean, even though the pass file is encrypted (e.g. say in Keepass), it still can be read by virus or attacker! – munnaBhai Feb 23 '10 at 18:36
1  
@munna, no, no, encryption is encryption, it can't be broken just through proximity. However, if a virus or keylogger can grab your password, then an attacker can read use that to get your passwords. They could, however, do that anyway with the passwords keypass stores! – Phoshi Feb 23 '10 at 18:40
feedback

Your Answer

 
or
required, but never shown
discard

Not the answer you're looking for? Browse other questions tagged or ask your own question.