Tell me more ×
Super User is a question and answer site for computer enthusiasts and power users. It's 100% free, no registration required.
up vote 1 down vote favorite

I like the idea of using a password manager to help me maintain separate, random passwords for each site I visit.

I don't like the idea of typing all my logins into a single piece of software. How do I know that it won't immediately transmit them to its mothership?

What evidence is there for the trustworthiness (or not) of these programs? (Especially 1Password.)

share|improve this question
If I may suggest: use keepass + dropbox instead. – Mahn Sep 22 '12 at 19:43
How do you know we won't lie to you making you choose an unsafe alternative? – Nifle Sep 22 '12 at 22:18
Strongly dissent from the claim that this question is "not constructive". It's a question any piotential user of password managers is likely to ask, and it has some straightforward answers. – Isaac Rabinovitch Sep 29 '12 at 0:43

closed as not constructive by Indrek, DragonLord, ChrisF, Nifle, Xavierjazz Sep 22 '12 at 22:43

As it currently stands, this question is not a good fit for our Q&A format. We expect answers to be supported by facts, references, or specific expertise, but this question will likely solicit debate, arguments, polling, or extended discussion. If you feel that this question can be improved and possibly reopened, see the FAQ for guidance.

2 Answers

up vote 2 down vote

When you enter a password by hand, your browser knows what you entered. How do you know the browser isn't transmitting to the mothership? Because you trust the company that supplied it.

You can't function offline with a 100% guarantee of security and privacy. The best you can do is to only allow openings to people you trust. Naturally, you should extend your trust with care, but if a company is doing business with a lot of people like you, it's in their interests not to abuse your trust — particularly when their whole business model depends on it.

Rather than worrying about conspiracies to steal your passwords, you should worry about unintended releases of your information. Do they have competent security people? Are the stored passwords encrypted in a way that allows unauthorized access?

share|improve this answer
I like your argument from self interest better than @moab's argument from authority. But I still wonder if there is any kind of certification or review, which is related to your questions about competence. – user2701 Sep 22 '12 at 19:36
@Eric The certification approach is actually the basis of Moab's claim that Open Source is better. There's just no way to audit a closed-source code base for back doors. But when you have a lot of people looking at your code in a public repository, they're going to spot security holes, deliberate or accidental. Of course, you still have to extend some trust to whoever built the application, unless you built it yourself -- something some tinfoil hat types insist on doing. – Isaac Rabinovitch Sep 22 '12 at 21:31
up vote -1 down vote

Open source and designed by Bruce Schneier, trustworthy as it gets

http://www.schneier.com/passsafe.html

share|improve this answer
3  
Argument from authority? I suppose if there's also an active open source community reviewing the code, that constitutes evidence, but how to judge what kind of review it's really getting? – user2701 Sep 22 '12 at 19:37
Trustworthy perhaps, but too limited for most users. No syncing, no support for any platform other than Windows, no ability to fill in or memorize forms.... – Isaac Rabinovitch Sep 22 '12 at 21:39
1  
@IsaacRabinovitch OP never asked about anything other than trustyworthyness – Moab Sep 22 '12 at 23:47
@PleaseDelete Your argument applies to all software, trustworthy based on who designed it. – Moab Sep 22 '12 at 23:49
1  
"Bruce Schneier" is trustworthy, research it yourself. – Moab Sep 23 '12 at 16:13
show 3 more comments