0

Which one is more secure and why?

For the online one, there is concern about whether your password is encrypted locally or not, or can anyone get an access to it if needed. Above all do you feel secure saving your passwords online?

For desktop password managers, a trojan, or a virus can steal all your passwords.

Would you prefer an old type chit keeping, where you write down all your passwords on a small piece of paper or in a small diary and keep it in your wallet?

This question was inspired by this question.

2 Answers 2

1

If you have malware on your local machine, it will compromise any cloud based service that you log on to anyway. Based on this, I would say that using a local password manager is better simply because unless you know the source code of the service you are using, anything is possible.

The real question is, are you willing to to sacrifice security for ease of use?

I have never used a password manager of any sort (other than the one built in to Firefox) as I use other techniques for remembering my passwords, however, I am quite impressed and like Keepass. You could always back up your password database to a service such as Dropbox or Mesh.

3
  • 2
    I use KeePass + Live Mesh, works like a charm. KeePass encrypts its database so the part of it living in the cloud is safe. Feb 23, 2010 at 15:03
  • @ Will, Say I use Keepass, then sometime if my computer get infected with a trojan or a virus, are my passwords safe? i mean it does not get stolen by that virus. Assume that I already have a backup copy. Just curious!
    – munnaBhai
    Feb 23, 2010 at 18:31
  • That depends, technically yes as long as you have a strong password protecting it - however, if the virus is some kind of keylogger, it will know your password - however you will have the exact same problem by using lastpass or any other product. Feb 23, 2010 at 19:59
0

An encrypted database uploaded via an encrypted connection into a secure database (With proper hashing and salting algorithms) is pretty much just as secure as a desktop solution, providing you don't have a password that can be bruteforced or guessed.

Either way, it's not that secure if the attacker has access to your PC.

2
  • You mean, even though the pass file is encrypted (e.g. say in Keepass), it still can be read by virus or attacker!
    – munnaBhai
    Feb 23, 2010 at 18:36
  • 1
    @munna, no, no, encryption is encryption, it can't be broken just through proximity. However, if a virus or keylogger can grab your password, then an attacker can read use that to get your passwords. They could, however, do that anyway with the passwords keypass stores!
    – Phoshi
    Feb 23, 2010 at 18:40

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .