Are online password managers secure?

If you're asking in theory, can such a system be built securely?
My answer would be yes, absolutely, but it's not trivial work - and most likely would be done wrong (depending on who designed and built it).

If you're asking about existing services, while I'm not familiar with the one you mentioned, in general I don't know of any good, reliable, secure systems for this.

If you're asking, how can I tell if a specific system is secure and reliable?, well, ya can't.
Unless you (or an expert you trust, and is proficient enough in the given technology) performed an in-depth code review, penetration test, and other security reviews. And periodic deployment and server examinations. And so forth...

And no, getting a 3rd party certification such as HackerSafe (not even PCI:DSS) is not good enough, not for you to entrust the keys to your most sensitive data. (Unless its a service you know well enough to trust).


I would recommend switching to Keepass or KeepassX for linux and put all your passwords in the one encrypted keepass database, (locked with a password or a key file) and then putting the database file into the cloud like S3 from Amazon Web Services or Dropbox. By doing this...you have a portable database file which can downloaded to any computer from the cloud and opened only by the keepass software with your decryption key/password.


In my opinion using a service like passpack could add another "weak ring" to your chain.

Your passwords are safe as how much paranoid you are about them (think about all the password best-practices), using a service like passpack make your passwords safe also as the whole passpack service itself (are their servers secure? the front-end? and so on..)

You should evaluate which one of these security sides you consider safer and which one you trust more. Are your password policies safe and trusty more than the security of a random password manager app? If yes, then this service may not be for you.

Tags:

Passwords