Password Apps - Question

[gjkiii]

I am trying to figure out why apps like 1Password are so popular. Aren't all the passwords stored in one place dangerous because if someone steals your phone then they can access everything you are part of. Am I wrong?

 

[Rukbat]

As long as they know the password you use to get into the password app. If it's random and long enough, it'll cost them more work than it's worth. (Of course if you have a decent amount of money in your bank account, and have your online banking password in the phone, and don't have a way of wiping the phone's data, you're asking for trouble.)

 

[Digital Controller]

Rukbat is completely right.

Yes they are in one place, but having your passwords backed up somewhere is always nice because there always seems to be one password that I forget that I still use nowadays.

As long as that one password to the password application is very secure

Banking is always tricky on a phone though. Especially if people could get a hold of your information that way. Just be wary, use relatively similar passwords, I usually keep about 3 in rotation that are very secure, you know number, letter, !@#$%^&*() <--- one of those....etc

 

[Medion]

I am trying to figure out why apps like 1Password are so popular. Aren't all the passwords stored in one place dangerous because if someone steals your phone then they can access everything you are part of. Am I wrong?

You have a few ways that you can do this, and each has its inherent pros and cons. Here's a few.

Local database method - This is where you use an app that keeps a local database, such as 1Password and Keepass. The database is stored by you, and you are responsible for keeping it backed up and synchronized across devices. If someone steals your phone, you just go home and change all your passwords with your local copy, and then the copy that was stolen will be out of date (even if the thief can crack your database). The downside is keeping it up to date on all devices. But if you only use one device, this is a solid method.

Cloud providers - The most well known is LastPass. This is the least secure, because if someone can guess your main password, they get everything, and you have little recourse. You can't just change the passwords from another device. But it is also the most convenient. As always, you trade convenience for security.

Hybrid method - This is where you take a local database and store it in the cloud via Dropbox, Google Drive, etc. This one combines the security of a local database with the convenience of a cloud provider. It's also far more secure than the cloud provider alone, because the thief has to gain entry to your cloud provider AND the database password (although most users don't lock their cloud storage on their device, the security exists online). If someone steals your phone, you just bar that device from the cloud app, and change your passwords as needed (same as the local method).

I personally use the Hybrid method with Keepass on my Windows desktop and laptop, as well as my Android phone. If you go this route, there are several apps that will work with KeePass. Here are my top 3:

KeePassDroid - The best one, IMO. Lightweight, fast, intuitive. Only works with local databases and will natively sync with Dropbox. Can open a read-only database from Google Drive, but cannot edit (which is also a good security measure).

KeePassDroid for Google Drive - Same app as above, but modified to sync with Google Drive. Is not updated and is currently a point release behind the above version (1.9.2 vs. 1.9.1). I only recommend this version if you prefer the above version, but must sync with Google Drive.

KeePass2Android - This is the largest and most feature filled app. Includes compatibility with numerous cloud providers, a keyboard for auto login, and more. I'm not a fan of it for minor reasons, but the developer does post on this board and genuinely cares about the customer's experience. Due to the features and support, I'd gladly donate to the author if he'd make a few minor changes.

 

[Rukbat]

I just use Keepass (Keepass Droid on the phone, the Windows version on Windows boxen), with the database file on Dropbox, and Dropsync to keep the phone synxed at all times. (If there's a change on either Dropbox or the local version of the file, Dropsync will sync them within seconds.)

I also have bank accounts at 2 banks. One is on the phone. I can deposit checks using the phone, so I don't have to drive to the bank whenever I get a check. My real account is only on one desktop in the house, and the password is saved locally. Once I deposit a check in account 1, I transfer that money to bank 2. If you get into my passwords, aside from this forum, a few others, some hardware, etc., you'll be able to get into a bank account with about $10 in it. I can afford to lose $10 for the convenience.

 

[Digital Controller]

I can deposit checks using the phone, so I don't have to drive to the bank whenever I get a check.

Literally love this feature. I work two jobs and one of my jobs won't allow direct deposit so being able to get my money right into my account without having to go to a bank is awesome!

 

[Medion]

I just use Keepass (Keepass Droid on the phone, the Windows version on Windows boxen), with the database file on Dropbox, and Dropsync to keep the phone synxed at all times. (If there's a change on either Dropbox or the local version of the file, Dropsync will sync them within seconds.)

FYI, you don't need Dropsync for this if your intent is to only sync the database. If you're using Dropsync for other files, then keep it. But if all you want Dropsync for is the database, you can remove it and do the following;

-Open Dropbox on your phone.
-Navigate to the KeePass database, and tap it.
-Depending on what you have installed, it will either open with KeePass or ask which app to open with. If the latter, select KeePass.
-From there, check the box that says "use as default database and log in as usual.

From then on out, if you open KeePass, it will pull the file from the cloud, and any changes will automatically go to the cloud. This is how it worked for me when I used Dropbox, and this is how I continue to use it with Google Drive (modified version).