Oblivious Investor

Password manager providers are naturally attractive targets for hackers. So a critical question to ask is: what happens if an attacker manages to access the servers of the company that provides your password manager software? And the answer to that question will depend on both your own practices as well as the policies and practices of the password manager provider.

Here it’s worth backing up a step and looking at historical security breaches in general. For instance, there have been many cases in which some company (e.g., an insurance company, a credit bureau, a hospital system, or a large retailer) gets hacked, and the attacker is ultimately able to access customer/patient information, such as contact info and Social Security numbers.

But wouldn’t that data have been encrypted on the company’s servers? In other words, even if the attacker was able to download the data, why weren’t they stuck with unusable encrypted data? Sadly, in some cases, the answer is that no, the data in fact was not encrypted on the company’s servers. But even in many cases in which the data was encrypted, the attacker was ultimately able to decrypt the data. Generally, that’s not because the attacker was able to defeat the encryption. (Modern best-practice encryption is quite secure.) Rather, the explanation is a simpler one: the attacker was able to access the decryption keys.

In most cases, when a company is storing encrypted data, they also need to be able to decrypt that data themselves, so that they can use the data when needed. So the decryption keys must be accessible in some way by systems (and sometimes people) at the company. And that is where the security often fails. In the major data breaches that you’ve heard about, what has generally been the case is that the decryption keys were stored in some way that was itself insecure, or the attackers were able to access an application that has access to the keys. The details vary, but the result is typically that the attacker is able to download the encrypted data and access the decryption keys, thereby allowing them to simply decrypt the data.

Now back to our discussion of password manager software specifically. The details vary by provider, but many password managers (including Bitwarden or 1Password) use what is known as zero-knowledge architecture. The idea of zero-knowledge architecture is that the password manager provider itself never has your master password, the key necessary to decrypt your data, or a decrypted version of your usernames, passwords, etc. Your encrypted vault is stored on their servers, and when the vault needs to be decrypted (in order for you to access saved information) that decryption happens entirely on your device. Your device uses your master password to derive the decryption key and then uses that decryption key to decrypt the requested data. To reiterate: with zero-knowledge architecture, the password manager provider never has your master password, the decryption key, or a decrypted version of your vault.

What this means is that, if your password manager is using zero-knowledge architecture with strong encryption practices, and you are using a strong master password, then even if an attacker were able to breach the password manager’s servers and download your encrypted vault, they would almost certainly not be able to decrypt the information. There’s a fundamental difference here between this sort of setup and a setup in which the company is saving not only your encrypted data but also the means to decrypt that data.

Of course, it would still be preferable for your password manager provider not to be hacked at any point. And if you ever learn that your password manager provider has suffered a breach involving customer vaults, you should promptly change the passwords of your most important accounts, and then change the remaining passwords as soon as practical. But if you and your password manager are both following best practices, you don’t need to worry that a data breach would mean that an attacker would immediately have access to all of your passwords.

There are also options for offline password managers. For instance, KeePassXC is a dedicated offline password manager. Alternatively, Bitwarden can be self-hosted on your own server. In these cases, your vault would not be stored on the vendor’s servers and thus would not be accessible at all if the vendor’s servers were breached. One downside is that syncing your passwords across devices or sharing with other family members becomes something you must set up and manage yourself. Also, now you would be fully responsible for security (including backups and other security-related policies). Whether that’s a good thing or a bad thing depends on your skills and how much time you want to spend on the endeavor.

Finally, on the topic of password manager breaches, we have to talk about LastPass. In 2022, LastPass was the subject of a major breach. In addition to being breached, it became clear that they were not following certain other best practices. For one, they were not encrypting the URLs of the websites for which users were saving usernames and passwords. That made it easier for the attacker to pick specific vaults to target for brute-force decryption attacks. (Specifically, the attacker appears to have gone after vaults that had cryptocurrency assets.) Secondly, the vaults of LastPass users with older accounts were not as securely encrypted as they should have been. In 2018, LastPass had upgraded its default for new users, but older users were still on older encryption policies unless they explicitly adjusted the setting themselves. That made it easier for the attacker to effectively use brute-force attacks on customer vaults. (Weaker encryption settings meant that the attacker could make many more password guesses per second against those vaults.) We know that some people did have money stolen as a result. Finally, LastPass customers were not informed that their encrypted vaults had been accessed until months after it had occurred. A more timely notification could have allowed customers to update all of their passwords promptly and avoid any actual losses. For the above reasons, many experts in the field simply no longer feel comfortable using or recommending LastPass. Regardless, the event illustrates the importance of a password manager provider following best practices.

Among people who read personal finance books, many save a high percentage of their income through most of their careers. One thing that eventually happens for some such people is that they reach a point at which they realize they have not only saved "enough," they have saved "more than enough." Their desired standard of living in retirement is well secured, and it’s likely that a major part of the portfolio is eventually going to be left to loved ones and/or charity. And that realization raises a whole list of new questions and concerns.

This book’s goal is to help you answer those questions.