In most cases, when a company is storing encrypted data, they also need to be able to decrypt<\/em> that data themselves, so that they can use the data when needed. So the decryption keys must be accessible in some way by systems (and sometimes people) at the company. And that is where the security often fails. In the major data breaches that you\u2019ve heard about, what has generally been the case is that the decryption keys were stored in some way that was itself insecure, or the attackers were able to access an application that has access to the keys. The details vary, but the result is typically that the attacker is able to download the encrypted data and<\/em> access the decryption keys, thereby allowing them to simply decrypt the data.<\/p>\n Now back to our discussion of password manager software specifically. The details vary by provider, but many password managers (including Bitwarden or 1Password) use what is known as zero-knowledge architecture<\/strong>. The idea of zero-knowledge architecture is that the password manager provider itself never has your master password, the key necessary to decrypt your data, or a decrypted version of your usernames, passwords, etc. Your encrypted vault is stored on their servers, and when the vault needs to be decrypted (in order for you to access saved information) that decryption happens entirely on your<\/em> device. Your device uses your master password to derive the decryption key and then uses that decryption key to decrypt the requested data. To reiterate: with zero-knowledge architecture, the password manager provider never has your master password, the decryption key, or a decrypted version of your vault.<\/p>\n What this means is that, if your password manager is using zero-knowledge architecture with strong encryption practices, and you are using a strong master password, then even if an attacker were able to breach the password manager\u2019s servers and download your encrypted vault, they would almost certainly not be able to decrypt the information. There\u2019s a fundamental difference here between this sort of setup and a setup in which the company is saving not only your encrypted data but also the means to decrypt that data.<\/p>\n Of course, it would still be preferable for your password manager provider not<\/em> to be hacked at any point. And if you ever learn that your password manager provider has<\/em> suffered a breach involving customer vaults, you should promptly change the passwords of your most important accounts, and then change the remaining passwords as soon as practical. But if you and your password manager are both following best practices, you don\u2019t need to worry that a data breach would mean that an attacker would immediately have access to all of your passwords.<\/p>\n There are also options for offline password managers. For instance, KeePassXC is a dedicated offline password manager. Alternatively, Bitwarden can be self-hosted on your own server. In these cases, your vault would not be stored on the vendor\u2019s servers and thus would not be accessible at all if the vendor\u2019s servers were breached. One downside is that syncing your passwords across devices or sharing with other family members becomes something you must set up and manage yourself. Also, now you<\/em> would be fully responsible for security (including backups and other security-related policies). Whether that\u2019s a good thing or a bad thing depends on your skills and how much time you want to spend on the endeavor.<\/p>\n Finally, on the topic of password manager breaches, we have to talk about LastPass. In 2022, LastPass was the subject of a major breach. In addition to being breached, it became clear that they were not following certain other best practices. For one, they were not encrypting the URLs of the websites for which users were saving usernames and passwords. That made it easier for the attacker to pick specific vaults to target for brute-force decryption attacks. (Specifically, the attacker appears to have gone after vaults that had cryptocurrency assets.) Secondly, the vaults of LastPass users with older accounts were not as securely encrypted as they should have been. In 2018, LastPass had upgraded its default for new users, but older users were still on older encryption policies unless they explicitly adjusted the setting themselves<\/a>. That made it easier for the attacker to effectively use brute-force attacks on customer vaults. (Weaker encryption settings meant that the attacker could make many more password guesses per second against those vaults.) We know that some people did<\/em> have money stolen as a result<\/a>. Finally, LastPass customers were not informed that their encrypted vaults had been accessed until months after it had occurred<\/a>. A more timely notification could have allowed customers to update all of their passwords promptly and avoid any actual losses. For the above reasons, many experts in the field simply no longer feel comfortable using or recommending LastPass. Regardless, the event illustrates the importance of a password manager provider following best practices.<\/p>\n Read the answers to this question and several other Social Security questions in my latest book:<\/p>\nWhat is the Best Age to Claim Social Security?<\/h3>\n
\n
\n ![\"\"](\"https:\/\/www.obliviousinvestor.com\/wp-content\/uploads\/2014\/04\/NewBook8CoverTiltedScaled2.png\" "\\"Book8FrontCovertilted150x200\\"")
<\/a><\/td>\nSocial Security Made Simple: Social Security Retirement Benefits and Related Planning Topics Explained in 100 Pages or Less<\/strong><\/em>\n