A lot of password managers seems to promote client-side encryption as a key feat

Question

A lot of password managers seems to promote client-side encryption as a key feature of their service. For example : LastPass, Firefox Sync, PasswordBox, etc...

They all say something like

Even we don't know your master password and cannot decrypt your data, hence it is more secure.

Making the user think that it protects him against the password manager he is using.

But, in reality, they control the code that does the encryption on the client side and can change it whenever they want to instead do the encryption on the server and you would not notice anything.

So, does it add any security?

Explanation / Answer

Client-side encryption does not protect against a malicious trusted application provider who decides to subvert their own system.

It does protect against attackers who breach the central store. Those people cannot decrypt without keys, and if the provider doesn't have the keys (the key feature (sic) described above), then the attacker can't steal those in the same manner. They'd have to compromise both the central store and the user endpoint(s), making a compromise of your data that much harder.

So does it really add security? Yes. Not for every use case, but for the use cases that realistically are a greater threat and a higher likelihood.

Related Questions

Navigate

• Browse (All)
• Browse A
• Subjects

Integrity-first tutoring: explanations and feedback only — we do not complete graded work. Learn more.