Been chewing on this and can't shake it.
So you've got KeePass/Bitwarden/1Password, the vault's encrypted on disk, seems fine. But the moment you unlock it, the decrypted copy sits in RAM right next to whatever process wants to reach for it. And even the encrypted version can be read by anyone with disk access - all they need is the master password.
So basically the entire security model rests on one assumption: that nothing malicious is present in the system at the moment of unlock. Catch a stealer with a keylogger and that's it - vault and master password both gone in one shot, with zero visible signs of compromise.
Do you actually think a software vault protects you, or is it just the only option and everyone's made peace with it? Anyone here manage passwords without a manager on principle? Anyone tried hardware tokens like Yubikey not just for 2FA but as an actual password replacement?
Curious how people are solving this gap for themselves, or if everyone's just fine living with it.
So you've got KeePass/Bitwarden/1Password, the vault's encrypted on disk, seems fine. But the moment you unlock it, the decrypted copy sits in RAM right next to whatever process wants to reach for it. And even the encrypted version can be read by anyone with disk access - all they need is the master password.
So basically the entire security model rests on one assumption: that nothing malicious is present in the system at the moment of unlock. Catch a stealer with a keylogger and that's it - vault and master password both gone in one shot, with zero visible signs of compromise.
Do you actually think a software vault protects you, or is it just the only option and everyone's made peace with it? Anyone here manage passwords without a manager on principle? Anyone tried hardware tokens like Yubikey not just for 2FA but as an actual password replacement?
Curious how people are solving this gap for themselves, or if everyone's just fine living with it.