Are Those Mobile Password/Wallet Apps Safe?

[PowerRanger]

Hi all, I have a question regarding those password keeper apps, and "wallet" apps. Are these kind of apps safe? I mean, what's to stop the app author from making a background process that can send all your passwords and info back to them? :ninja:

 

[xplosiveone]

Just use keepass which is opensource.

Sent from my Transformer TF101 using Tapatalk

 

[destrekor]

I use Lastpass, which uses local encryption/decryption to make passwords pretty much impossible to grab from the vault. Of course, there's still the main password itself, the one that decrypts your other passwords.

Though honestly, I don't know if the mobile version has local en/decrypt like the PC browser version.

Also, using Lastpass Mobile requires a $14/yr subscription.

 

[tdawg]

Just use keepass which is opensource.

Sent from my Transformer TF101 using Tapatalk

Seconded.

 

[Red Storm]

Nothing beats storing them in the old noggin... except forgetting them. Thankfully, I haven't had that happen yet.

 

[Slinkwyde]

Nothing beats storing them in the old noggin... except forgetting them. Thankfully, I haven't had that happen yet.

I disagree. Passwords should be long, random, and completely unique from site-to-site. Doing what you suggests leads to weak and/or less unique passwords. It's better to store your (strong and unique) passwords in a well-encrypted location, preferably one that you can securely access whenever, wherever, and however you need it.

 

[Slinkwyde]

I use Lastpass, which uses local encryption/decryption to make passwords pretty much impossible to grab from the vault. Of course, there's still the main password itself, the one that decrypts your other passwords.

Though honestly, I don't know if the mobile version has local en/decrypt like the PC browser version. [...].

I use LastPass too, and I was almost certain that it was true. I asked the support team to be sure, and this was the reply:

The answer is yes. All decryption and encryption is done locally on the phone or mobile device. The same goes for any computer you login to. If someone asks why they are able to view their sites on the website from any computer, it's because the decryption encryption is all done locally on the browser page using javascript. Let us know if you have any other questions or problems we can help with.

Best,
Alex

I've really come to like LastPass. The security of the overall system seems well done, the customer support is good, and I can access my stuff on any browser (extension or website) or mobile device I'd encounter- online or offline. Several forms of multi-factor authentication. The downsides are that it isn't 100% open-source like Keepass (but you can view source on the Chrome and Safari extensions, and the JavaScript on the website) and they haven't yet completed an audit by an independent party. Still, their reputation seems strong and their entire business depends on that.

 

[dagamer34]

Hi all, I have a question regarding those password keeper apps, and "wallet" apps. Are these kind of apps safe? I mean, what's to stop the app author from making a background process that can send all your passwords and info back to them? :ninja:

They'd all get thrown in jail for a very very long time.