How can we quantify the trade-off between password aggregation and convenience?
Password managers such as lastpass are convenient, but aggregation of passwords into a common store may reduce security. How do we evaluate the trade off between convenience and security? How much risk arises from password aggregation? How can we compare convenience and risk.
How much risk arises from password aggregation?
This is a difficult measure to quantify. Certainly, if the cryptography protecting your password store is poor, or in the case of a cloud-based tool their host system security is poor and their storage scheme allows an attacker to recover your password database, then all password data is freely available to the attacker and you have a near-100% compromise of everything stored there.
However, life is not necessarily that straightforward. There are two really important factors to consider:
What is the likely behaviour for yourself or other users if you do not have the convenience of a password manager? With a password manager you have no excuse to use anything but high entropy passwords. However, if you are required to remember all your passwords you will hit upon the human-brain-storage limit pretty quickly and find yourself using correct horse battery staple 1 for everything, adding a different number each time.
In this case, a password leak may give a persistent nuisance the chance to evaluate how you generate your passwords (badly, most likely. I'm as guilty as the next for this) and therefore probably log in to a great number of accounts.
How do we evaluate the trade off between convenience and security?
I think I have answered the how above, but I'd like to add an additional consideration into the mix: it depends on what you are storing in your aggregated password safe. Despite the emergence of technologies like OpenID, almost every site wants an email address and password from you - the motivating reason behind this discussion.
That does not mean that all such accounts are created equal - indeed, 99.99% of "stuff" users register for online they don't actually care about one hoot, a statistic I made up just now. So on this basis, such a user would probably be well served splitting their accounts into three types:
On this basis, you could decide that the risk of storing your most risky stuff in a password manager is too great (and you can expend some of that precious human memory stuff on memorising a difficult to remember password and turning on two factor auth), so you don't do it.
You could then decide which, if any, of the socially identifying sites pose the biggest threat and optionally not include these.
Finally, all the junk sites that seemingly want you to create an account can have a randomly generated password of sufficient length.
Evaluating password managers themselves is a much more difficult proposition. I'd fit them into two categories:
Desktop. This benefits from the security advantage of being (mostly) not directly available all of the time which also adds to the inconvenience. You may be able to evaluate the cryptographic on disk algorithms used, but above all else like any encrypted data unless you protect the physical target and ensure the virtual target is malware free, you put your data at risk.
In addition, in a desktop-based solution it would be possible to harvest the entire database, something that is not so easy from a secure cloud based solution.
As I say, cloud based service evaluation is a hard one to do and each type of manager has their advantages and disadvantages. This really boils down to deciding what risks you wish to accept and the level of convenience you desire.
Hopefully, however, this is food for thought.
IMHO, its a question of trust. Cloud based services, or 3rd party services like LastPass are owned, managed, run, secured by a 3rd party who you can not audit the code nor the processes. Local application installations, like KeePass, can either be open-source or commercial software which you may have the full range of insight into ownership -> code auditability (if it is open sourced) or some subset - but you at least have some auditability.
In addition to the general "trust", I also come from the alien-landing, tin-foil wearing, highly paranoid crowd (having worked with government programs on several occasions) and know that 3rd parties are not bound to inform you when another 3rd party (say the government) is granted legal access to your information via the court system. So I tend to prefer to own my own destiny, trust aside.
This is a very simple question, which has no easy answer.
The biggest issue with applications like LastPass is that they are cloud based, and not only add a new single point if failure, but also adds additional risks in case there is a breach of the service provider (as happened to LastPass in May 2011). Though with this extra risk, comes a lot of extra convenience.
Other tools, such as KeePass, have a very different attack surface thanks to not having a cloud service. Though users often add extra risk by syncing data files over services like Dropbox.
It's all about trade offs - like most other things in this field, it's all risk management. Have to determine what risks you are willing to accept.
