Password Manager Onelogin Hacked, Exposing Sensitive Customer Data

If you use Onelogin, you need to read the article in ZDnet at http://zd.net/2rZ1pgs.

Comment: Similar weaknesses exist in all password managers and is one of the reasons why I have never used a password manager. The idea of keeping all your passwords in one place simply strikes me as a very bad idea.

Any password manager automatically becomes a single point of failure. Anyone with the know-how could potentially hack into the password manager in a manner similar to what happened to Onelogin and, as a result, can extract all of a password manager’s data. In addition, if the password’s database becomes lost or corrupted, you lose everything! There are better ways to keeping your passwords safe.

Some people keep all their passwords in one file or on one piece of paper. Doing so is undoubtedly worse than using a password manager. Once again, a single file or single piece of paper is a single point of failure and is easily compromised or lost.

In today’s world, memorizing all the required passwords is impossible. The myriad of passwords required need to be recorded, preferably not on paper. However, the requirement of recording passwords in itself is a security weakness.

I would suggest recording passwords in SEPARATE files and encrypting each file so that only you can read it. Then distribute those files in some manner that you can find them easily. I would never cluster all my passwords in one place and never record them in unencrypted form.

If passwords are recorded in files, never use a file name that has the word “passwords” in the title. Use a file title of HJTefs.abc or Cat’s medicine.enc or something similar. You need a title that will not attract attention from a hacker that accesses your computer remotely.

If you really want to keep all your passwords in a single place, at least store them in an encrypted flash drive, then have backups of that flash drive stored someplace else (not on your hard drive).

2 thoughts on “Password Manager Onelogin Hacked, Exposing Sensitive Customer Data

  1. I use KeePassX on Linux Mint which is encrypted. I don’t enter the user names there and I just keep the title as vague as possible.

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out / Change )

Twitter picture

You are commenting using your Twitter account. Log Out / Change )

Facebook photo

You are commenting using your Facebook account. Log Out / Change )

Google+ photo

You are commenting using your Google+ account. Log Out / Change )

Connecting to %s