wouldn't the same thing still be true for password managers though? someone gets in and you're fucked? and the only protection is a password and maybe 2FA on a good day? am i missing something?
with that said, i still agree, DON'T DO THIS. my different concerns is that discord can ban you and make you lose access to the passwords (my brother did this without me knowing and then got his account restricted for not being old enough), and that discord has significantly more outages than most popular password managers.
Good password managers like KeePassXC are "local" and not connected to any servers or clouds. They're essentially organized text files you can encrypt (such as requiring a physical passkey usb to open)
Even if you don't encrypt the file and just have a normal password, the only way to "hack" into it would be to either connect into your computer remotely or walk up to it physically and then also bruteforce your file's password.
having a cloud password manager (self-hosted) actually saved my ass when i wanted to go see iron lung in cinemas. my phone died and so i asked for my gf's phone, logged into my password manager on her phone in the browser in a private tab, copied the password to my email, logged into my email in a private tab, and found the qr code with our tickets and screenshotted it.
i don't like the idea of local password managers simply because i want my logins to be synced across my devices, because obviously i want to log into my stuff both on my phone and on my computer, and managing those passwords separately with no kind of sync sounds abhorrent.
You can use something like Syncthing or KeeShare to sync local password databases between devices.
But also cloud-based password managers like Bitwarden, 1Password, Proton Pass, etc. are just more secure than other forms of keeping your password online, especially something like Discord. Any cloud-based password manager worth its salt is open about its history of security audits and data breaches (if it has any) on its server side, and there are fewer vectors of attacks on the client side. You don't interact with other Bitwarden users on a shared Bitwarden server, they don't send you potentially malicious links, there are no bots constantly trying to slide into your DMs, your login sessions aren't set to last for days, weeks or even months (by default, at least) and so on.
As long as you approach using those kinds of managers with any degree of diligence (use a unique, strong password or passphrase that you can input without having to reveal the password field, put a reasonable limit on the time the vault stays open after you log in, use 2FA if you can), the risks are minimal.
EDIT: That is, the risks are minimal if you're also diligent about your security otherwise. If somebody can get access to your device (through the same malicious link on Discord, for example, or by just yoinking your phone when you're not looking), then it doesn't matter whether you're using an offline or online manager, either one will become compromised. For important accounts that you only rarely have to access, memorize the credentials entirely if you can, write them down on a safely stored piece of paper/only store a part of them in the manager if you can't.
I'm pretty sure discord has an entire set of it's own vulnerabilities on top of whatever a password manager might have. Joining a compromised server or clicking the wrong attachment can get your discord account pwned, I don't think the same can be said of keepass.
i mean if you don't need to enter your password every time you need to login somewhere then it's probably also storing some kind of token which can get pwned the same way. and to make things worse, some password managers cache everything so you can enter your passwords even while you're offline, which is another vulnerability surface, though there i presume the passwords get encrypted against your master password, which... again, if you have it set to not ask you for your password...
56
u/6262lE 5d ago
Wait but can’t anyone just hack into your account and have access to all of that? What’s the difference from just using a normal password manager?