Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flaws in deterministic password managers

tonyarcieri.com

Post reply on HN
Print view View original

41–50 of 106 posts

Re: Flaws in deterministic password managers

#41

Post by problems »

acomar wrote: post #38
problems wrote: post #34

Earlier quoted context omitted.

Which is bad. I've reverse engineered script kiddie malware far too many times to find them shipping "iStealer" and similar, which basically just dump browser password stores and send them to a gmail or FTP account. Often these pieces of malware include the SMTP credentials to the same gmail account or FTP access to download the results. And having seen their results, let me just say, these script kiddies can do damn…

Wait, KeePass only decrypts the database into memory for a particular process, right? So it would take an exploit of some kind to read the memory holding the decrypted database?

No, it wouldn't take an exploit, it just takes a process running as an administrator, maybe even as the same user if the attacker is clever.

There's several ways to go about it:

1) Basic basic software keylogger, there are some mitigations against this via common APIs though with mixed success. It also would mean a lot of data to filter through. Not fun for someone just looking to grab as many passwords as they can.

2) Dump memory, just save the entire memory of the keepass process via ReadProcessMemory calls, as long as you have sufficient privileges this should be possible. The passwords are in there, KeePass has no memory shadowing support to my knowledge at least. And once you've logged in to keepass you don't get prompted for the password again, therefore, it should be entirely possible to read all passwords based on just this.

3) Replace the keepass executable with your own modified version that logs the password or other auth credentails to disk, or just dumps the database to disk on logon if they're using some esoteric authentication method like Yubikey. This involves shipping your own patched exe around though, which works, but isn't particularly clever, could be fairly large and will be revealed with a signature check.

4) Do the same, but rather than replacing it on disk, do it in memory - do it from a shared library or inject your own code via WriteProcessMemory/CreateRemoteThread, etc. This is usually less detectable. Doesn't matter if the executable is signed this way either, you bypass the signature system and can avoid the need for disk write permissions too. This is the way to get the brownie points.

Any and all of these are fairly trivial to someone who knows their way around the Windows API and has a copy of the Keepass source and IDA. However, none of these are things commonly used by script kiddies going for a hit-and-run operation. All of these however are on the table in a targeted attack with even a slightly competent attacker.

Re: Flaws in deterministic password managers

#42

Post by the_af »

dvdkon wrote: post #36
pavel_lishin wrote: post #24

Earlier quoted context omitted.

> Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws. If the Deterministic Password Generator does not generate a valid password for a given site, it's certainly a fatal flaw for that site, and a usability nightmare - now I have to remember which sites aren't supported and keep a vault anyway. And I guess point 2 isn't a fatal flaw until…

We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious security vulnerability and nothing less. You seem to have a more relaxed view, accepting things that create a bad user experience as fatal flaws, too.

Regardless of whether it's "fatal" or not, usability is crucial. If it's impractical or impossible to use in common scenarios, that's a huge flaw.

Re: Flaws in deterministic password managers

#43

Post by bascule »

dvdkon wrote: post #36
pavel_lishin wrote: post #24

Earlier quoted context omitted.

> Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws. If the Deterministic Password Generator does not generate a valid password for a given site, it's certainly a fatal flaw for that site, and a usability nightmare - now I have to remember which sites aren't supported and keep a vault anyway. And I guess point 2 isn't a fatal flaw until…

We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious security vulnerability and nothing less. You seem to have a more relaxed view, accepting things that create a bad user experience as fatal flaws, too.

Security isn't an end in and of itself, it's a means to an end. A tool which delivers on security but isn't usable still fails to fulfill its purpose, in the same way an unplugged computer is both secure and useless.

I know there's a group within the security community willing to tolerate poor user experiences, or wear them as a badge of honor, "the price of security" or so to speak. But often I find these are the same people scratching their heads wondering why OpenPGP encrypted email hasn't seen more widespread adoption, or why the Web of Trust failed (or perhaps they think it succeeded), while at the same time bemoaning successful encrypted chat systems like WhatsApp and Signal.

I would argue that user experience is just as important a consideration as the security properties of a tool.

Re: Flaws in deterministic password managers

#44

Post by lemoncucumber »

dvdkon wrote: post #36
pavel_lishin wrote: post #24

Earlier quoted context omitted.

> Sure, those things make a truly stateless password manager harder to use and a very niche tool, but they're by no means fatal flaws. If the Deterministic Password Generator does not generate a valid password for a given site, it's certainly a fatal flaw for that site, and a usability nightmare - now I have to remember which sites aren't supported and keep a vault anyway. And I guess point 2 isn't a fatal flaw until…

We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious security vulnerability and nothing less. You seem to have a more relaxed view, accepting things that create a bad user experience as fatal flaws, too.

"Bad user experience" implies it's still usable but inconvenient, but in fact it's completely unusable if it can't handle passwords for arbitrary sites. You might as well say that having a password manager that can only store one password is a "bad user experience."

Re: Flaws in deterministic password managers

#45

Post by Gruselbauer »

pwinnski wrote: post #26

Today I learned that many people on Hacker News have really insecure web security practices. :( I don't understand the resistance to using a vault-based password manager. Is it inertia? I mean, if you're using the same one or two passwords on every site, then sure, it may not seem worthwhile to us 1Password. But then, enough password hashes have been leaked this year alone to suggest that you need to do something bet…

For me it was a case of thinking I know better. As in, "no way I'm giving you my passwords" and "who knows how tight their opsec is" ... never even tried anything like LastPass or 1Password until six months ago.

Now I cannot imagine going back. My LastPass subscription is among the most vital services I pay for and the sheer freedom of having to remember one diceware-style master password instead of maintaining my own local database is just too nice.

I'm using banking software with a HBCI card and have set reasonable limits on all things like PayPal. So if you cracked my LastPass vault - good luck with that, 2FA considered - you'd be well able to ruin my digital life. But you would not get much out of it.

The attack surface I offer in total has shrunk a lot, too. Unique, maximum allowed length passwords for every unimportant little account and no need to memorise a single one.

It's to Web logins what pubkey auth is to ssh for me personally. Just such a freaking blessing.

Re: Flaws in deterministic password managers

#46

Post by Scaevolus »

Another flaw: deterministic password managers are inherently vulnerable to brute forcing-- it's basically like sending your password database to every site you log into. Ideally they use a very expensive KDF, but I've seen implementations that use weak derivations like 10,000 round PBKDF2.

Re: Flaws in deterministic password managers

#47

Post by Gruselbauer »

bascule wrote: post #43
dvdkon wrote: post #36

Earlier quoted context omitted.

We both seem to have a different view of what a "fatal flaw" is. For me (especially when talking about a computer security tool), it means a very serious security vulnerability and nothing less. You seem to have a more relaxed view, accepting things that create a bad user experience as fatal flaws, too.

Security isn't an end in and of itself, it's a means to an end. A tool which delivers on security but isn't usable still fails to fulfill its purpose, in the same way an unplugged computer is both secure and useless. I know there's a group within the security community willing to tolerate poor user experiences, or wear them as a badge of honor, "the price of security" or so to speak. But often I find these are the sa…

I couldn't agree more. Getting smart but non-nerd friends set up with OpenPGP is truly an eye opener. The rate of adoption is terrible because of that and nothing else.

Even with a GUI like Enigmail, I needed hour long explainathons to make it work for these friends. Smart, borderline brilliant folk.

The same people now use WhatsApp with encryption and don't even know it. That's what a good crypto UX looks like.

I'd love for a google-free, proprietary-free, facebook-free alternative to exist but if the alternative is painful hours of setting up encrypted mail only to have it cease working after two weeks because the user forgot their passphrase, I'm gonna say I don't care too much.

Re: Flaws in deterministic password managers

#49

Post by ythn »

eridius wrote: post #19
ythn wrote: post #12

Earlier quoted context omitted.

I too am interested to see how long it takes assuming the attacker knows the generator ruleset (which he will have had to work out previously from two plaintext passwords of mine). Still, I don't think it's that easy to figure out the ruleset of a good password generator if you make it obscure enough. For example: Amazon: NovemberAlphaies12# Facebook: KiloFoxtrototto16& What's the ruleset? Answer: Phoenic alphabet of…

What do you mean by "integer sum of the digits on either side of each digit in the Italian number"? Your italian number is a word, not a sequence of digits. It looks to me like that number is really just the number of letters in the domain multiplied by 2. And the rest of that password scheme is actually rather trivial to deduce (assuming you can recognize italian numbers).

It's a word that represents a series of digits. "Otto" represents 8, tredici represents 13, etc

Re: Flaws in deterministic password managers

#50

Post by tomrod »

problems wrote: post #34
eikenberry wrote: post #28

Earlier quoted context omitted.

I'd guess he doesn't mean cached, but instead means that his web browser works with this system keyring (or has its own) to save/use the passwords.

Which is bad. I've reverse engineered script kiddie malware far too many times to find them shipping "iStealer" and similar, which basically just dump browser password stores and send them to a gmail or FTP account. Often these pieces of malware include the SMTP credentials to the same gmail account or FTP access to download the results. And having seen their results, let me just say, these script kiddies can do damn…

Neophyte to all this. What is a browser password store? Do you mean never letting Chrome (or whatever) save a password?
Post reply on HN