Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Flaws in deterministic password managers

tonyarcieri.com

Post reply on HN
Print view View original

81–90 of 106 posts

Re: Flaws in deterministic password managers

#81

Post by whyagaindavid »

problems wrote: post #34
eikenberry wrote: post #28

Earlier quoted context omitted.

I'd guess he doesn't mean cached, but instead means that his web browser works with this system keyring (or has its own) to save/use the passwords.

Which is bad. I've reverse engineered script kiddie malware far too many times to find them shipping "iStealer" and similar, which basically just dump browser password stores and send them to a gmail or FTP account. Often these pieces of malware include the SMTP credentials to the same gmail account or FTP access to download the results. And having seen their results, let me just say, these script kiddies can do damn…

I thought browsers store password s encrypted. I use Firefox sync that encrypts and uploads passwords. Do u mean this is also vulnerable? Thx

Re: Flaws in deterministic password managers

#82

Post by lucaspiller »

Retr0spectrum wrote: post #39

I have an irrational(?) fear of vault password managers. I see it as a single point of failure. Furthermore, the more "useful" they become, with browser extensions etc., the greater the attack surface becomes. Because of this fear, I generate random passwords and memorise them, which is not ideal.

How many passwords do you actually remember? 10, maybe 20? What do you do for everything else?

In my password vault I have over 500 logins, each with unique password. Unless you are reusing passwords it doesn't seem feasible to have a unique password for each site (or you have a much better memory than me :D).

In terms of your fears, I remember unique passwords that aren't stored in the vault for things like my main email account and banks. Everything else goes in the vault - if it gets lost, at worse I can reset the password via email, and if it gets stolen at worse they get access to my Spotify account.

Re: Flaws in deterministic password managers

#83

Post by countingteeth »

problems wrote: post #51
tomrod wrote: post #50

Earlier quoted context omitted.

Neophyte to all this. What is a browser password store? Do you mean never letting Chrome (or whatever) save a password?

Yes. If you want to see how vulnerable you are to this sort of attack, Nirsoft ships a good tool called WebBrowserPassView: http://www.nirsoft.net/utils/web_browser_password.html Be aware, this may be detected as malware or a "hacking tool" by your AV for obvious reasons.

How is this to supposed to show "how vulnerable you are to this sort of attack"? This runs standalone.

1. As a general rule, if you download and run an untrusted standalone program, it could probably steal your passwords even if you use a password vault (although that would certainly make it a little bit harder).

2. You can just go into the Chrome password manager and click "show" to see any stored password. No tool needed.

Chrome uses sandboxing and process isolation extensively. Using the default browser password store certainly presents a ripe target if someone manages to totally own the browser, but technically there's not a huge leap from owning the browser to owning an external password store, and certainly not grabbing any and all passwords entered into the browser via a password vault.

I'm not disagreeing that a standalone password vault encrypted with a master password is effectively more secure than the built-in manager. I do think it has been exaggerated both how much more so it is. Saving strong passwords with the built-in password store is generally much less bad than, for instance, using a common memorized password, or using very weak passwords. Both of which are likely outcomes of "never use the password store."

Re: Flaws in deterministic password managers

#84

Post by countingteeth »

Gee19 wrote: post #78
hackuser wrote: post #64

Earlier quoted context omitted.

> This is only true for cloud based password managers I agree, in the sense that one successful attack on the supposed centralized database containing all user credentials would have a high ROI. But it also applies to local password managers. If 20 million people use the same password manager and I have an exploit for it, if I'm in the business of stealing data I'm likely to find a use for my exploit.

'If 20 million people use the same password manager and I have an exploit for it' Someone is going to exploit my local password manager remotely?

Yes. If you don't think so, then just tell your browser to remember your passwords and don't bother with another tool.

Re: Flaws in deterministic password managers

#86

Post by minitech »

macintux wrote: post #77
minitech wrote: post #52

I use a deterministic password generator so all I have to remember is my master password and default password scheme to get access to all my critical accounts (critical ones generally don’t have silly password requirements). If I were using something that stored passwords and lost my database somehow, I’d lose access to all of those.

"lost my database somehow" I have mine in Dropbox and at least 3 devices. I'm really not concerned I'll lose it.

If I were out of country and my laptop got stolen, for example, I’d lose it. Sure, you can use a separate password for your Dropbox/email/etc. that you remember, but that’s pretty much the same thing as generating based off a master password.

(With the exception of your master password being brute-forceable based on any password you generate, but you just use a master + KDF combo that’s unbreakable to prevent that.)

Re: Flaws in deterministic password managers

#87

Post by mhaymo »

pwinnski wrote: post #26

Today I learned that many people on Hacker News have really insecure web security practices. :( I don't understand the resistance to using a vault-based password manager. Is it inertia? I mean, if you're using the same one or two passwords on every site, then sure, it may not seem worthwhile to us 1Password. But then, enough password hashes have been leaked this year alone to suggest that you need to do something bet…

I do use a vault-based password manager (KeePass), but investigated using a deterministic one out of fear of losing my database, a risk which is avoided by using a memorable algorithm to generate passwords instead.

Re: Flaws in deterministic password managers

#88

Post by Gruselbauer »

stouset wrote: post #73
Gruselbauer wrote: post #45

Earlier quoted context omitted.

For me it was a case of thinking I know better. As in, "no way I'm giving you my passwords" and "who knows how tight their opsec is" ... never even tried anything like LastPass or 1Password until six months ago. Now I cannot imagine going back. My LastPass subscription is among the most vital services I pay for and the sheer freedom of having to remember one diceware-style master password instead of maintaining my ow…

> For me it was a case of thinking I know better. I'm deeply curious: why ? When virtually every reputable security practitioner on this site and others has echoed the advice to just use a password manager for years, how do you come to the conclusion that you know better than them? If it sounds like I'm asking judgmentally, please don't interpret it that way. Your experience mirrors that of many others, and if I can…

It's cool! I've been wondering too, since it's been an eye opener without equals finding out just how wrong I was. I think there were multiple lines of reasoning going on:

- "I don't even use that many logins." I do. I just abused 'reset password via email'.

- "I distrust the cloud provider's opsec." Seriously? I'm a self taught amateur. Get a grip guy.

- "What if they give my passwords to the NSA?" ... at this point I want to slap myself.

- "How can it be secure if it's easy to use?" I blame PGP for this one...

So I guess many things. In the end it was the usual mix of uninformed bias, weariness against third parties in security, being very wrong and the assumption that security needs terrible UX.

As I said, I never looked back. I've even sat down with friends and family, explained the concept and turned their '$catsname$birthyear' passwords they used for absolutely everything into security they wouldn't ever hope to achieve otherwise. And they're all so freaking happy, too.

For their master passwords I used the 'correct horse battery staple' approach and nobody has a problem remembering one of those, especially if it's in their native language.

So, yup, you're right in every way. I didn't know better.

Re: Flaws in deterministic password managers

#89

Post by erelde »

problems wrote: post #34
eikenberry wrote: post #28

Earlier quoted context omitted.

I'd guess he doesn't mean cached, but instead means that his web browser works with this system keyring (or has its own) to save/use the passwords.

Which is bad. I've reverse engineered script kiddie malware far too many times to find them shipping "iStealer" and similar, which basically just dump browser password stores and send them to a gmail or FTP account. Often these pieces of malware include the SMTP credentials to the same gmail account or FTP access to download the results. And having seen their results, let me just say, these script kiddies can do damn…

If only my bank allowed passwords...

Shame, Société Générale, shame.

Re: Flaws in deterministic password managers

#90

Post by OskarS »

stouset wrote: post #73
Gruselbauer wrote: post #45

Earlier quoted context omitted.

For me it was a case of thinking I know better. As in, "no way I'm giving you my passwords" and "who knows how tight their opsec is" ... never even tried anything like LastPass or 1Password until six months ago. Now I cannot imagine going back. My LastPass subscription is among the most vital services I pay for and the sheer freedom of having to remember one diceware-style master password instead of maintaining my ow…

> For me it was a case of thinking I know better. I'm deeply curious: why ? When virtually every reputable security practitioner on this site and others has echoed the advice to just use a password manager for years, how do you come to the conclusion that you know better than them? If it sounds like I'm asking judgmentally, please don't interpret it that way. Your experience mirrors that of many others, and if I can…

I think the reason is that it just feels insecure. If you keep all your passwords in your head, then you have full control. Using a password manager means handing them off to something else, whether it is a paid service, a piece of software, or whatever. It feels like a "cat's out of the bag situation", that once you let the password escape that first container (your mind), it will inevitably spread everywhere.

I'm not saying it's rational (I'm a happy customer of 1password), but there is something a little bit scary about letting go of control of your passwords.

Post reply on HN