Master password in Firefox or Thunderbird? Do not bother • Hacker News Board

Re: Master password in Firefox or Thunderbird? Do not bother

#91

Post by palant » Sun, Mar 11, 2018, 6:42 PM UTC

kerkeslager wrote: post #48

yborg wrote: post #2

Fixing issues like this is clearly less important than implementing browser-side VR support, I don't see what Palant is on about. As a Firefox user, trading the security of any and all accounts I store passwords for in the browser is something I'd gladly exchange for ... anyway, VR is cool, right? Guess I should dump the password store and go all-in on the 1Password extension.

At least Firefox is open source and probably doesn't broadcast your passwords back to the server. 1Password is closed source and stores your passwords on a server which, should it ever be hacked, could easily cause all sorts of issues. If they received a secret order to compromise your accounts Lavabit-style, they wouldn't even have to be hacked--they might willingly backdoor their own product. I use KeePass or KeePa…

Yes, 1Password is closed source. But as far as their security design goes, they are as open as possible. In fact, I recently started looking into https://1password.com/files/1Password%20for%20Teams%20White%... to understand what choices they've made. While I don't have an overview yet, one thing for sure: their key derivation algorithm isn't built for hardware from the past century.

Storing your password database on someone else's computer might not be a bad thing if it is securely encrypted. In the end, most people have more than one device these days. If your solution is doing manual "synchronization" then the result will often turn out less secure.

Re: Master password in Firefox or Thunderbird? Do not bother

#92

Post by palant » Sun, Mar 11, 2018, 6:46 PM UTC

kerkeslager wrote: post #82

bradknowles wrote: post #50

Earlier quoted context omitted.

Sorry, you’ve got some things wrong about 1Password. Yes, they provide a cloud option where you can store your passwords on their server for synchronization purposes. But you don’t have to use it. You could just not use synchronization at all, or use a file stored on Dropbox, or iCloud, or other cloud provider of your choice. And if you use only a local file, you can still choose to sync that over the local network w…

> The 1Password authors have been pretty open about how distributed their team is, and how no one single government would be able to convince them to do those kinds of things — the other developers would find out and then the game would be over. Your options are: A. Go to jail for contempt of court, which is a crime for which you receive no due process or appeals. B. Give the control over to the government. Yes, your…

> Look, I'm sure the 1Password guys are nice, upstanding people, but implementing crypto correctly is hard, really hard. Sure, they are probably telling the truth about what algorithms they use. But did they implement them correctly? Would they tell you if they hadn't, given it would hurt their business?

I looked into a number of password managers already. So far, 1Password is the only one where I can believe that they got the crypto right (other than my own, obviously). But I'll certainly try to find flaws in their implementation. There is a nice bug bounty on those.

Re: Master password in Firefox or Thunderbird? Do not bother

#93

Post by eadmund » Sun, Mar 11, 2018, 11:50 PM UTC

omnifischer wrote: post #75

eadmund wrote: post #25

Earlier quoted context omitted.

Firefox Sync is insecure and should not be used. This didn't used to be the case — it used to be world-class — but the engineers decided to utterly destroy its security. All of your remote data is protected by whatever password you use, rather than by a high-entropy key (which means if you choose a poor password you might as well leave your data in plaintext). Worse, they use dynamically-downloaded JavaScript to hand…

'This means that any government Mozilla must obey can do the same thing.' Please do not spread FUD. This is hn. Mozilla cannot see your passwords. See the latest security audit: https://blog.mozilla.org/security/2017/07/18/web-service-aud... https://medium.com/mozilla-tech/how-firefox-sync-keeps-your-...

> Please do not spread FUD. This is hn. Mozilla cannot see your passwords.

They process your password with JavaScript they deliver to your browser; they can at any time choose to deliver different, malicious JavaScript which sends them the raw password instead.

It's not FUD; it's the honest truth. For details, see my note https://news.ycombinator.com/item?id=16565382

Re: Master password in Firefox or Thunderbird? Do not bother

#94

Post by eadmund » Sun, Mar 11, 2018, 11:57 PM UTC

omnifischer wrote: post #76

eadmund wrote: post #57

Earlier quoted context omitted.

> Can you elaborate on this? bscphil did a good job of it. They stretch the password into a key, but a 24-bits-of-entropy key still has only 24 bits of entropy, no matter how much you stretch it. Their previous system actually used properly-secure encryption keys. > I'm unsure why you think Mozilla would do this, or why you would be using Firefox at all if you expect them to push malware to your system. There's a dif…

>As for the why — I explained why afterwards. Not just Mozilla has the ability to steal your passwords: any government which can force it to comply can also snarf your passwords. As for precedent, court orders require third parties to do things all the time. I would love to see if you can prove this. Please see their latest audit: https://blog.mozilla.org/security/2017/07/18/web-service-aud... https://medium.com/mozi…

> I would love to see if you can prove this.

Go to https://accounts.firefox.com/signin and view source. Note that it loads https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98... and https://accounts-static.cdn.mozilla.net/bundle-75dd38d5a7f98....

The signin page itself may be edited at any time to point to different files, or to additional files, which load JavaScript which steals your password and sends it to Mozilla's servers. Game, set, match for your security.