Backdoored password manager stole data from as many as 29K enterprises • Hacker News Board

Re: Backdoored password manager stole data from as many as 29K enterprises

#41

Post by tediousdemise » Sun, Apr 25, 2021, 1:47 AM UTC

scrollaway wrote: post #28

tediousdemise wrote: post #15

The best password manager is your own salting algorithm and memory.

No, it is not. You want to back up your comment with some actual convincing arguments that human memory is better than the plethora of tools 1password offers? I know you won't because although it makes for a nice, witty comment on HN, it's such an absurd thing to actually consider at face value. Truly random, unique passwords for each website. OTP support and backups. Sharing with audit trails for teams. Encrypted fi…

I don’t need convincing arguments. A software password manager is a single point of failure, as the story demonstrates. It’s a dangerous external dependency with alluring convenience.

Until mind reading becomes reality, nothing will ever be as secure as human memory.

Re: Backdoored password manager stole data from as many as 29K enterprises

#42

Post by cryptica » Sun, Apr 25, 2021, 1:52 AM UTC

scrollaway wrote: post #38

cryptica wrote: post #34

Earlier quoted context omitted.

Of course security folks who stand to profit from selling these password management solutions will insist that these solutions are important... After all, like you say, their whole career depends on selling 'security products' to companies and individuals. This kind of argument would never stand up in court because of conflict of interests. About the edit, the meaning of my comment hasn't changed. I just removed the…

> But it's good that expanding my reasoning has led you to reconsider the validity of your argument. What I meant is that my first sentence, which references something you removed from your original comment, sounds very out of context now. And no, none of the folks I'm thinking of actually make money from password management solutions. Your comment sounds the same as "of course all those doctors would recommend getti…

>> And no, none of the folks I'm thinking of actually make money from password management solutions.

Not directly, but maybe their peers do. If your buddy works at Facebook, you're not going to say bad things about Facebook's business. It also applies to some extent if it's your friend's friend; group-think is a powerful effect.

>> Your comment sounds the same as "of course all those doctors would recommend getting vaccinated since they make a profit from selling you the vaccines".

Well of course that's a factor to consider. The medical industry is not immune to ulterior motives. For example, doctors have been known for over-prescribing opioids and many people actually died as a result. I'm pretty sure all these doctors thought they were doing the right thing; all their colleagues were also prescribing the same drugs.

Also many drugs which received FDA approval were later found to be unsafe, caused birth defects, deaths etc... It's foolish to suggest that anything is 100% safe and ulterior motives will certainly have a negative effect on safety.

Re: Backdoored password manager stole data from as many as 29K enterprises

#43

Post by scrollaway » Sun, Apr 25, 2021, 1:55 AM UTC

cryptica wrote: post #42

scrollaway wrote: post #38

Earlier quoted context omitted.

> But it's good that expanding my reasoning has led you to reconsider the validity of your argument. What I meant is that my first sentence, which references something you removed from your original comment, sounds very out of context now. And no, none of the folks I'm thinking of actually make money from password management solutions. Your comment sounds the same as "of course all those doctors would recommend getti…

>> And no, none of the folks I'm thinking of actually make money from password management solutions. Not directly, but maybe their peers do. If your buddy works at Facebook, you're not going to say bad things about Facebook's business. It also applies to some extent if it's your friend's friend; group-think is a powerful effect. >> Your comment sounds the same as "of course all those doctors would recommend getting v…

I have several buddies who work at Facebook and i think Facebook is evil and one of the worst companies to work for in tech. They know my stance on it, now you do too, and I've disproven your opening argument.

I didn't mention opioids did i? I'm going to ignore further comments from you in this thread because this has all the hallmarks of a bad faith discussion. Assuming that's not your intention, maybe do some introspection on why that is.

Re: Backdoored password manager stole data from as many as 29K enterprises

#44

Post by tediousdemise » Sun, Apr 25, 2021, 1:55 AM UTC

cj wrote: post #22

tediousdemise wrote: post #15

The best password manager is your own salting algorithm and memory.

> your own salting algorithm This can be an OK strategy as long as your salting algorithm is not easy enough to figure out by looking at a few password breaches that you (now or in the future) are exposed by. It can work if you’re smart about the algorithm, but if someone can guess your algorithm by looking at a few leaked passwords, it can provide a false sense of security.

That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure.

The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.

Re: Backdoored password manager stole data from as many as 29K enterprises

#45

Post by scrollaway » Sun, Apr 25, 2021, 2:01 AM UTC

tediousdemise wrote: post #41

scrollaway wrote: post #28

Earlier quoted context omitted.

No, it is not. You want to back up your comment with some actual convincing arguments that human memory is better than the plethora of tools 1password offers? I know you won't because although it makes for a nice, witty comment on HN, it's such an absurd thing to actually consider at face value. Truly random, unique passwords for each website. OTP support and backups. Sharing with audit trails for teams. Encrypted fi…

I don’t need convincing arguments. A software password manager is a single point of failure, as the story demonstrates. It’s a dangerous external dependency with alluring convenience. Until mind reading becomes reality, nothing will ever be as secure as human memory.

And your mind, or whatever algorithm you came up with, isn't a single point of failure?

You will never be one thousandth as good at securing hundreds of password as the most robust tools we have today. You may be good at remembering a couple of long, random passphrases. You can use those as a master password / encryption key.

The software mentioned in the article is not a particularly good or trustworthy password manager, so no it doesn't make sense to put it in the same lot as the actually-good ones.

Or to put it another way, if I come up with a crappy off brand version control software and backdoor it, that doesn't reflect badly on VCS, it reflects badly on me.

Re: Backdoored password manager stole data from as many as 29K enterprises

#46

Post by scrollaway » Sun, Apr 25, 2021, 2:14 AM UTC

cryptica wrote: post #37

StavrosK wrote: post #20

Earlier quoted context omitted.

Do you simply remember hundreds of random passwords?

It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.

Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault.

In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will likely come up with "a rule", and then if I get a couple of example numbers (in a "password leak"), i can probably figure it out. The numbers are no longer secret, it's the rule that is.

Re: Backdoored password manager stole data from as many as 29K enterprises

#47

Post by tediousdemise » Sun, Apr 25, 2021, 2:16 AM UTC

scrollaway wrote: post #45

tediousdemise wrote: post #41

Earlier quoted context omitted.

I don’t need convincing arguments. A software password manager is a single point of failure, as the story demonstrates. It’s a dangerous external dependency with alluring convenience. Until mind reading becomes reality, nothing will ever be as secure as human memory.

And your mind, or whatever algorithm you came up with, isn't a single point of failure? You will never be one thousandth as good at securing hundreds of password as the most robust tools we have today. You may be good at remembering a couple of long, random passphrases. You can use those as a master password / encryption key. The software mentioned in the article is not a particularly good or trustworthy password man…

I admit that there might be password managers out there that provide sufficient security for some users’ threat models, but I wouldn’t trust such a sensitive compilation of data on any computing system, especially ones with network access.

If I used a password manager, it would have to be on an airgapped and password protected system, making it essentially useless for me. For me, it’s easier to memorize a password/salting algorithm that generates unique passwords to the website or service I’m using, so that I don’t have to actually memorize any passwords—only the algorithm.

Re: Backdoored password manager stole data from as many as 29K enterprises

#48

Post by scrollaway » Sun, Apr 25, 2021, 2:22 AM UTC

tediousdemise wrote: post #44

cj wrote: post #22

Earlier quoted context omitted.

> your own salting algorithm This can be an OK strategy as long as your salting algorithm is not easy enough to figure out by looking at a few password breaches that you (now or in the future) are exposed by. It can work if you’re smart about the algorithm, but if someone can guess your algorithm by looking at a few leaked passwords, it can provide a false sense of security.

That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure. The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.

It doesn't have to be a black box. There are open source password managers. Bitwarden and Keepassxc are two very good ones.

And keep in mind that even if you can create a reasonably strong algorithm which will both be memorable and resistant to reverse engineering, most people won't. Password managers aren't just good for professionals, they're leagues ahead of anything "mere mortals" use. My mom uses 1password -- that's not a slight, I mean that literally; I put her on my family plan.

Re: Backdoored password manager stole data from as many as 29K enterprises

#49

Post by scrollaway » Sun, Apr 25, 2021, 2:27 AM UTC

tediousdemise wrote: post #47

scrollaway wrote: post #45

Earlier quoted context omitted.

And your mind, or whatever algorithm you came up with, isn't a single point of failure? You will never be one thousandth as good at securing hundreds of password as the most robust tools we have today. You may be good at remembering a couple of long, random passphrases. You can use those as a master password / encryption key. The software mentioned in the article is not a particularly good or trustworthy password man…

I admit that there might be password managers out there that provide sufficient security for some users’ threat models, but I wouldn’t trust such a sensitive compilation of data on any computing system, especially ones with network access. If I used a password manager, it would have to be on an airgapped and password protected system, making it essentially useless for me. For me, it’s easier to memorize a password/sa…

This is a common take on password managers but in practice it doesn't really hold, because humans are bad at security and good password managers are really fucking good at it. That's not to say there aren't weaknesses to the password manager model, but you're overestimating them and underestimating the ones in your scheme.

I also invite you to read my response above to someone else regarding the security of such an algorithm: with some examples, brute forcing an algorithm is easier than brute forcing a master password.

Re: Backdoored password manager stole data from as many as 29K enterprises

#50

Post by tediousdemise » Sun, Apr 25, 2021, 2:28 AM UTC

scrollaway wrote: post #48

tediousdemise wrote: post #44

Earlier quoted context omitted.

That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure. The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.

It doesn't have to be a black box. There are open source password managers. Bitwarden and Keepassxc are two very good ones. And keep in mind that even if you can create a reasonably strong algorithm which will both be memorable and resistant to reverse engineering, most people won't. Password managers aren't just good for professionals, they're leagues ahead of anything "mere mortals" use. My mom uses 1password -- th…

I’m in support of password managers if they promote better security hygiene for the average user. Particularly, preventing the most heinous of all password crimes: reuse.