Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoored password manager stole data from as many as 29K enterprises

arstechnica.com

Post reply on HN
Print view View original

51–60 of 117 posts

Re: Backdoored password manager stole data from as many as 29K enterprises

#51

Post by ce4 »

lisper wrote: post #12
vkou wrote: post #10

Earlier quoted context omitted.

That's like saying that seatbelts don't help very much, unless you're willing to wear a motorcycling helmet, and install a roll cage in your car. In the worst-case scenario, no, your seatbelt won't help. I'm still going to wear one.

The difference is that the interior of your car is not typically an adversarial environment.

That really depends on your threat model. Every effort to reduce your attack surface increases the effort needed for your adveraries. Your "won't help very much" is only true for the trusting trust problems in the paper, i.e. if you need to survive state sponsored attacks

Re: Backdoored password manager stole data from as many as 29K enterprises

#52

Post by hackinthebochs »

scrollaway wrote: post #49
tediousdemise wrote: post #47

Earlier quoted context omitted.

I admit that there might be password managers out there that provide sufficient security for some users’ threat models, but I wouldn’t trust such a sensitive compilation of data on any computing system, especially ones with network access. If I used a password manager, it would have to be on an airgapped and password protected system, making it essentially useless for me. For me, it’s easier to memorize a password/sa…

This is a common take on password managers but in practice it doesn't really hold, because humans are bad at security and good password managers are really fucking good at it. That's not to say there aren't weaknesses to the password manager model, but you're overestimating them and underestimating the ones in your scheme. I also invite you to read my response above to someone else regarding the security of such an a…

The issue is that password managers skew the cost/benefit analysis of an attack, thus altering the risk profile for the individual. As long as your password creation/storage method is strong enough to thwart low motivation/low resource parties, you may be better off than being in a very attractive pot of millions of credentials.

Re: Backdoored password manager stole data from as many as 29K enterprises

#53

Post by afpx »

My password manager: a mental hash of some site attributes, my username, and a security level that results in a valid password.

A particularly-motivated attacker could easily reverse engineer my hash algorithm, given enough samples. But, good enough for me.

Re: Backdoored password manager stole data from as many as 29K enterprises

#54

Post by yjftsjthsd-h »

afpx wrote: post #53

My password manager: a mental hash of some site attributes, my username, and a security level that results in a valid password. A particularly-motivated attacker could easily reverse engineer my hash algorithm, given enough samples. But, good enough for me.

That's fine until the first time you have to rotate a password, at which point it devolves to, at best, a mnemonic device.

Re: Backdoored password manager stole data from as many as 29K enterprises

#55

Post by function_seven »

cryptica wrote: post #37
StavrosK wrote: post #20

Earlier quoted context omitted.

Do you simply remember hundreds of random passwords?

It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.

I used to do this. It fell apart fast. Some websites require special characters and numbers and upper and lower case letters. Others actually prohibit certain special characters (weak SQL injection "prevention"). Some limit the length to 8 or 16 characters, others don't.

Then a random breach happens, and the website will force you to choose a new password.

I couldn't remember which variant of my rule I used at a particular website. This is aside from how easy my rule was to reverse engineer (which was made really clear to me once when I saw a couple of my PWs on haveibeenpwned

Re: Backdoored password manager stole data from as many as 29K enterprises

#56

Post by timpattinson »

miohtama wrote: post #6
1cvmask wrote: post #2

Just to clarify the title. It was not a deliberate backdoor on the part of Passwordstate. It was a supply chain attack. There is some history to their security holes (most of the known ones being patched). https://twitter.com/juanandres_gs/status/1385689464329187329 https://github.com/NorthwaveSecurity/passwordstate-decryptor... A potential issue in the password management space is that Francisco Partners (owner of N…

Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?

I use KeePass + dropbox. Works on windows and android.

I'm pretty sure you don't need to trust the syncing software, so anything should work. Someone please correct me if i'm wrong

Re: Backdoored password manager stole data from as many as 29K enterprises

#57

Post by atq2119 »

StavrosK wrote: post #20
lmilcin wrote: post #18

That's why I don't use password managers. That's giving one entity too much power over everything I own.

Do you simply remember hundreds of random passwords?

Browsers have had built-in password stores for years now. Why not just use those?

Re: Backdoored password manager stole data from as many as 29K enterprises

#58

Post by jniedrauer »

lmilcin wrote: post #25
w4rh4wk5 wrote: post #21

Earlier quoted context omitted.

Just note them down in a book? I know, it sounds stupid, but nowadays it's a lot easier to keep a small booklet save than a digital file on a connected machine.

No, it is not stupid. It is strange how people get blinded by technology and forget about oldest, most reliable methods. I have worked as a security officer at a credit card acquirer (basically, processing credit card transactions between terminal and the bank). The process to safeguard your PINs is extremely complex but at the very end relies on pieces of paper with passwords and key components written down, put in…

You're describing backups. The base derivation keys still have to exist in an HSM to be used. No one is opening a safe and hand-typing the BDK each time they need to issue a PIN encryption key.

Re: Backdoored password manager stole data from as many as 29K enterprises

#59

Post by dllthomas »

lisper wrote: post #7
miohtama wrote: post #6

Earlier quoted context omitted.

Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?

FOSS won't help you very much unless you're willing to build your entire tool chain from vetted source. http://users.ece.cmu.edu/~ganger/712.fall02/papers/p761-thom...

Trusting Trust actually says that vetted source isn't enough! Fortunately it's been defeated (https://dwheeler.com/trusting-trust/), such that vetted source and multiple compiler executables that are unlikely to be compromised in the same way can be enough if you use them carefully (which, to my knowledge, we don't).

Re: Backdoored password manager stole data from as many as 29K enterprises

#60

Post by dllthomas »

brewdad wrote: post #35
lisper wrote: post #12

Earlier quoted context omitted.

The difference is that the interior of your car is not typically an adversarial environment.

The exact moment that you need a seatbelt is the same moment your car's interior becomes an adversarial environment.

"Adversarial" in this sense is meaningfully different than "dangerous" - at no point is your car trying to outsmart you.
Post reply on HN