Backdoored password manager stole data from as many as 29K enterprises

Post by serial_dev » Sun, Apr 25, 2021, 5:47 AM UTC

g_p wrote: post #9

miohtama wrote: post #6

Earlier quoted context omitted.

Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?

Bitwarden seems to tick the boxes you need - FOSS license, syncs via an (open source) server which you can host yourself, or use their hosted version, and there's team versions available. It's pretty good. There's also bitwarden_rs (a rust-based server component) if you fancy a simpler self-hosting stack that doesn't require SQL server. The solution has been audited, I believe, but audits are only valid at individual…

Post by serial_dev » Sun, Apr 25, 2021, 6:18 AM UTC

scrollaway wrote: post #48

tediousdemise wrote: post #44

Earlier quoted context omitted.

That’s a thoughtful consideration. My logic is that a personal salting algorithm could be compromised after several points of failure, whereas a password manager can be compromised by a single point of failure. The former requires trust in myself to create a strong algorithm, and the latter requires trust in a black box.

It doesn't have to be a black box. There are open source password managers. Bitwarden and Keepassxc are two very good ones. And keep in mind that even if you can create a reasonably strong algorithm which will both be memorable and resistant to reverse engineering, most people won't. Password managers aren't just good for professionals, they're leagues ahead of anything "mere mortals" use. My mom uses 1password -- th…

Post by edflsafoiewq » Sun, Apr 25, 2021, 6:32 AM UTC

scrollaway wrote: post #46

cryptica wrote: post #37

Earlier quoted context omitted.

It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.

Then the passwords are not secret, the rule is. And figuring out a rule with a couple of examples is much easier than breaking into an encrypted, properly secured password vault. In case I'm losing you, here's a parallel: if I ask you to pick and remember a random number between 1 and 1 billion, the odds of me figuring it out are low. But if I ask you to pick and remember 200 numbers between 1 and 1 billion, you will…

Post by p49k » Sun, Apr 25, 2021, 7:18 AM UTC

scrollaway wrote: post #49

tediousdemise wrote: post #47

Earlier quoted context omitted.

I admit that there might be password managers out there that provide sufficient security for some users’ threat models, but I wouldn’t trust such a sensitive compilation of data on any computing system, especially ones with network access. If I used a password manager, it would have to be on an airgapped and password protected system, making it essentially useless for me. For me, it’s easier to memorize a password/sa…

This is a common take on password managers but in practice it doesn't really hold, because humans are bad at security and good password managers are really fucking good at it. That's not to say there aren't weaknesses to the password manager model, but you're overestimating them and underestimating the ones in your scheme. I also invite you to read my response above to someone else regarding the security of such an a…

Post by jjav » Sun, Apr 25, 2021, 7:35 AM UTC

lmilcin wrote: post #18

That's why I don't use password managers. That's giving one entity too much power over everything I own.