Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoored password manager stole data from as many as 29K enterprises

arstechnica.com

Post reply on HN
Print view View original

71–80 of 117 posts

Re: Backdoored password manager stole data from as many as 29K enterprises

#71

Post by atq2119 »

ComodoHacker wrote: post #62
atq2119 wrote: post #57

Earlier quoted context omitted.

Browsers have had built-in password stores for years now. Why not just use those?

So let that one entity be your browser vendor? Also, the article says this product is primarily for enterprise customers, who need other features like sync across team and team access management.

My browser already sees all of my (web) passwords anyway. Therefore, using the browser's built-in password management reduces the number of external entities I need to place my trust in.

Though fair enough when it comes to enterprise features.

Re: Backdoored password manager stole data from as many as 29K enterprises

#72

Post by jobigoud »

lmilcin wrote: post #23
StavrosK wrote: post #20

Earlier quoted context omitted.

Do you simply remember hundreds of random passwords?

I have couple of ways of dealing with the problem. -- Pen and paper? It is still a thing and cannot be stolen online. -- If you are afraid your family will access it without your knowledge, use tamper evident bag and a notepad to make notes of bag serial numbers. This prevents anybody from accessing it without your knowledge. -- Split the password into components so that even if somebody gets access to the piece of p…

Pen and paper doesn't work when you have hundreds of 20-char good passwords and it doesn't work for backups if you regularly create new ones. You need search and you need to sync the new entries to offsite backup as they are created.

Re: Backdoored password manager stole data from as many as 29K enterprises

#73

Post by luckylion »

cjohansson wrote: post #64
627467 wrote: post #4

Why would any "enterprise" customers trust closed sourced AND small-time password manager?

It may be just a matter of time until LastPass gets hacked, I would suspect that the attack surface is the browser plugin

From my interactions with LastPass' support, I'm not sure. They rely on security by obscurity in some parts, I wouldn't be surprised if they did in others.

Re: Backdoored password manager stole data from as many as 29K enterprises

#74

Post by rocqua »

timpattinson wrote: post #56
miohtama wrote: post #6

Earlier quoted context omitted.

Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?

I use KeePass + dropbox. Works on windows and android. I'm pretty sure you don't need to trust the syncing software, so anything should work. Someone please correct me if i'm wrong

Syncing software could perhaps do so cyphertext malleability attacks. Changing the ciphertext, and deducing information on the plaintext based on client behavior.

Perhaps they could force you into a password reset for a specific site by corrupting the correct files. That might be an interesting first step for an account takeover.

These are highly complicated, active attacks. I wouldn't worry as long as your sync service isn't literally the Russian or Chinese government.

Re: Backdoored password manager stole data from as many as 29K enterprises

#75

Post by jfrunyon »

rocqua wrote: post #74
timpattinson wrote: post #56

Earlier quoted context omitted.

I use KeePass + dropbox. Works on windows and android. I'm pretty sure you don't need to trust the syncing software, so anything should work. Someone please correct me if i'm wrong

Syncing software could perhaps do so cyphertext malleability attacks. Changing the ciphertext, and deducing information on the plaintext based on client behavior. Perhaps they could force you into a password reset for a specific site by corrupting the correct files. That might be an interesting first step for an account takeover. These are highly complicated, active attacks. I wouldn't worry as long as your sync serv…

> Perhaps they could force you into a password reset for a specific site by corrupting the correct files. That might be an interesting first step for an account takeover.

It would be interesting to see that accomplished without making it obvious (particularly: without corrupting large parts of or the entire database). KeePass encrypts the whole database.

Re: Backdoored password manager stole data from as many as 29K enterprises

#76

Post by jobigoud »

afpx wrote: post #53

My password manager: a mental hash of some site attributes, my username, and a security level that results in a valid password. A particularly-motivated attacker could easily reverse engineer my hash algorithm, given enough samples. But, good enough for me.

I have +1000 entries in my KeePass. Some of them don't have a username associated. Or a service (passphrases to decrypt private keys for instance). I use different usernames for different aspects of my online life anyway. I also store the randomly generated "mother's maiden name" or "name of first pet" in the entry notes.

When you have a simple software managing this mental burden for you it expands your possibilities.

Re: Backdoored password manager stole data from as many as 29K enterprises

#77

Post by jfrunyon »

dllthomas wrote: post #60
brewdad wrote: post #35

Earlier quoted context omitted.

The exact moment that you need a seatbelt is the same moment your car's interior becomes an adversarial environment.

"Adversarial" in this sense is meaningfully different than "dangerous" - at no point is your car trying to outsmart you.

You're right, the car isn't trying to outsmart anyone - physics is trying to outsmart engineers.

Re: Backdoored password manager stole data from as many as 29K enterprises

#78

Post by jfrunyon »

jjav wrote: post #70
CarelessExpert wrote: post #30

Earlier quoted context omitted.

Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android…

If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…

> A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste.

A browser is too complex but an OS and SSH aren't? There are vulnerabilities in both disclosed regularly.

Re: Backdoored password manager stole data from as many as 29K enterprises

#79

Post by jfrunyon »

cjohansson wrote: post #64
627467 wrote: post #4

Why would any "enterprise" customers trust closed sourced AND small-time password manager?

It may be just a matter of time until LastPass gets hacked, I would suspect that the attack surface is the browser plugin

LastPass was hacked just six years ago... how short our collective memory is https://blog.lastpass.com/2015/06/lastpass-security-notice/

As far as getting actual password data, yes, the attack surface is the clients, and as the most common client is presumably the browser plugin, it's probably the most likely to be attacked.

Re: Backdoored password manager stole data from as many as 29K enterprises

#80

Post by jfrunyon »

cryptica wrote: post #36

These days I generally don't trust any security product. They are as much malware themselves as the malware which they claim to protect you from. - Many security software providers are hackers or ex-hackers... So you're basically paying hackers to protect you from themselves. Why should I trust software which is almost 100% guaranteed to have been written by hackers more than any other random software I might downloa…

> Many security software providers are hackers or ex-hackers... So you're basically paying hackers to protect you from themselves. Why should I trust software which is almost 100% guaranteed to have been written by hackers more than any other random software I might download from the internet which has maybe a less than 1% chance of having been written by a hacker?

Because the hackers know how other hackers are going to try to break it. Most developers pay literally no attention to the security of their code.

Post reply on HN