Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoored password manager stole data from as many as 29K enterprises

arstechnica.com

Post reply on HN
Print view View original

81–90 of 117 posts

Re: Backdoored password manager stole data from as many as 29K enterprises

#81

Post by EVa5I7bHFq9mnYK »

jjav wrote: post #70
CarelessExpert wrote: post #30

Earlier quoted context omitted.

Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android…

If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…

Not sure I can call clipboard a very secure communication protocol.

Re: Backdoored password manager stole data from as many as 29K enterprises

#83

Post by bosie »

swiley wrote: post #26
StavrosK wrote: post #24

Earlier quoted context omitted.

Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.

You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.

No notepad for me unfortunately. how do you use your setup on mobile?

Re: Backdoored password manager stole data from as many as 29K enterprises

#84

Post by jfrunyon »

cryptica wrote: post #27

That's why I never used and will never use a password manager... You can't get more security by trusting more intermediaries with your passwords. When it comes to anything that matters, you want to trust as few intermediaries as possible. The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. Why not just remember your passwords? There is…

> You can't get more security by trusting more intermediaries with your passwords.

I would agree, were it not for the fact that every worthwhile password manager never sends your passwords to any intermediary. There is of course some risk related to the strength of the encryption, software updates/supply chain attacks, client backdoors, etc; however, in most scenarios that is far outweighed by the additional security on a "link in the chain" which is much more likely to be attacked (better credentials - higher entropy, better rotation, and so on).

> The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious.

You're right, it is obvious, that's why those entities don't have access to them!

> Why not just remember your passwords? There is an infinite number of strategies and secret rules which you can use to easily remember your passwords.

That is incredibly low entropy. This will likely prevent you from falling victim to a simple dictionary or credential-stuffing attack, but not much else.

> Or for low-importance services, why not just use your browser's built-in password manager? You have to trust the browser maker anyway.

Well, that IS a password manager. And as to why not use it, because in an enterprise environment you should probably have automatic/encrypted/signed sharing, as well as logs of who accessed a password, who modified a password, etc.

By the way, I just want to point out that your "password manager" could be "rot13 and write it down in a notebook and put it in a locked cabinet". Or it could be "put it in a text file and GPG-encrypt it". There are plenty of options available which don't involve even trusting the code of any third-party.

Re: Backdoored password manager stole data from as many as 29K enterprises

#85

Post by antaviana »

g_p wrote: post #9
miohtama wrote: post #6

Earlier quoted context omitted.

Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?

Bitwarden seems to tick the boxes you need - FOSS license, syncs via an (open source) server which you can host yourself, or use their hosted version, and there's team versions available. It's pretty good. There's also bitwarden_rs (a rust-based server component) if you fancy a simpler self-hosting stack that doesn't require SQL server. The solution has been audited, I believe, but audits are only valid at individual…

Bitwarden says they are hashed and encrypted with your email and master key before leaving your device so it is not possible to get them even if they are ever hacked.

So far so good, but how do they protect from hacking or from Bitwarden employees the shared secrets in an organization? I understand that each member of the organization team has their own master key.

Re: Backdoored password manager stole data from as many as 29K enterprises

#86

Post by cryptica »

jfrunyon wrote: post #84
cryptica wrote: post #27

That's why I never used and will never use a password manager... You can't get more security by trusting more intermediaries with your passwords. When it comes to anything that matters, you want to trust as few intermediaries as possible. The more entities have access to your passwords, the less secure you are. I can't believe I even have to say it, it seems so obvious. Why not just remember your passwords? There is…

> You can't get more security by trusting more intermediaries with your passwords. I would agree, were it not for the fact that every worthwhile password manager never sends your passwords to any intermediary. There is of course some risk related to the strength of the encryption, software updates/supply chain attacks, client backdoors, etc; however, in most scenarios that is far outweighed by the additional security…

>> every worthwhile password manager never sends your passwords to any intermediary

Except in cases where the password manager is 100% open source, the people who wrote the password manager are intermediaries. As I said, you need to trust an additional intermediary.

Re: Backdoored password manager stole data from as many as 29K enterprises

#87

Post by albuic »

p49k wrote: post #67
scrollaway wrote: post #49

Earlier quoted context omitted.

This is a common take on password managers but in practice it doesn't really hold, because humans are bad at security and good password managers are really fucking good at it. That's not to say there aren't weaknesses to the password manager model, but you're overestimating them and underestimating the ones in your scheme. I also invite you to read my response above to someone else regarding the security of such an a…

> That's not to say there aren't weaknesses to the password manager model, but you're overestimating them Doesn’t this very article show otherwise?

It does not. It shows the failure of one ONLINE and CLOSED SOURCES password manager. Both of those can and should be avoided.

Re: Backdoored password manager stole data from as many as 29K enterprises

#88

Post by lmilcin »

jniedrauer wrote: post #58
lmilcin wrote: post #25

Earlier quoted context omitted.

No, it is not stupid. It is strange how people get blinded by technology and forget about oldest, most reliable methods. I have worked as a security officer at a credit card acquirer (basically, processing credit card transactions between terminal and the bank). The process to safeguard your PINs is extremely complex but at the very end relies on pieces of paper with passwords and key components written down, put in…

You're describing backups. The base derivation keys still have to exist in an HSM to be used. No one is opening a safe and hand-typing the BDK each time they need to issue a PIN encryption key.

It is not a backup. Backups are made just in case.

In case of HSM keys, the HSM itself is built to loose those keys at the least pretense. It is also not possible to retrieve the keys.

So whenever you want to provision a new HSM or even just move it couple centimeters (it looses keys when you try to move it) you have to go to the components written on paper.

It is just like a password on a website -- you have to be entering it regularly. But once you enter the password you don't need to retype it for every HTTP request.

Key components = password HSM = browser Message with PIN block = HTTP request

Re: Backdoored password manager stole data from as many as 29K enterprises

#89

Post by swiley »

bosie wrote: post #83
swiley wrote: post #26

Earlier quoted context omitted.

You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.

No notepad for me unfortunately. how do you use your setup on mobile?

I have a hard time imagining getting any useful (maybe I could review PRs?) work done on a smartphone, also my company didn't give me one and both they and I have a strict policy of not mixing personal and work devices.

Re: Backdoored password manager stole data from as many as 29K enterprises

#90

Post by ivanhoe »

antaviana wrote: post #85
g_p wrote: post #9

Earlier quoted context omitted.

Bitwarden seems to tick the boxes you need - FOSS license, syncs via an (open source) server which you can host yourself, or use their hosted version, and there's team versions available. It's pretty good. There's also bitwarden_rs (a rust-based server component) if you fancy a simpler self-hosting stack that doesn't require SQL server. The solution has been audited, I believe, but audits are only valid at individual…

Bitwarden says they are hashed and encrypted with your email and master key before leaving your device so it is not possible to get them even if they are ever hacked. So far so good, but how do they protect from hacking or from Bitwarden employees the shared secrets in an organization? I understand that each member of the organization team has their own master key.

> Bitwarden says they are hashed and encrypted with your email and master key before leaving your device so it is not possible to get them even if they are ever hacked.

This part makes electron apps even a bigger problem, because if hacker owns the app that's the point where they can grab the password before it's encrypted.

Post reply on HN