Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Backdoored password manager stole data from as many as 29K enterprises

arstechnica.com

Post reply on HN
Print view View original

101–110 of 117 posts

Re: Backdoored password manager stole data from as many as 29K enterprises

#101

Post by scrollaway »

hackinthebochs wrote: post #52
scrollaway wrote: post #49

Earlier quoted context omitted.

This is a common take on password managers but in practice it doesn't really hold, because humans are bad at security and good password managers are really fucking good at it. That's not to say there aren't weaknesses to the password manager model, but you're overestimating them and underestimating the ones in your scheme. I also invite you to read my response above to someone else regarding the security of such an a…

The issue is that password managers skew the cost/benefit analysis of an attack, thus altering the risk profile for the individual. As long as your password creation/storage method is strong enough to thwart low motivation/low resource parties, you may be better off than being in a very attractive pot of millions of credentials.

That is a fair point, but keep in mind the risk of NOT using one. Most people won't have a "strong enough" storage/creation method.

I'd argue even those who think they do probably don't.

To me the whole conversation sounds like this:

- An unknown, low security bank was broken into.

- This proves storing your money in a bank is a terrible idea! This is why I keep all my money in my home.

- No that's definitely a worse idea. Storing your money in a bank is the most secure way to keep your money. It's not infallible but-

- Yes but alone i don't have that much money... It's a lot more attractive if it's in a big oot everybody else's.

- Well no, most good banks invest a lot more in security than you ever would or could.

- No it's okay, because I put it in a box and I have a lock on it.

- Like a safe?

- No. I don't trust safes either.

Re: Backdoored password manager stole data from as many as 29K enterprises

#102

Post by Too »

swiley wrote: post #26
StavrosK wrote: post #24

Earlier quoted context omitted.

Do you carry this around with you, or is it just for high-value passwords? I regularly have to log in to things, carrying a notepad of passwords with me would be inconvenient and dangerous.

You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.

They don't rely on transferring the password via an insecure channel - your clipboard.

Other applications can sniff the clipboard, you might accidentally copy another of your credentials into website or you might forget to clear it after use and then later accidentally paste it into an irc-channel.

There is also risk of visually exposing the password in the text editor, either to someone else in the room, screen sharing or screenshot from another malicious app.

A bit into the tinfoil-hat side, but it's passwords we are talking about after all.

Re: Backdoored password manager stole data from as many as 29K enterprises

#103

Post by megous »

Fethbita wrote: post #98
eeegnu wrote: post #68

Earlier quoted context omitted.

At that point add a 2 to the end or change your username. Worst case you have to try a few times to get in, but eventually you'll remember it's one of those sites that uses the extra version information.

I don't think just appending a character to your password is such a good idea if it is compromised.

As a side note, trying various passwords doesn't strike me as a great idea either. You're basically telling the site you're trying to log into your other passwords you use, along with a username. At the very least you're revealing something about how you derive your passwords, if you have some scheme.

I'd say that if I'm not sure about the right password, it's safest to go straight for a password reset function, instead of giving all my passwords or a password derivation method to some random website.

Re: Backdoored password manager stole data from as many as 29K enterprises

#104

Post by lrvick »

miohtama wrote: post #6
1cvmask wrote: post #2

Just to clarify the title. It was not a deliberate backdoor on the part of Passwordstate. It was a supply chain attack. There is some history to their security holes (most of the known ones being patched). https://twitter.com/juanandres_gs/status/1385689464329187329 https://github.com/NorthwaveSecurity/passwordstate-decryptor... A potential issue in the password management space is that Francisco Partners (owner of N…

Password managers seem to be the most critical software where open source and reproducible builds are needed. Are there any good FOSS password managers that can do remote sync and team permissions?

I use Password Store for these use cases and with yubikey tap-to+decrypt which makes bulk exfiltration of passwords virtually impossible.

Re: Backdoored password manager stole data from as many as 29K enterprises

#106

Post by CarelessExpert »

jjav wrote: post #70
CarelessExpert wrote: post #30

Earlier quoted context omitted.

Easy integration with browsers and so forth which significantly simplifies UX, especially for less sophisticated users. Built in password/passphrase generator. Mobile device support. Search and organization functions. The ability to store other kinds of secrets like ssh keys. TOTP support. I'm sure there's stuff I'm missing but those are a few things that spring to mind. Personally, I use keepassxc + keepass2android…

If you're optimizing for UX you're not optimizing for security. It's just how it is. My password manager can't communicate with anything, it's local only. It runs on a separate host so no, it doesn't have any browser integration. A browser is way too complex attack surface to trust. Only way I get a password is to ssh into the isolated host, decrypt password and cut & paste. Less convenient, sure. Also far more secur…

> If you're optimizing for UX you're not optimizing for security. It's just how it is.

Security can never be perfect. It's a lesson in trade-offs.

For example, if you make security so hard or inconvenient that people won't engage in secure behaviors, then in the end you're worse off.

This is the reason password rotation has fallen out of favor lately.

If in general we did away with password managers and took your lead, I guarantee we would collectively be worse off because, for most folks, what you describe would be seen as way more trouble than it's worth.

Your black-and-white take also fails to account for varied threat models.

Remember, the most common threat model online today is service breaches leading to passwords being exposed, followed by credential stuffing. Password managers encourage practices that eliminate that threat model.

If your threat model is centered on password manager service breaches like this one, then use a solution that doesn't require cloud hosting (e.g. keepass).

So now we need to worry about device breaches, which requires hackers to go after individual users (either targeted or untargeted), which has a much higher cost/complexity. We've made the hackers job a lot harder, which is good.

And if your model is centered on device breaches, well, bad news: your browser already sees your passwords go by (among many other things), so if the device is breached, you're hooped, password manager or no password manager.

Re: Backdoored password manager stole data from as many as 29K enterprises

#107

Post by CarelessExpert »

swiley wrote: post #89
bosie wrote: post #83

Earlier quoted context omitted.

No notepad for me unfortunately. how do you use your setup on mobile?

I have a hard time imagining getting any useful (maybe I could review PRs?) work done on a smartphone, also my company didn't give me one and both they and I have a strict policy of not mixing personal and work devices.

Okay, but what about your personal accounts? Do you just not use them on your phone? Manually key in passwords while looking at them on a PC?

Re: Backdoored password manager stole data from as many as 29K enterprises

#108

Post by atat7024 »

Too wrote: post #102
swiley wrote: post #26

Earlier quoted context omitted.

You don't have a notepad anyway? although I've never personally understood the advantage password managers have over just using AES encryption that most text editors have.

They don't rely on transferring the password via an insecure channel - your clipboard. Other applications can sniff the clipboard, you might accidentally copy another of your credentials into website or you might forget to clear it after use and then later accidentally paste it into an irc-channel. There is also risk of visually exposing the password in the text editor, either to someone else in the room, screen shar…

Malicious JavaScript can sniff the clipboard.

Re: Backdoored password manager stole data from as many as 29K enterprises

#109

Post by joelellis »

laurowyn wrote: post #96
g_p wrote: post #9

Earlier quoted context omitted.

Bitwarden seems to tick the boxes you need - FOSS license, syncs via an (open source) server which you can host yourself, or use their hosted version, and there's team versions available. It's pretty good. There's also bitwarden_rs (a rust-based server component) if you fancy a simpler self-hosting stack that doesn't require SQL server. The solution has been audited, I believe, but audits are only valid at individual…

Any idea why Bitwarden insist on their installation ID generation for self hosted deployments? it strikes me as unusual, as it's not documented WHY it's necessary, or what the ID is used for, only that you're required to give Bitwarden your email address to get the necessary ID. If they would remove this step, or at the very least explain it, I'd be more likely to deploy and use it. Critical things like password mana…

As far as I remember, it was used to pass API requests for third party services (like APNS) through the main Bitwarden servers so Bitwarden's secret keys for these services weren't published, but self-hosters wouldn't have to register and manage their own accounts for these services, which can be complicated and expensive (To get access to APNS you have to pay the $100/yr apple developer subscription and you can only use it for your own apps, so you would have to build and distribute, via the app store or testflight, your own build of the app.

Re: Backdoored password manager stole data from as many as 29K enterprises

#110

Post by cryptica »

function_seven wrote: post #55
cryptica wrote: post #37

Earlier quoted context omitted.

It's easy. Just come up with a secret rule and derive the passwords from that rule such that the password is different for each website/service.

I used to do this. It fell apart fast. Some websites require special characters and numbers and upper and lower case letters. Others actually prohibit certain special characters (weak SQL injection "prevention"). Some limit the length to 8 or 16 characters, others don't. Then a random breach happens, and the website will force you to choose a new password. I couldn't remember which variant of my rule I used at a part…

You can have different variants so you try one and if that's not it then you try the backup/alternative. In my case, this was only a problem with a couple of websites which I rarely used. I just did a password reset every time I wanted to log into these websites.
Post reply on HN