Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky Password Manager: All your passwords are belong to us

donjon.ledger.com

Post reply on HN
Print view View original

11–20 of 122 posts

Re: Kaspersky Password Manager: All your passwords are belong to us

#11

Post by Anunayj »

simias wrote: post #9
123pie123 wrote: post #6

>All the passwords it created could be bruteforced in seconds Can somebody please correct me if I'm wrong, but to bruteforce a password attackers need offline access to the stored passwords data and I'm assuming it mustn't be stored in a proper encrypted way why should the onus be on the end client/ user to use 'crazy' lenght and complex passwords(I'm excluding stupidily simple passwords such as 123456 etc..) surely…

I think the attack vector would be something like: - Website is compromised, database is dumped - It contains hashed user passwords that you'd have to bruteforce if you want to recover them - If you know roughly how long the password is and when it was generated (and what character set it uses) and that you know that it was probably generated by this Karspersky product, you can use that to generate all possible combi…

Another would be sharing a encrypted file using password-based key derivation scheme over a unsecure channel. This could mean even if you use a client side password encrypted (Think Matrix, Bitwarden) with a supposedly "strong" password. The password is much much much much less secure.

One thing though with the database dump scenario is, password managers by design discourage password reuse, so bruteforcing a password in a past leak might not help with the current passwords. Which imo makes using a password manager (albiet a bad one) still a net positive.

Re: Kaspersky Password Manager: All your passwords are belong to us

#13

Post by Hackbraten »

123pie123 wrote: post #6

>All the passwords it created could be bruteforced in seconds Can somebody please correct me if I'm wrong, but to bruteforce a password attackers need offline access to the stored passwords data and I'm assuming it mustn't be stored in a proper encrypted way why should the onus be on the end client/ user to use 'crazy' lenght and complex passwords(I'm excluding stupidily simple passwords such as 123456 etc..) surely…

Good points but I beg to differ.

- For internet-facing systems, your threat model should acknowledge that the user database is going to leak. It happens all the time, even though many businesses don’t admit it. (You can tell how rampant the problem is: use unique email addresses per service, wait a year or two, and check how much spam you get on those addresses.)

- Encryption is irrelevant when your threat model involves a leaked user database. That’s because if a service keeps passwords encrypted at rest, decryption keys may be available to the system at runtime. So you can assume that the decryption key is going to ship along with the leak.

- Hashing passwords, if done properly, will buy you some time against an offline brute-forcer. But not if the space of possible passwords is as tiny as in the Kaspersky case. So hashing isn’t going to help much here as well. In other words, if a database of Kaspersky-generated passwords is ever leaked, consider them easily brute-forced, no matter what.

- Even if logon attempts are limited and the database never leaks, the password is still at risk. The attacker may learn the time where the victim’s account was created, guess the timestamp in seconds, apply the Kaspersky algorithm and get the password right in four or five attempts if they’re lucky.

Re: Kaspersky Password Manager: All your passwords are belong to us

#15

Post by kalleboo »

jpxw wrote: post #7
propwash wrote: post #5

I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since

Bitwarden has the best UI/UX of any password manager I have used, by far. In particular it puts LastPass (which I switched from) to shame. I rarely use the premium features, but I pay for premium anyway to support the project. Costs a dollar a month, so barely noticeable.

Yeah I evaluated a few team password managers for a friend's small business and Bitwarden was the clear winner (1Password was second, but fell due to the requirement for a long random master key). I was surprised by just how bad Last pass and Dashlane were considering how much they spend on advertising

Re: Kaspersky Password Manager: All your passwords are belong to us

#16

Post by nix23 »

varjag wrote: post #3
jfktkrkfk wrote: post #2

Getting some DUAL_EC prng vibes. Insert Kaspersky owned by Russia intelligence conspiracy here...

Kaspersky's Advanced School of KGB graduation photos: https://cs6.pikabu.ru/post_img/big/2017/07/04/11/14991974131...

KGB school student and later KGB officer...sounds plausible.

BTW: that whole thing must be before 1991 (KGB) and kaspersky was founded in 1997 (where KGB wasn't anymore).

Re: Kaspersky Password Manager: All your passwords are belong to us

#17

Post by senectus1 »

jpxw wrote: post #7
propwash wrote: post #5

I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since

Bitwarden has the best UI/UX of any password manager I have used, by far. In particular it puts LastPass (which I switched from) to shame. I rarely use the premium features, but I pay for premium anyway to support the project. Costs a dollar a month, so barely noticeable.

it can be a bit club-footed on the mobile platform. but yeah its my password manager of choice as well.

Re: Kaspersky Password Manager: All your passwords are belong to us

#18

Post by convery »

kalleboo wrote: post #15
jpxw wrote: post #7

Earlier quoted context omitted.

Bitwarden has the best UI/UX of any password manager I have used, by far. In particular it puts LastPass (which I switched from) to shame. I rarely use the premium features, but I pay for premium anyway to support the project. Costs a dollar a month, so barely noticeable.

Yeah I evaluated a few team password managers for a friend's small business and Bitwarden was the clear winner (1Password was second, but fell due to the requirement for a long random master key). I was surprised by just how bad Last pass and Dashlane were considering how much they spend on advertising

Can you elaborate on the issues with Lastpass? I haven't looked at other managers but Lastpass seems fine.

Re: Kaspersky Password Manager: All your passwords are belong to us

#19

Post by Tempest1981 »

Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too:

- getRandomValues() is not guaranteed to be running in a secure context.

- There is no minimum degree of entropy mandated by the Web Cryptography specification

- User agents are instead urged to provide the best entropy they can when generating random numbers, using a well-defined, efficient pseudorandom number generator built into the user agent itself, but seeded with values taken from an external source of pseudorandom numbers, such as a platform-specific random number function, the Unix /dev/urandom device, or other source of random or pseudorandom data.

From https://developer.mozilla.org/en-US/docs/Web/API/Crypto/getR...

Is there a better solution?

Post reply on HN