Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky Password Manager: All your passwords are belong to us

donjon.ledger.com

Post reply on HN
Print view View original

71–80 of 122 posts

Re: Kaspersky Password Manager: All your passwords are belong to us

#71

Post by mcintyre1994 »

sysadm1n wrote: post #59

The title is misleading. Yes, the passes are generated using a crappy and predictable seed value, but the passes are stored in a vault, and good luck breaking into that vault providing you use a strong master password, like a six-word diceware passphrase.

Unless any of the services you sign up for decide to log passwords like Facebook did, or store password hashes insecurely and get their database dumped online. I think it's pretty unsafe to assume that none of the passwords in your vault will leak from the service side, you just have to rely on the important services not screwing it up.

Re: Kaspersky Password Manager: All your passwords are belong to us

#72

Post by denton-scratch »

seanhunter wrote: post #68
jmclnx wrote: post #42

To me, using a Password Manager puts you at risk, no matter which one you use. I cannot speak to windows, but on Linux, I use a encrypted text file via emacs. And to generate passwords: tr -cd "[:alnum:]" And a real TL;DR: Upgrade your Kaspersky Password Manager

If you're happy with the command line, using something like pass ( https://www.passwordstore.org/ ) is worth serious consideration rather than rolling your own. It is GPLv2 and has a number of benefits, including the fact that your passwords are stored encrypted in a git repo and if you do "pass edit" it will call out to $EDITOR to do your edits, putting encryption/decryption and git transparently on both sides.

Unless you're a cryptographer, don't even think about rolling your own crypto (I'm not one, I did, and I'm ashamed of myself).

Re: Kaspersky Password Manager: All your passwords are belong to us

#73

Post by Blikkentrekker »

CyberRage wrote: post #61
simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

Bias simply weakens your password. If you generate long elaborate passwords then they can resist some of these flaws but the point is you don't want to introduce a flaw when they are simpler and better solutions out there. Mistakes are natural, you want to provide the utmost resistance to such exploits which can stack up to become viable.

What I've been wondering for a long time is how do these two passwords compare:

   hiKxChDiaHNAtgVz
vis-à-vis:

   kähdikyylkönekkimahdakerttaksa
One is a 16 random `[a-zA-Z0-9]` characters, the other is a 32 character long nonce word, containing and among others that conforms to Finnish phonology, but otherwise is devoid of any meaning and phonology but easier to remember to speakers of Finnish. One is a 16.

Does 32 characters opposed to 16 offset that the latter conforms to the phonology of a language with 6 million speakers?

Re: Kaspersky Password Manager: All your passwords are belong to us

#74

Post by gregmac »

Gatsky wrote: post #24
propwash wrote: post #5

I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since

What did you find was better about Bitwarden?

Killer feature for me is the URI matching options. Each entry can have URIs, and each URI can match based on: Base Domain, Host, Starts With, Exact, or Regex.

This simplified a bunch of things for me:

* Dev deployments of an app, where I have one or two different logins (eg, the default admin login) but it's deployed on a bunch of subdomains and/or internal IPs and/or internal non-FQDN hosts

* A bunch of work systems on different domains where there's old-style SSO (synchronized password, but login form as part of the app)

* Android apps just get a URI like com.domain.AppName and can otherwise be consolidated with other entries, etc

Re: Kaspersky Password Manager: All your passwords are belong to us

#75

Post by proactivesvcs »

tomrod wrote: post #20
verytrivial wrote: post #12

> It means every instance of Kaspersky Password Manager in the world will generate the exact same password at a given second. Whoa. That's just ... Wow.

I recall this was an issue too for certain RSA tokens.

"In the context of previous allegations about RSA and USA intelligence, there's some chance these errors were intentionally introduced."

https://en.wikipedia.org/wiki/RSA_Security#Relationship_with...

Re: Kaspersky Password Manager: All your passwords are belong to us

#76

Post by Snild »

sysadm1n wrote: post #59

The title is misleading. Yes, the passes are generated using a crappy and predictable seed value, but the passes are stored in a vault, and good luck breaking into that vault providing you use a strong master password, like a six-word diceware passphrase.

The vault does no good if you're passwords can be identically recreated by the attacker. Which the "crappy and predictable seed value", in combination with account creation time data, makes trivial. That creation time may be explicitly shown by the service, or at least hinted at through something like the timestamp of the user's first post.

Re: Kaspersky Password Manager: All your passwords are belong to us

#77

Post by ludamad »

Blikkentrekker wrote: post #73
CyberRage wrote: post #61

Earlier quoted context omitted.

Bias simply weakens your password. If you generate long elaborate passwords then they can resist some of these flaws but the point is you don't want to introduce a flaw when they are simpler and better solutions out there. Mistakes are natural, you want to provide the utmost resistance to such exploits which can stack up to become viable.

What I've been wondering for a long time is how do these two passwords compare: hiKxChDiaHNAtgVz vis-à-vis : kähdikyylkönekkimahdakerttaksa One is a 16 random `[a-zA-Z0-9]` characters, the other is a 32 character long nonce word, containing and among others that conforms to Finnish phonology, but otherwise is devoid of any meaning and phonology but easier to remember to speakers of Finnish. One is a 16. Does 32 char…

It can IMO. The right thing to do is to consider the entropy in a pessimistic attack context. Enough dictionary-attackable words together still has good entropy

Re: Kaspersky Password Manager: All your passwords are belong to us

#78

Post by andrewkdinh »

AnIdiotOnTheNet wrote: post #58
josu wrote: post #29

Earlier quoted context omitted.

It was just added last week https://bitwarden.com/blog/post/admin-password-reset-is-out/

I hope this makes it into bitwarden_rs, which is what we use at work, soon. That and/or the ability to disable personal vaults would go a long ways for us.

bitwarden_rs has been renamed to vaultwarden

https://github.com/dani-garcia/vaultwarden

Re: Kaspersky Password Manager: All your passwords are belong to us

#79

Post by dheera »

simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

I don't get why it's so hard to just seed with some random sensor data from your computer? Noise from a microphone input would be perfect, and a million times better than this.

Re: Kaspersky Password Manager: All your passwords are belong to us

#80

Post by bruce343434 »

simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

> Seeding with the current time is the real sin here.

As somebody who only ever uses rng for games, and then indeed seeds with os.microtime(), what's the issue and what is a better approach?

Post reply on HN