Kaspersky Password Manager: All your passwords are belong to us • Hacker News Board

Re: Kaspersky Password Manager: All your passwords are belong to us

#81

Post by CyberRage » Tue, Jul 06, 2021, 4:20 PM UTC

Blikkentrekker wrote: post #73

CyberRage wrote: post #61

Earlier quoted context omitted.

Bias simply weakens your password. If you generate long elaborate passwords then they can resist some of these flaws but the point is you don't want to introduce a flaw when they are simpler and better solutions out there. Mistakes are natural, you want to provide the utmost resistance to such exploits which can stack up to become viable.

What I've been wondering for a long time is how do these two passwords compare: hiKxChDiaHNAtgVz vis-à-vis : kähdikyylkönekkimahdakerttaksa One is a 16 random `[a-zA-Z0-9]` characters, the other is a 32 character long nonce word, containing and among others that conforms to Finnish phonology, but otherwise is devoid of any meaning and phonology but easier to remember to speakers of Finnish. One is a 16. Does 32 char…

The second password can fail quite quickly assuming an attacker is going to target Finnish words to perform a dictionary attack, perhaps a Finnish website makes sense for something like this to be done.

Psuedo-random is always better because anything else usually follows a pattern that can be exploited(sequence, structure, words, statistical bias)

If we can't make assumptions about the secret, the only solution is plain brute-force when it comes to the number of characters squared the length of the password.

Re: Kaspersky Password Manager: All your passwords are belong to us

#82

Post by ericbarrett » Tue, Jul 06, 2021, 4:26 PM UTC

bruce343434 wrote: post #80

simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

> Seeding with the current time is the real sin here. As somebody who only ever uses rng for games, and then indeed seeds with os.microtime(), what's the issue and what is a better approach?

There are only so many seconds in a year, and if you know the PRNG and assume reasonable constraints for the password generator (length, symbols, numbers) you can iterate this space orders of magnitude faster than brute-force.

The proper way to do this for cryptographic purposes is use the RNG facility provided by the kernel, which mixes in local entropy. Or go directly to the CPU like Intel’s RDRAND instruction. But the kernel should be using this if it’s enabled.

Re: Kaspersky Password Manager: All your passwords are belong to us

#83

Post by cogman10 » Tue, Jul 06, 2021, 4:26 PM UTC

bruce343434 wrote: post #80

simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

> Seeding with the current time is the real sin here. As somebody who only ever uses rng for games, and then indeed seeds with os.microtime(), what's the issue and what is a better approach?

The main issue is you generally want PRNGs, especially in terms of crypto, to be unpredictable. When you use something like the time, you've suddenly made the output VERY predictable.

In terms of a global password manager, it's extremely bad, you now can use things like "member since x" to guess a password. If, for example, a database with credentials are leaked, you've significantly shorted the amount of passwords that need to be brute forced for a given target (assuming you know what password manager software they are using)

A good approach would have been something as simple as adding the master password into the seed. (Master password + time). An even better approach would be using a more cryptographically secure random number from the system for either the whole thing or at very least for the seed. (On linux systems /dev/random). You certainly could combine all those approaches to make the password much harder to guess.

Re: Kaspersky Password Manager: All your passwords are belong to us

#84

Post by comicjk » Tue, Jul 06, 2021, 4:27 PM UTC

bruce343434 wrote: post #80

simias wrote: post #4

I feel like the discussion about uniform password generation and PRNG, while interesting, is relatively irrelevant here. Even a garbo xorshift-based non uniform PRNG is almost certainly good enough to generate strong random passwords, as long as it's seeded correctly. An attacker is unlikely to gather enough output (generated passwords) to predict other ones, and the passwords are unlikely to be all generated within…

> Seeding with the current time is the real sin here. As somebody who only ever uses rng for games, and then indeed seeds with os.microtime(), what's the issue and what is a better approach?

Seeding with the time makes the outputs predictable to an adversary. If your games are not moving real money based on your RNG (like online poker), you probably don't have any adversaries trying to guess your random numbers, so you're fine.

See here for an online poker game which actually had this flaw: https://news.ycombinator.com/item?id=7207851

Re: Kaspersky Password Manager: All your passwords are belong to us

#85

Post by _xy8h » Tue, Jul 06, 2021, 4:51 PM UTC

Blikkentrekker wrote: post #73

CyberRage wrote: post #61

Earlier quoted context omitted.

Bias simply weakens your password. If you generate long elaborate passwords then they can resist some of these flaws but the point is you don't want to introduce a flaw when they are simpler and better solutions out there. Mistakes are natural, you want to provide the utmost resistance to such exploits which can stack up to become viable.

What I've been wondering for a long time is how do these two passwords compare: hiKxChDiaHNAtgVz vis-à-vis : kähdikyylkönekkimahdakerttaksa One is a 16 random `[a-zA-Z0-9]` characters, the other is a 32 character long nonce word, containing and among others that conforms to Finnish phonology, but otherwise is devoid of any meaning and phonology but easier to remember to speakers of Finnish. One is a 16. Does 32 char…

I wonder if the xkcd comic about this is still accurate, being that it's generally safer to have longer passwords regardless of how it's formatted.

https://xkcd.com/936/

I recently signed up for a ticketing website to buy tickets for a concert and was appalled that the site wouldn't accept my 50+ character generated password... I had to enter something between 8 and 15 characters.

Still seems to me that "^Zh7*2wNfRG7ehj" would still be inherently less secure than "thisisasuperlongpasswordandithas12345alotofcharactersinitthatwouldtake12345rainbowtablesalongtimetocalculatefor"

15 vs 111 characters to find permutations for.

That is, of course, even assuming that the password db for the site is even hashed (AND salted) or not.

Re: Kaspersky Password Manager: All your passwords are belong to us

#86

Post by CJefferson » Tue, Jul 06, 2021, 5:15 PM UTC

Tempest1981 wrote: post #19

Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too: - getRandomValues() is not guaranteed to be running in a secure context. - There is no minimum degree of entropy mandated by the Web Cryptography specification - User agents are instead urged to provide the best entropy they can when generating random numbers, using a…

This is one of those areas where security in depth is a good idea.

Gather all the sources of random sources you can and hash them together -- add in any information based on user input (key presses / mouse movements), and personally I'd provide each users with a securely generated random 1K string (which could be sent once at install) to provide more random data.

Re: Kaspersky Password Manager: All your passwords are belong to us

#87

Post by htrp » Tue, Jul 06, 2021, 5:27 PM UTC

CJefferson wrote: post #86

Tempest1981 wrote: post #19

Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too: - getRandomValues() is not guaranteed to be running in a secure context. - There is no minimum degree of entropy mandated by the Web Cryptography specification - User agents are instead urged to provide the best entropy they can when generating random numbers, using a…

This is one of those areas where security in depth is a good idea. Gather all the sources of random sources you can and hash them together -- add in any information based on user input (key presses / mouse movements), and personally I'd provide each users with a securely generated random 1K string (which could be sent once at install) to provide more random data.

I like cloudflares solution for entropy. A webcam pointed at a wall of lavalamps in their HQ

https://www.cloudflare.com/learning/ssl/lava-lamp-encryption...

Re: Kaspersky Password Manager: All your passwords are belong to us

#88

Post by war1025 » Tue, Jul 06, 2021, 5:33 PM UTC

denton-scratch wrote: post #72

seanhunter wrote: post #68

Earlier quoted context omitted.

If you're happy with the command line, using something like pass ( https://www.passwordstore.org/ ) is worth serious consideration rather than rolling your own. It is GPLv2 and has a number of benefits, including the fact that your passwords are stored encrypted in a git repo and if you do "pass edit" it will call out to $EDITOR to do your edits, putting encryption/decryption and git transparently on both sides.

Unless you're a cryptographer, don't even think about rolling your own crypto (I'm not one, I did, and I'm ashamed of myself).

The context here was rolling your own password manager, not cryptography.

Re: Kaspersky Password Manager: All your passwords are belong to us

#89

Post by war1025 » Tue, Jul 06, 2021, 5:38 PM UTC

JackMcMack wrote: post #65

propwash wrote: post #5

I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since

Has anyone had any success in getting your TOTP shared secrets out of Lastpass Authenticator?

I don't think it's quite what you were asking, but I always avoided Two Factor Auth because I don't use a smartphone and all the approved methods seemed to use phone apps.

A year ago, one of my accounts forced me to enable two factor auth, so I spent time looking into how to make it less onerous. Turns out the TOTP code stuff is an open standard and there is a command line tool [1] you can use to generate the codes.

Thought that was really neat. I wrote a little script to integrate with my password manager and went from avoiding two factor auth to enabling it everywhere.

[1] https://www.nongnu.org/oath-toolkit/oathtool.1.html

Re: Kaspersky Password Manager: All your passwords are belong to us

#90

Post by Blikkentrekker » Tue, Jul 06, 2021, 5:41 PM UTC

CyberRage wrote: post #81

Blikkentrekker wrote: post #73

Earlier quoted context omitted.

What I've been wondering for a long time is how do these two passwords compare: hiKxChDiaHNAtgVz vis-à-vis : kähdikyylkönekkimahdakerttaksa One is a 16 random `[a-zA-Z0-9]` characters, the other is a 32 character long nonce word, containing and among others that conforms to Finnish phonology, but otherwise is devoid of any meaning and phonology but easier to remember to speakers of Finnish. One is a 16. Does 32 char…

The second password can fail quite quickly assuming an attacker is going to target Finnish words to perform a dictionary attack, perhaps a Finnish website makes sense for something like this to be done. Psuedo-random is always better because anything else usually follows a pattern that can be exploited(sequence, structure, words, statistical bias) If we can't make assumptions about the secret, the only solution is pl…

As I said; it's not a word.

It isn't a word and has no actual meaning or morphology; it's comparable to something such as:

   wrockrangnattentamploozakoshal

It conforms to Finnish orthography and phonology, but otherwise not a word.