Browser password managers – flawed security, by design • Hacker News Board

Re: Browser password managers – flawed security, by design

#31

Post by olliej » Mon, Aug 15, 2022, 5:57 AM UTC

plaguepilled wrote: post #21

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

SMS TOTP is indeed bad and your suspicion is well warranted. Its a lazy way to implement 2-factor authentication and exposes the user to MITM attacks as well as a host of other nastiness. U2F (stuff like what Google Authenticator does) is way better and less phone dependent. The only reason a team would opt for TOTP if they had the resources to implement U2F is because its a good way to get your phone number. Edit: e…

I disagree here, suspicion is not warranted - I'd prefer that they support additional non-sms 2FA paths, but supporting SMS based 2FA has many benefits for a company beyond being "lazy"

SMS is vastly better than nothing, and it has the benefit of not requiring users install random software that they (a) don't know how to install, (b) don't know how to use, (c) don't have a recent enough device to use, (d) you don't need to worry about them deleting the app and then losing their 2f, (e) doesn't require your customers having an account with (and potentially paying) another company just to log in to your site, etc

I really do think that tech people over estimate the proportion of people for whom at least one of the above applies. Not everyone runs a one or two year old phone, many of the very cheap phones run very old versions of android, can't be updated, etc

Obviously SMS 2FA has a different problem as the sufficiently poor may not have a constant phone number, obviously sim hijacks can happen but the targeting requires much more effort than simply moving on to the next non-2fa account.

[edit: updated to make sentence structure not look like a series of wordle guesses]

Re: Browser password managers – flawed security, by design

#32

Post by pigbearpig » Mon, Aug 15, 2022, 6:01 AM UTC

> Microsoft Edge is Windows-exclusive of course

No, no it is not. When an article gets something so easy to check so wrong, it's difficult to believe anything else in it.

Re: Browser password managers – flawed security, by design

#33

Post by hn_throwaway_99 » Mon, Aug 15, 2022, 6:05 AM UTC

plaguepilled wrote: post #21

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

SMS TOTP is indeed bad and your suspicion is well warranted. Its a lazy way to implement 2-factor authentication and exposes the user to MITM attacks as well as a host of other nastiness. U2F (stuff like what Google Authenticator does) is way better and less phone dependent. The only reason a team would opt for TOTP if they had the resources to implement U2F is because its a good way to get your phone number. Edit: e…

You seem to be mixing and matching acronyms that don't really make sense.

"TOTP" means "Time-based one time password". It's where the server and client (like the Google Authenticator app) share a secret and then the one-time password changes every 30 seconds. "SMS TOTP" doesn't make sense because SMS codes can be anything random that is sent out to the user attempting to log in.

As I stated above, the Google Authenticator app is a TOTP implementation and is also susceptible to MITM attacks.

U2F refers to physical hardware keys (like yubikeys) that cryptographically validate the requesting server is who they say they are, and is not susceptible to phishing.

Re: Browser password managers – flawed security, by design

#34

Post by mikkom » Mon, Aug 15, 2022, 6:10 AM UTC

what-imright wrote: post #29

Lastpass just sent us a bill for $750 and unless we pay it they locked the whole company out of out shared password database and refuse to supply even chat or email support to discuss it

Lastpass was acquired by some shady chinese company. It's time to migrate to some reliable open source manager like Bitwarden (also provides cloud sync)

Re: Browser password managers – flawed security, by design

#35

Post by EGreg » Mon, Aug 15, 2022, 6:13 AM UTC

politelemon wrote: post #24

modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

> You need hardware second factor tokens. Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.

That’s great! Why not let the USERS have a choice of how to manage their own identity?

Re: Browser password managers – flawed security, by design

#36

Post by avree » Mon, Aug 15, 2022, 6:16 AM UTC

wetpaws wrote: post #18

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

I switched to Google Voice after changing my phone number a couple of times and going through the 2fa replacement hell.

Most 2fa platforms detect and block GV (and similar VOIP numbers)

Re: Browser password managers – flawed security, by design

#37

Post by avree » Mon, Aug 15, 2022, 6:16 AM UTC

modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

That's because this is low-effort blog spam to advertise their security consulting business.

Re: Browser password managers – flawed security, by design

#38

Post by pretext-1 » Mon, Aug 15, 2022, 6:17 AM UTC

foota wrote: post #28

I get asked for my windows password when I try to view the passwords, are they not encrypted by windows?

No, the prompt just unlocks the UI. Otherwise you'd be asked for your Windows password every time you auto-fill a password.

Re: Browser password managers – flawed security, by design

#39

Post by m8s » Mon, Aug 15, 2022, 6:19 AM UTC

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

I recently had to tell my bank, with my voice over the phone, that the make and model of my first car were the three random words 1Password generated for me. “Yes, the make and model of my first car was… a Venerated Breakfast Platoon.”

Re: Browser password managers – flawed security, by design

#40

Post by popcorncowboy » Mon, Aug 15, 2022, 6:25 AM UTC

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

Little-to-nothing to do with liability. Your identity = $. Phone-validated users are simply higher ARPU and (somewhat less importantly) lower risk - an artefact of gating access behind harder-to-spoof touch points.

To the extent that a hardware token proffers anon/pseudonymous verification, there'll be pushback from industry. Because again, your identity = $. Expect anything that would plausibly get a revenue bump from verifying identity to force you to do so eventually. Because you know, security.