Smartphone password managers are largely insecure
elcomsoft.com
Smartphone password managers are largely insecure
1–10 of 23 posts
Re: Smartphone password managers are largely insecure
#2Wow, some of these are amazingly insecure. It's really incredible that at least one of the developers of a paid security app stores the master-password encrypted (not-hashed) using a hardcoded private key.
Re: Smartphone password managers are largely insecure
#3One Ring to Rule Them All... but seriously, interesting article; I think more interesting is the phone log-in password that all smart phones now have. I just read an article where the DOJ subpenaed Google to unlock an Android based phone because after several weeks of working on the log-in, they still couldn't get in. If you think about it, Password management software for your phone is really protected by 2 systems, the one native to your phone and the apps own security systems. Although, yes, some of these apps are essentially bunk.
Re: Smartphone password managers are largely insecure
#4Sorry to see iKeePass missing from the analysis.
Re: Smartphone password managers are largely insecure
#5Sorry to see iKeePass missing from the analysis.
Indeed.. as well as KeePass for Blackberry.
Re: Smartphone password managers are largely insecure
#6Response from Agilebits (publisher of 1Password) to this paper: http://blog.agilebits.com/2012/03/16/strong-security-require...
Re: Smartphone password managers are largely insecure
#7Sorry to see iKeePass missing from the analysis.
KeePass is the only one I really wanted to see...
Re: Smartphone password managers are largely insecure
#8Response from Agilebits (publisher of 1Password) to this paper: http://blog.agilebits.com/2012/03/16/strong-security-require...
The crux of it:
"1Password uses PBKDF2 to significantly slow down attackers. Currently this is not available on iOS as we needed to support older devices. The next major release of 1Password will only support iOS 5 and at that time we will be incorporating these additional defences"
This is absolutely unacceptable. Agilebits has long talked about how they use PBKDF2 to secure your passwords, and using anything different on mobile is an abuse of trust.
Agilebits' response is hand-waving. Of course longer passwords are more secure. If we all used 32-character passwords, we wouldn't even need key derivation.
But we expect to use reasonably simple (7-10) character passwords because it's possible to make these secure against cold attacks using math. And when the software you use has in the past described the algorithms it uses, you expect all versions of the software to work in the same manner.
I've long used 1password, and I don't plan to stop using it yet, but this is a serious breach of trust, and I feel less secure in using it now.
Re: Smartphone password managers are largely insecure
#9In short, protect your device from physical access by untrusted people, and don't connect it to untrusted machines. Use a PIN or device password just in case someone else does get ahold of your device.
Re: Smartphone password managers are largely insecure
#10Response from Agilebits (publisher of 1Password) to this paper: http://blog.agilebits.com/2012/03/16/strong-security-require...
The crux of it: "1Password uses PBKDF2 to significantly slow down attackers. Currently this is not available on iOS as we needed to support older devices. The next major release of 1Password will only support iOS 5 and at that time we will be incorporating these additional defences" This is absolutely unacceptable. Agilebits has long talked about how they use PBKDF2 to secure your passwords, and using anything differ…
I agree.
I am going to add the PBKDF2 strengthening and fix the problem with the PKCS#7 padding mentioned in the article. We plan to submit the 1Password update by the end of March.
The support iOS 3 and the old devices really hurt us there as the performance gap between iPhone 3 and iPhone 4S is huge and so far we were targeting the lowest common denominator. I am still not sure what to do about the older iPhones. We'll probably try to adjust the number of PBKDF2 iterations based on the device. Unfortunately, the PBKDF2 calibration API is only available on iOS 5.