Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Smartphone password managers are largely insecure

elcomsoft.com

Post reply on HN
Print view View original

11–20 of 23 posts

Re: Smartphone password managers are largely insecure

#11

Post by MattRogish »

roustem wrote: post #10
dorianj wrote: post #8

Earlier quoted context omitted.

The crux of it: "1Password uses PBKDF2 to significantly slow down attackers. Currently this is not available on iOS as we needed to support older devices. The next major release of 1Password will only support iOS 5 and at that time we will be incorporating these additional defences" This is absolutely unacceptable. Agilebits has long talked about how they use PBKDF2 to secure your passwords, and using anything differ…

I agree. I am going to add the PBKDF2 strengthening and fix the problem with the PKCS#7 padding mentioned in the article. We plan to submit the 1Password update by the end of March. The support iOS 3 and the old devices really hurt us there as the performance gap between iPhone 3 and iPhone 4S is huge and so far we were targeting the lowest common denominator. I am still not sure what to do about the older iPhones. W…

Hardly anyone runs on iOS3 and/or iPhone3 - do you have data showing this market segment is large?

Weakening security for such a tiny market segment - I can't imagine that's worth it.

Re: Smartphone password managers are largely insecure

#12

Post by roustem »

MattRogish wrote: post #11
roustem wrote: post #10

Earlier quoted context omitted.

I agree. I am going to add the PBKDF2 strengthening and fix the problem with the PKCS#7 padding mentioned in the article. We plan to submit the 1Password update by the end of March. The support iOS 3 and the old devices really hurt us there as the performance gap between iPhone 3 and iPhone 4S is huge and so far we were targeting the lowest common denominator. I am still not sure what to do about the older iPhones. W…

Hardly anyone runs on iOS3 and/or iPhone3 - do you have data showing this market segment is large? Weakening security for such a tiny market segment - I can't imagine that's worth it.

We don't collect any usage information.

About 18 months ago I removed support for iOS 3 and we got a huge pushback from existing users. I spent another month adding back iOS 3 support. I am sure things must be different now.

Re: Smartphone password managers are largely insecure

#13

Post by [deleted] »

roustem wrote: post #12
MattRogish wrote: post #11

Earlier quoted context omitted.

Hardly anyone runs on iOS3 and/or iPhone3 - do you have data showing this market segment is large? Weakening security for such a tiny market segment - I can't imagine that's worth it.

We don't collect any usage information. About 18 months ago I removed support for iOS 3 and we got a huge pushback from existing users. I spent another month adding back iOS 3 support. I am sure things must be different now.

[deleted]

Re: Smartphone password managers are largely insecure

#14

Post by imajes »

roustem wrote: post #12
MattRogish wrote: post #11

Earlier quoted context omitted.

Hardly anyone runs on iOS3 and/or iPhone3 - do you have data showing this market segment is large? Weakening security for such a tiny market segment - I can't imagine that's worth it.

We don't collect any usage information. About 18 months ago I removed support for iOS 3 and we got a huge pushback from existing users. I spent another month adding back iOS 3 support. I am sure things must be different now.

in other products which are very very non-tech consumer focused, i've seen almost zero iOS 3 deployment. You should feel incredibly comfortable deploying as iOS 5+ only at this point.

Re: Smartphone password managers are largely insecure

#15

Post by dorianj »

roustem wrote: post #10
dorianj wrote: post #8

Earlier quoted context omitted.

The crux of it: "1Password uses PBKDF2 to significantly slow down attackers. Currently this is not available on iOS as we needed to support older devices. The next major release of 1Password will only support iOS 5 and at that time we will be incorporating these additional defences" This is absolutely unacceptable. Agilebits has long talked about how they use PBKDF2 to secure your passwords, and using anything differ…

I agree. I am going to add the PBKDF2 strengthening and fix the problem with the PKCS#7 padding mentioned in the article. We plan to submit the 1Password update by the end of March. The support iOS 3 and the old devices really hurt us there as the performance gap between iPhone 3 and iPhone 4S is huge and so far we were targeting the lowest common denominator. I am still not sure what to do about the older iPhones. W…

Thank you for being forthright and responsive.

I think the better thing to do for older devices would have been to make it a user-settable option, with a note on first install. I would have preferred to have a 5 or even 10 second delay in opening my 1password keychain, rather than have it less secure. But it's a moot point now--as others noted, the older devices are quickly falling out of favor (at least among those savvy enough to use something like 1password).

Re: Smartphone password managers are largely insecure

#16

Post by pyre »

imajes wrote: post #14
roustem wrote: post #12

Earlier quoted context omitted.

We don't collect any usage information. About 18 months ago I removed support for iOS 3 and we got a huge pushback from existing users. I spent another month adding back iOS 3 support. I am sure things must be different now.

in other products which are very very non-tech consumer focused, i've seen almost zero iOS 3 deployment. You should feel incredibly comfortable deploying as iOS 5+ only at this point.

  >  i've seen almost zero iOS 3 deployment

  > You should feel incredibly comfortable deploying
  > as iOS 5+
A number seems to be missing there.

Re: Smartphone password managers are largely insecure

#17

Post by dpeck »

krupan wrote: post #9

In short, protect your device from physical access by untrusted people, and don't connect it to untrusted machines. Use a PIN or device password just in case someone else does get ahold of your device.

Don't connect to untrusted machines? As in, never connect to anything? What the point in having a smart phone then? (debatable why anyone needs one, I'm personally considering going to a dumb prepaid for cost/lack of need reasons)

I appreciate the paranoia, but it doesn't scale for normal users. With every page the users browses/app they install/etc there is a chance of the device executing code that's going to do something naughty. Operating under that assumption, one would hope that things like password managers would mitigate some of the long term effects of that, but as we see from this report that is not typically the case.

Re: Smartphone password managers are largely insecure

#18

Post by sirclueless »

ValG wrote: post #3

One Ring to Rule Them All... but seriously, interesting article; I think more interesting is the phone log-in password that all smart phones now have. I just read an article where the DOJ subpenaed Google to unlock an Android based phone because after several weeks of working on the log-in, they still couldn't get in. If you think about it, Password management software for your phone is really protected by 2 systems,…

That's not as important as you make it seem. They can crack the two independently, so it is at most a factor of 2 increase in security over just the stronger method.

Re: Smartphone password managers are largely insecure

#19

Post by azov »

MattRogish wrote: post #11
roustem wrote: post #10

Earlier quoted context omitted.

I agree. I am going to add the PBKDF2 strengthening and fix the problem with the PKCS#7 padding mentioned in the article. We plan to submit the 1Password update by the end of March. The support iOS 3 and the old devices really hurt us there as the performance gap between iPhone 3 and iPhone 4S is huge and so far we were targeting the lowest common denominator. I am still not sure what to do about the older iPhones. W…

Hardly anyone runs on iOS3 and/or iPhone3 - do you have data showing this market segment is large? Weakening security for such a tiny market segment - I can't imagine that's worth it.

People most definitely still use older phones. I use my iPhone 3G when I travel overseas because there's an easy unlock available for it (unlike the baseband on my current model). And password manager is one of the things I really want to work across all my devices. Actually, if I can't share 1password database between old and new phones, I'll probably be looking for a different password manager. Having said that, I obviously don't expect it to perform fast on older hardware.
Post reply on HN