Browser password managers – flawed security, by design • Hacker News Board

Re: Browser password managers – flawed security, by design

#101

Post by throwawayffffas » Mon, Aug 15, 2022, 3:32 PM UTC

lucideer wrote: post #95

throwawayffffas wrote: post #89

Earlier quoted context omitted.

It's not in transit, it's the equivalent of storing your passwords in plaintext, which I don't think can be actually defended as a good practice. Regardless the question that arises which is a lot more worrisome is what happens when you turn on synchronization on these browsers? Do they encrypt the passwords with a key only you know? Or do they just ship the "encrypted" passwords along with the key, so that your pass…

> which I don't think can be actually defended as a good practice Allow me to try defending it: Even storing your passwords in plaintext locally using an integrated password manager would: 1. discourage password reuse 2. usually encourage generated strong passwords/phrases (best password is one you don't know) 3. allow easy automated password auditing 4. prevent phishing-based credential capture via domain matching J…

> If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable.

My guess would be that they use the users authentication credentials, but I am not confident that they do.

Re: Browser password managers – flawed security, by design

#102

Post by m8s » Mon, Aug 15, 2022, 3:45 PM UTC

aaronbrethorst wrote: post #41

m8s wrote: post #39

Earlier quoted context omitted.

I recently had to tell my bank, with my voice over the phone, that the make and model of my first car were the three random words 1Password generated for me. “Yes, the make and model of my first car was… a Venerated Breakfast Platoon.”

I hope you either made up that code or changed it after posting this.

That was obviously not the actual code :)

Re: Browser password managers – flawed security, by design

#103

Post by denton-scratch » Mon, Aug 15, 2022, 4:08 PM UTC

MattPalmer1086 wrote: post #69

denton-scratch wrote: post #67

Earlier quoted context omitted.

> When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. /me not a security expert. But isn't this the mistake I used to make for years: to believe that the hacker is a human, responding to his environment and making decisions? It took me a long time to acknowledge that nearly all network attacks are automated, and unle…

It can either be a human directing it once a foothold is established, or an automated attack. Initial compromise may be automated but lateral movement is harder to automate. If you work on highly sensitive systems then you should expect a human in the loop at some point.

> If you work on highly sensitive systems

I don't; I'm retired. I have only my home network to fret about. I don't have data to lose, but I don't want some rotter using my network to attack other networks. That rotter isn't going to set up automation to grab my family photos; but he'll use automation to attack other networks.

I've never worked with "highly sensitive systems", as far as I'm aware. I've only ever worked with systems that had the potential to wreck the company. I don't know if that counts, in your book.

Re: Browser password managers – flawed security, by design

#104

Post by denton-scratch » Mon, Aug 15, 2022, 4:14 PM UTC

GekkePrutser wrote: post #84

denton-scratch wrote: post #67

Earlier quoted context omitted.

> When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. /me not a security expert. But isn't this the mistake I used to make for years: to believe that the hacker is a human, responding to his environment and making decisions? It took me a long time to acknowledge that nearly all network attacks are automated, and unle…

The big news headlines like wannacry were fully automated. But one-trick ponies. If you had patched you were fine. What made it a problem was that so many hadn't. But the sinister targeted ones where you only find out because someone is selling terabytes of confidential data, those are usually highly targeted and manual. It's very hard to automate and stay under the radar. You need protection against both.

> But the sinister targeted ones where you only find out because someone is selling terabytes of confidential data, those are usually highly targeted and manual.

It doesn't surprise me that "sinister targeted" attacks are also "usually highly targeted".

Re: Browser password managers – flawed security, by design

#105

Post by MattPalmer1086 » Mon, Aug 15, 2022, 5:05 PM UTC

denton-scratch wrote: post #103

MattPalmer1086 wrote: post #69

Earlier quoted context omitted.

It can either be a human directing it once a foothold is established, or an automated attack. Initial compromise may be automated but lateral movement is harder to automate. If you work on highly sensitive systems then you should expect a human in the loop at some point.

> If you work on highly sensitive systems I don't; I'm retired. I have only my home network to fret about. I don't have data to lose, but I don't want some rotter using my network to attack other networks. That rotter isn't going to set up automation to grab my family photos; but he'll use automation to attack other networks. I've never worked with "highly sensitive systems", as far as I'm aware. I've only ever worke…

Potential to wreck the company counts pretty high in my book!

My own home security is merely adequate. I turn off things like upnp on the router. Disks and backups are encrypted. I don't worry overly much about it. If someone actually targets me it's probably game over, but it's ok against random script kiddies or someone stealing my computers.

Re: Browser password managers – flawed security, by design

#106

Post by olliej » Mon, Aug 15, 2022, 5:16 PM UTC

denton-scratch wrote: post #85

olliej wrote: post #77

Earlier quoted context omitted.

I had assumed that at this point all android phones have got some equivalent to the secure element present in all apple products produced in the last 5+ years, if they don't that's bananas. Assuming that, a phone is likely one of the most secure devices that you own.

Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me). A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot…

I agree on the TPA not using the secure element on the phone is an issue, but I wasn't addressing low quality authenticator apps, but for apps or for tokens you're assuming that the developers haven't cheaped out.

> A smartphone OS ...

Yes, and the same applies to tokens albeit with simpler logic, and the same applies to any PC. So at some point you're saying "I trust that the company producing the product I'm using is not lying in their security documentation".

> .. Reviews ...

Correct, because reviewers are talking about feature set, competent phone companies provide extensive documentation of the security architecture of the devices. Security researchers periodically write up their investigations.

> These are opaque devices, with a huge attack surface.

No, by the standards you have presented all your devices are opaque, but unlike every other device you own the default security model of a well designed phone is far stronger than any other device you have. They don't run arbitrary code, they don't support loading code into kernel space, user partitions are completely separated from the read only system partitions, etc.

Re: Browser password managers – flawed security, by design

#107

Post by GekkePrutser » Mon, Aug 15, 2022, 5:17 PM UTC

denton-scratch wrote: post #104

GekkePrutser wrote: post #84

Earlier quoted context omitted.

The big news headlines like wannacry were fully automated. But one-trick ponies. If you had patched you were fine. What made it a problem was that so many hadn't. But the sinister targeted ones where you only find out because someone is selling terabytes of confidential data, those are usually highly targeted and manual. It's very hard to automate and stay under the radar. You need protection against both.

> But the sinister targeted ones where you only find out because someone is selling terabytes of confidential data, those are usually highly targeted and manual. It doesn't surprise me that "sinister targeted" attacks are also "usually highly targeted".

Lol yeah not my best writing. Agreed

Re: Browser password managers – flawed security, by design

#108

Post by throwaway81523 » Mon, Aug 15, 2022, 5:43 PM UTC

lucideer wrote: post #11

This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. The author / website does seem to be offering services in the security industry, but they seem compliance-focused rather than security-focused (compliance is a component of security). So likely offering legal & administrative expertise rather than technical.

It would also be great if someone could get the author a Twitter account. I usually hate twitter but this seems like a 2000+ word article that could have been stated in a couple of tweets.

Re: Browser password managers – flawed security, by design

#109

Post by WorldMaker » Mon, Aug 15, 2022, 5:48 PM UTC

zokier wrote: post #62

lsh123 wrote: post #9

As usual with security discussions, one needs to start from analyzing security threats and attack vectors. Is a simple to memorize and likely multi-use password is a bigger security threat than a unique, hard to guess passwords in a file storage? It depends. Is this a laptop without disk encryption that travels a lot and especially internationally? Sure, these semi-unencrypted passwords on disk are likely not very sa…

> Is this a laptop without disk encryption that travels a lot and especially internationally? If yes then password storage is not the thing you should be concerned about. There is no excuse for not having FDE on laptops in 2022.

Even Windows Home SKUs have been trying to gently move casual home users (which today are most likely to be using laptops) to FDE in 2022. It's one of the reasons for the Microsoft Account requirement that is much maligned to a sector of HN commenters. A trade off to using Microsoft Accounts for login is that Microsoft knows you have a recovery path for FDE keys and can enable FDE on your behalf, which in isolation is a good idea for casual home users. (Whatever you think about the other implications of needing a Microsoft Account for a personal casual use device.)

Re: Browser password managers – flawed security, by design

#110

Post by olliej » Mon, Aug 15, 2022, 6:01 PM UTC

nl wrote: post #83

olliej wrote: post #31

Earlier quoted context omitted.

I disagree here, suspicion is not warranted - I'd prefer that they support additional non-sms 2FA paths, but supporting SMS based 2FA has many benefits for a company beyond being "lazy" SMS is vastly better than nothing, and it has the benefit of not requiring users install random software that they (a) don't know how to install, (b) don't know how to use, (c) don't have a recent enough device to use, (d) you don't n…

TOTP should run on any smartphone, including phones that are much older than 2 years.

Huh, you're correct those apps have much longer support than I expected - but did not check :( - from free apps (though I guess Google Authenticator is backed a small immigrant business :D ), thanks for pointing out my error, I'd fix my comment but can no longer edit things.

What I was trying to say there are a _lot_ of very old smart phones in poor communities, and they're still in use. I searched craigslist in very poor parts of the US and I can find quite a few phones that are running android Not intended as a correction to your comment, but just as a backup for my statement that plenty of phones still can't use TOTP apps, the cheapest phones with t-mobile are not smartphones, and the cheapest ones on amazon are not running a recent enough android, and some even run Windows OS?!?!?!