Earlier quoted context omitted.
Just the built in managers. Other are worse: they do vendor locking for profit.
Bitwarden is fully open source, both client and server - no lock-in.
You just need to be able to run your own server?
Browser password managers – flawed security, by design
111–120 of 127 posts
Re: Browser password managers – flawed security, by design
#112I get asked for my windows password when I try to view the passwords, are they not encrypted by windows?
No, the prompt just unlocks the UI. Otherwise you'd be asked for your Windows password every time you auto-fill a password.
Really? I would have assumed that they do what keychain on macOS does which is password gate the decryption key, so it's good to know they're just sitting on disk somewhere. It's a shame as half assed stuff like this is why people don't trust these tools :-/
Re: Browser password managers – flawed security, by design
#113If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.
Compromised sessions is not necessarily a concern, unless the attacker has physical access to the location, since systems can detect if the location changes. E.g. Ip address change prompts the user. Not perfect, and hugely inconvenient for people with dynamic IPs. AND filesystem access IS a concern, and that is not just if someone has physical access. E.g. You do not know for sure that the code running on your own sy…
> Compromised sessions is not necessarily a concern, unless the attacker has physical access to the location, since systems can detect if the location changes. E.g. Ip address change prompts the user.
I don't think that's a valid approach anymore. FWIW I have coded these restrictions into auth tokens before (i.e. reject the auth token if it's from a new IP), but had to get rid of it because too many ISPs frequently change a user's IP address, especially mobile clients.
Re: Browser password managers – flawed security, by design
#114> Note – many of these dedicated password managers have browser plugins or extensions to help users save and fill passwords. These are very different and much more secure than the built-in password managers that are the subject of this article! This is a shitty article from someone who doesn't really know what he's talking about. Here is a post from Tavis Ormandy, well-known security expert at Google Project Zero, ad…
Although I trust Tavis Ormandy more than this random blog post, I disagree with the idea that the password managers built into your browser are somehow superior. I use Bitwarden and there's simply no comparison between what Firefox/Chrome offer me and what Bitwarden offers; you can't even add an extra field to the browser password manager and Google helpfully "encrypts" your data with the password they're already rec…
FWIW, I agree with everything you've written. My point is that it's very clear to see that Tavis Ormandy understands at a very deep level the tradeoffs and threat vectors of browser-implemented password managers vs. password-manager plugins. You may not come to the same conclusion he does, but Ormandy's position is not due to a lack of understanding
That is in contrast with this blog post author who fundamentally doesn't understand what he's talking about.
Re: Browser password managers – flawed security, by design
#115TIL. I enabled master password on my work browser before I finished reading the article.
Seems obvious now
Re: Browser password managers – flawed security, by design
#116Earlier quoted context omitted.
Although I trust Tavis Ormandy more than this random blog post, I disagree with the idea that the password managers built into your browser are somehow superior. I use Bitwarden and there's simply no comparison between what Firefox/Chrome offer me and what Bitwarden offers; you can't even add an extra field to the browser password manager and Google helpfully "encrypts" your data with the password they're already rec…
> I disagree with the idea that the password managers built into your browser are somehow superior. I use Password Safe. It doesn't integrate with my browser, and the database is stored locally. So I'm exposed to no threat from the subscription company; and there's no content script. It's easy to back-up the database. I can store the database and the Password Safe program on a memory stick. And I can use the password…
I don't like copy/pasting passwords. Many computers have a clipboard log these days and you never know what program is polling for your clipboard contents. Mobile apps used to do this all the time and I don't believe for a second that shitty trackers and other such online stalkerware doesn't try to get the contents of your clipboard.
I use an integrated browser mostly so I don't need to go through my clipboard, even though Bitwarden has a setting to auto clear the clipboard after copying a password.
Re: Browser password managers – flawed security, by design
#117If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.
You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…
2fa doesn’t get triggered onsite for my employer, only remote IPs.
Re: Browser password managers – flawed security, by design
#118This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. The author / website does seem to be offering services in the security industry, but they seem compliance-focused rather than security-focused (compliance is a component of security). So likely offering legal & administrative expertise rather than technical.
It would also be great if someone could get the author a Twitter account. I usually hate twitter but this seems like a 2000+ word article that could have been stated in a couple of tweets.
I always upvote the random maligning of Twitter
Re: Browser password managers – flawed security, by design
#119Earlier quoted context omitted.
You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…
> When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. /me not a security expert. But isn't this the mistake I used to make for years: to believe that the hacker is a human, responding to his environment and making decisions? It took me a long time to acknowledge that nearly all network attacks are automated, and unle…
One thing I think isn't widely appreciated is that insecurity is a highly developed market.
People still have this idea of the lone hooded hacker doing everything from their bedroom.
In reality, people specialise in different aspects of cracking security and sell what they have to someone else. So someone is in the market for a zero day, or a compromised system in the government or a company, and they can just buy that.
For home users, the payoff isn't big enough to be worth more than automated type attacks. So you escape the human in the loop mostly.
Re: Browser password managers – flawed security, by design
#120Earlier quoted context omitted.
You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…
2fa doesn’t get triggered onsite for my employer, only remote IPs.
Well, better than nothing. Most places I've worked do not have ubiquitous 2fa. And it's mostly just a gate to gain access, rather than something required to maintain access.