Kaspersky Password Manager: All your passwords are belong to us

Post by CJefferson » Thu, Jul 08, 2021, 10:05 AM UTC

dchest wrote: post #108

CJefferson wrote: post #86

Earlier quoted context omitted.

This is one of those areas where security in depth is a good idea. Gather all the sources of random sources you can and hash them together -- add in any information based on user input (key presses / mouse movements), and personally I'd provide each users with a securely generated random 1K string (which could be sent once at install) to provide more random data.

getRandomValues() already takes input from keyboard and mouse interrupts (via the OS PRNG) and lots of other sources, no need to create own bug-ridden implementations of the same thing.

That's true for good implementarions, but is it true for all implementations? I don't know, but I'd be worried about it.

Post by esnard » Thu, Jul 08, 2021, 1:16 PM UTC

aidenn0 wrote: post #120

Blikkentrekker wrote: post #73

Earlier quoted context omitted.

What I've been wondering for a long time is how do these two passwords compare: hiKxChDiaHNAtgVz vis-à-vis : kähdikyylkönekkimahdakerttaksa One is a 16 random `[a-zA-Z0-9]` characters, the other is a 32 character long nonce word, containing and among others that conforms to Finnish phonology, but otherwise is devoid of any meaning and phonology but easier to remember to speakers of Finnish. One is a 16. Does 32 char…

It depends on your threat model. The simplest analysis assumes that the attacker knows how you are generating your password. There are 36^16 possible passwords with the first scheme. I don't know how you generated the second. One way of doing it would be to generate all valid Finnish syllables and select randomly from that. If the number of possible syllables raised to the power of the number of syllables in your pas…

Minor nitpick: there are 62^16 possibles passwords in the fist scheme (passwords are case-sensitive in almost every scenario).

Re: Kaspersky Password Manager: All your passwords are belong to us

Re: Kaspersky Password Manager: All your passwords are belong to us