Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser password managers – flawed security, by design

fractionalciso.com

Post reply on HN
Print view View original

121–127 of 127 posts

Re: Browser password managers – flawed security, by design

#121

Post by tomxor »

zokier wrote: post #90
tomxor wrote: post #81

Earlier quoted context omitted.

Because they are significantly more memorable than pw made from individually random chars without significantly reducing their strength. I have a handful of diceware passwords for important accounts i need to remember, and find that pretty easy... the rest are throwaway level unimportant or I leave to email based login. However I dictate password and security policies where I work, and don't have to adhere to stupid…

I have about 200ish passwords in my password manager. No matter how memorable any of those is individually, remembering 200 secure secrets is not practical. Nevermind the fact that many of those are used extremely rarely, good luck rembering diceware password that you use once in couple of years

That's fair, but I'd ask yourself: of those 200 how many are important enough to warrant a strong password? and of those how many are important and frequently used enough to need to be independent of email based authentication? Perhaps you don't need to remember as many as you think.

Re: Browser password managers – flawed security, by design

#122

Post by quickthrower2 »

olliej wrote: post #111
tmikaeld wrote: post #100

Earlier quoted context omitted.

Bitwarden is fully open source, both client and server - no lock-in.

You just need to be able to run your own server?

Yes, or go with their hosting, and the password manager design allows you to encrypt your data so even they can't get access to it.

Obviously this is quite the honeypot, so people will be trying to attack it in the general case. Browser bugs, JS bugs in extensions and such like are a risk.

If you want to be more paranoid (not a bad thing) you might need to do away with a password manager in the browser, and use an independent program like KeePass. More paranoid and you would run that program on it's own separate physical device.

There is a balance between security issues trusting someone else, and security issues rolling your own and screwing it up though.

For example is KeePass with password only less/more secure than LastPass with encryption key and password.

Re: Browser password managers – flawed security, by design

#123

Post by olliej »

quickthrower2 wrote: post #122
olliej wrote: post #111

Earlier quoted context omitted.

You just need to be able to run your own server?

Yes, or go with their hosting, and the password manager design allows you to encrypt your data so even they can't get access to it. Obviously this is quite the honeypot, so people will be trying to attack it in the general case. Browser bugs, JS bugs in extensions and such like are a risk. If you want to be more paranoid (not a bad thing) you might need to do away with a password manager in the browser, and use an in…

It shouldn't be a "and the design means that they can't access it" that should be the only behavior?

I agree with your other points

Assuming the LastPass encryption key is a separate token I would say LastPass wins, but that is solely assuming similar architecture, obviously you can make design decisions that mess up everything.

Re: Browser password managers – flawed security, by design

#124

Post by jjav »

WhyNotHugo wrote: post #78
hn_throwaway_99 wrote: post #27

Earlier quoted context omitted.

On reflection, I think this article is why I find it extremely difficult to hire qualified security experts. The vast majority of "security experts" I find tend to be "box tickers", who can require lots of rules like this ("don't use the built in password manager"), but whose advice is worse than useless because they don't understand the actual threat models. I know great security people exist, but in my experience I…

I feel that it's also very hard for people who understand security to put themselves out there. For people who actually care about security and not just compliance, there's no real job market at all. Companies never hire for this kind of role. So I think they're hard to find because there's no real market for them, there's little point in announcing themselves and their expertise since there's really [almost] nobody…

> For people who actually care about security and not just compliance, there's no real job market at all. Companies never hire for this kind of role.

Can't agree more! This is the sad truth as you say.

This is the space I work in and to find a team who actually cares about building a secure product against reasoned threat models is as rare as winning the lottery.

Roles with great pay are easy to find in the policy and process side of security though.

Re: Browser password managers – flawed security, by design

#125

Post by denton-scratch »

olliej wrote: post #106
denton-scratch wrote: post #85

Earlier quoted context omitted.

Having a "secure element", enclave or whatever, doesn't mean that some rando TPA app is using it. I'm not qualified to inspect the source-code of Android apps. As far as I'm conceerned, these enclaves aren't for my protection; they're there to protect the interests of the device's owners (which isn't me). A smartphone OS runs under the supervision of another OS, which is proprietary - source-code not supplied. A lot…

I agree on the TPA not using the secure element on the phone is an issue, but I wasn't addressing low quality authenticator apps, but for apps or for tokens you're assuming that the developers haven't cheaped out. > A smartphone OS ... Yes, and the same applies to tokens albeit with simpler logic, and the same applies to any PC. So at some point you're saying "I trust that the company producing the product I'm using…

> all your devices are opaque

Point taken.

I'd take a maximum transparency keyfob-type device. By "maximum transparency", I mean I'd have to be able to assemble it myself, from COTS components, and understand any software it runs. But I have no idea how to make such a thing (I've tinkered a bit with microcontrollers and TTL).

The closest I'm aware of is the fob my bank gave me; it has a number-pad and a display, you read a challenge off the screen, and trype it into the keypad. It displays numeric response, and you type it into the website form.

That seems cool, if I could build the device myself, or even know what it does.

Re: Browser password managers – flawed security, by design

#126

Post by KronisLV »

jeroenhd wrote: post #116
denton-scratch wrote: post #73

Earlier quoted context omitted.

> I disagree with the idea that the password managers built into your browser are somehow superior. I use Password Safe. It doesn't integrate with my browser, and the database is stored locally. So I'm exposed to no threat from the subscription company; and there's no content script. It's easy to back-up the database. I can store the database and the Password Safe program on a memory stick. And I can use the password…

I don't like copy/pasting passwords. Many computers have a clipboard log these days and you never know what program is polling for your clipboard contents. Mobile apps used to do this all the time and I don't believe for a second that shitty trackers and other such online stalkerware doesn't try to get the contents of your clipboard. I use an integrated browser mostly so I don't need to go through my clipboard, even…

> I don't like copy/pasting passwords.

A nice feature that some local password managers like KeePass have is that you can auto type them, so the actual password doesn't end up in the clipboard.

Of course, personally I'm not a fan of the idea of the command being interpreted incorrectly or messing up window switching so that my password would be sent to the wrong application.

Re: Browser password managers – flawed security, by design

#127

Post by tmikaeld »

quickthrower2 wrote: post #122
olliej wrote: post #111

Earlier quoted context omitted.

You just need to be able to run your own server?

Yes, or go with their hosting, and the password manager design allows you to encrypt your data so even they can't get access to it. Obviously this is quite the honeypot, so people will be trying to attack it in the general case. Browser bugs, JS bugs in extensions and such like are a risk. If you want to be more paranoid (not a bad thing) you might need to do away with a password manager in the browser, and use an in…

Bitwarden also has an independent app (also open source), in case you don't want to use the browser.
Post reply on HN