Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser password managers – flawed security, by design

fractionalciso.com

Post reply on HN
Print view View original

21–30 of 127 posts

Re: Browser password managers – flawed security, by design

#21

Post by plaguepilled »

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

SMS TOTP is indeed bad and your suspicion is well warranted.

Its a lazy way to implement 2-factor authentication and exposes the user to MITM attacks as well as a host of other nastiness.

U2F (stuff like what Google Authenticator does) is way better and less phone dependent. The only reason a team would opt for TOTP if they had the resources to implement U2F is because its a good way to get your phone number.

Edit: embarrassingly I've made an error in my use of acronyms. What I refer to as TOTP is in fact plaintext OTP sent via SMS, and what I refer to as U2F is actually app-based TOTP. Apologies!

Re: Browser password managers – flawed security, by design

#22

Post by olliej »

torstenvl wrote: post #3

Even if the user doesn't turn on a master password, having the key in a predictable place on an encrypted volume with appropriate access permissions is still far more secure than sticky notes on the monitor. Contrary to the OP link's statement, it isn't enough for the attacker to get access to the user's system, they have to get access to the user's account. And if the organization in question isn't using Bitlocker o…

I'm sorry, but this view is fundamentally incorrect.

You have to consider what the actual threat model is. The reality is that your primary threat model is not going to be one employee compromising another's, nor is it someone malicious physically tracking down your employees and stealing and/or physically compromising their devices.

Those threats do technically exist, but your employees have to be extraordinarily valuable to warrant the surveillance required to use physical access to compromise them/their account. It is vastly more likely that the attack vector is going to be spam/scam/phishing leading to malicious software installed on the victim's machine. Notably in regard to the post-it/notebook you claimed was the worst option, computers generally can't read post it notes attached to the monitor.

Similarly bit locker and FileVault are obviously important, but do nothing at all to stop a remote attacker, because the only threat model that they protect against is physical access to the hardware. If a remote attacker has got some malicious software installed, then by definition once it's running all the drive content is available to the attacker's software (technically SIP should limit this on macOS, but I'll assume that an attacker also compromises SIP).

But it is extremely important to understand that in none of these cases did the attacker need to get "access to the user's account" - that was simply a byproduct of their primary attack.

Re: Browser password managers – flawed security, by design

#23

Post by hn_throwaway_99 »

> Note – many of these dedicated password managers have browser plugins or extensions to help users save and fill passwords. These are very different and much more secure than the built-in password managers that are the subject of this article!

This is a shitty article from someone who doesn't really know what he's talking about. Here is a post from Tavis Ormandy, well-known security expert at Google Project Zero, advocating the exact opposite: https://lock.cmpxchg8b.com/passmgrs.html

Re: Browser password managers – flawed security, by design

#24

Post by politelemon »

modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

> You need hardware second factor tokens.

Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.

Re: Browser password managers – flawed security, by design

#25

Post by quickco »

A lot of the criticism of this article seems to be: “If they already have access to your local file system, you already have bigger problems”

What about defence in depth?

This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers.

So this article is bringing attention to a weakness in the browser’s built-in password managers, and suggesting a very viable and easy-to-adopt solution.

Why the strong criticism of this article?

Re: Browser password managers – flawed security, by design

#26

Post by rexf »

wetpaws wrote: post #18
aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

I switched to Google Voice after changing my phone number a couple of times and going through the 2fa replacement hell.

I use GV, but it's really tough to use with many sites. Many sites will detect the non-cellphone (virtual) nature of the number and require a different (cellphone backed) number.

Yesterday, I put my GV number in the DALL·E sign up and it wouldn't let me proceed. So I abandoned the sign up flow.

Re: Browser password managers – flawed security, by design

#27

Post by hn_throwaway_99 »

lucideer wrote: post #11

This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. The author / website does seem to be offering services in the security industry, but they seem compliance-focused rather than security-focused (compliance is a component of security). So likely offering legal & administrative expertise rather than technical.

On reflection, I think this article is why I find it extremely difficult to hire qualified security experts.

The vast majority of "security experts" I find tend to be "box tickers", who can require lots of rules like this ("don't use the built in password manager"), but whose advice is worse than useless because they don't understand the actual threat models.

I know great security people exist, but in my experience I wasn't able to find them, and instead just decided to learn the most important things myself (I'm an application engineer who felt I had a good grasp of things around application security, but less so around infrastructure and corporate IT security).

Re: Browser password managers – flawed security, by design

#30

Post by tomxor »

modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

> Using a password manager without a master password is way more secure than not using a password manager at all.

I disagree, diceware AND hardware security keys, is stronger, no password manager needed at all.

However I agree the article is overblown. For most people, browser based password managers are probably a vast improvement, since most will likely never educate themselves on such things or accept the solutions as personally viable. The browser is right there and even prompts them into using it.

Post reply on HN