Smartphone password managers are largely insecure • Hacker News Board

Re: Smartphone password managers are largely insecure

#21

Post by skymt » Mon, Mar 19, 2012, 9:45 PM UTC

dpeck wrote: post #17

krupan wrote: post #9

In short, protect your device from physical access by untrusted people, and don't connect it to untrusted machines. Use a PIN or device password just in case someone else does get ahold of your device.

Don't connect to untrusted machines? As in, never connect to anything? What the point in having a smart phone then? (debatable why anyone needs one, I'm personally considering going to a dumb prepaid for cost/lack of need reasons) I appreciate the paranoia, but it doesn't scale for normal users. With every page the users browses/app they install/etc there is a chance of the device executing code that's going to do so…

I assume krupan meant never physically connect a smartphone to an untrusted PC. (That's one of the two methods for obtaining an encrypted password database described in the paper.)

Re: Smartphone password managers are largely insecure

#22

Post by skymt » Mon, Mar 19, 2012, 10:10 PM UTC

mdc wrote: post #4

Sorry to see iKeePass missing from the analysis.

I was curious about KeePass as well, so I downloaded the source. I haven't done anything resembling a source audit, so I can't speak to implementation flaws, but the design seems solid (to my admittedly amateur eyes).

KeePass databases are AES-encrypted with a 256-bit key. The key is generated from your passphrase with a user-configurable number of bcrypt rounds, followed by a single SHA-256 round, to reduce it to the 256 bits needed by AES.

Re: Smartphone password managers are largely insecure

#23

Post by acqq » Tue, Mar 20, 2012, 7:29 AM UTC

Conclusion from the article:

"Many password management apps offered on the market do not provide adequate level of security. We strongly encourage users not to rely on their protections but rather use iOS or BlackBerry security features.

For Apple users: set up a passcode, and a (complex!) backup password. Do not plug the unlocked device to computers you do not trust to prevent creation of pairing. If you can't encrypt backup for some reason, restrict access to it as much as possible."