Browser Extension Password Managers Exposing Passwords Everywhere • Hacker News Board

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#21

Post by euank » Sat, Dec 21, 2013, 1:46 AM UTC

y0ghur7_xxx wrote: post #6

Nerdfest wrote: post #2

Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.

Why NON--browser-integrated? What's wrong with the one integrated in the browser?

Read the article - each attack it mentions only applies to browser-integrated ones.

If instead you mean "browser-integrated" as in the default "remember my password", well, those are not what this paper discusses and are generally better, though they are still not as desirable as a standalone less-privileged manager.

The idea that the password manager should be separate is practically common sense. Browsers provide more surface are for attack. Browsers are made to share content and work with network data. Ideally, your password manager should never touch the network ever. It has no need to.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#22

Post by MetaCosm » Sat, Dec 21, 2013, 1:53 AM UTC

subsection1h wrote: post #13

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…

... this doesn't sound easier, this sounds much more annoying. But each to is own.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#23

Post by subsection1h » Sat, Dec 21, 2013, 2:18 AM UTC

MetaCosm wrote: post #22

subsection1h wrote: post #13

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…

... this doesn't sound easier, this sounds much more annoying. But each to is own.

I didn't assert that it was easier, just potentially more secure. Similarly, it's arguably annoying to only access financial accounts (and the email accounts that are associated with the financial accounts) using a dedicated banking computer, but I think that having a banking computer is worth it. Others will disagree.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#24

Post by robszumski » Sat, Dec 21, 2013, 2:21 AM UTC

ximeng wrote: post #12

Is there a good, ideally free password manager that works on Android, iPhone, and the web? Any recommendations?

MacPass makes the client tolerable on OSX too:

https://github.com/mstarke/MacPass

It's alpha but been stable for me for a month or two.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#25

Post by HaloZero » Sat, Dec 21, 2013, 2:30 AM UTC

eknkc wrote: post #8

Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…

I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#26

Post by josephwegner » Sat, Dec 21, 2013, 2:46 AM UTC

Shameful plug... sorry..

I actually just released an account manager for Chrome, called Waltz. Waltz uses Clef (http://getclef.com) for multi-factor auth, and then submits using preconfigured login URLS - not heuristics like most other password managers.

After a semi-thorough read of the article, I don't believe Waltz falls into any of the security holes mentioned in the article.

http://getwaltz.com

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#27

Post by donniezazen » Sat, Dec 21, 2013, 2:48 AM UTC

sixbrx wrote: post #11

BadassFractal wrote: post #5

How bad is it for LastPass? I've used KeePass for a while, but the convenience of LastPass is such a killer feature :(

Basically you just need to turn off auto-login and auto-fill on all sites, no matter what your password manager is. All of the attacks depended on those two features, from what I could tell from a quick scan of the paper.

Can you do that globally?

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#28

Post by judk » Sat, Dec 21, 2013, 2:53 AM UTC

eknkc wrote: post #8

Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…

Are you saying that yahoo web mail lets senders create forms with submit actions? That's.. Horribly broken.

But tumbler allows JavaScript redirects to phishing sites, so yahoo standard I guess.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#29

Post by ryan-c » Sat, Dec 21, 2013, 2:55 AM UTC

Guvante wrote: post #3

Nerdfest wrote: post #2

Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.

I am curious, is there a way to do OTPs with offline databases? I tried poking around with the add-in, but couldn't quite determine whether the implementation could properly protect from replay attacks, most notably whether a copy of the xml file used and the matching old OTP would be enough to unlock a newer database file.

It's impossible to use OTP as part of an encryption key without some sort of oracle that could do the decryption without the OTP.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#30

Post by CurtMonash » Sat, Dec 21, 2013, 3:03 AM UTC

eknkc wrote: post #8

Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…

Everybody needs a few critical passwords that they should memorize and not use shortcuts with. My email and Paypal passwords are very strong; to break them you have to either keylog/shouldersurf/whatever, or else brute force an attack for quite a few characters. Nor will you find joy with alternate ways of getting in, such as security questions. If I used a password manager, its password would be another critical one, but even so I probably wouldn't use it for accessing my other crucial accounts.

A lot of my other accounts can be more easily hacked, but relatively little harm would be done if they were. I think one of my MMO accounts -- to a game I no longer play -- actually was.