Password Managers • Hacker News Board

Re: Password Managers

#261

Post by brabel » Sun, Jun 06, 2021, 9:04 AM UTC

kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

> exploiting a browser-based password manager likely means escaping the sandbox that contains web pages and accessing the shadow DOM

Any PM that injects a script into the DOM is vulnerable, as the article explains, because the script runs with the exact same privilleges as everything else in the DOM (so the existing DOM can mess with your script or with the changes your script tries to make).

Also, the shadow DOM has nothing to do with security in any way. It's trivial to work around it whether it's closed or not. See https://blog.revillweb.com/open-vs-closed-shadow-dom-9f3d742... for example on how to do that.

Re: Password Managers

#262

Post by oefrha » Sun, Jun 06, 2021, 9:05 AM UTC

CyberRage wrote: post #253

oefrha wrote: post #250

Earlier quoted context omitted.

> https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso... That’s a clickjacking vulnerability. Gp post discussed why UI should be out-of-DOM. > https://www.csis.dk/newsroom-blog-overview/2021/moserpass-su... I’m not familiar with the password manager here, but that's a CDN compromise causing auto-update to download a malicious dll. Of course voluntarily installing malicious code is a game-over scenario unrela…

The point is(just gave a couple of examples for issues in the past related to web based PM's) that extensions have tremendous attack surface and lots of complicated little things you have get perfectly right. kbuck made it seem like there's just a single issue here that can be avoided. that's not true.

Program binary delivery CDN compromise is completely orthogonal to whether the password manager is "web based". Upon some cursory research, the compromised Passwordstate thing is an on-prem enterprise solution, the upgrade package compromised looks like an asp.net application meant to be placed on a server. I guess you can call it compromise of a web-based password manager... But you can compromise native programs the exact same way if you get ahold of the update CDN. Using it as an example is weird.

Re: Password Managers

#263

Post by whereistimbo » Sun, Jun 06, 2021, 9:08 AM UTC

closeneough wrote: post #232

I would NOT recommend the chrome password manager. If you sync your passwords, they will not be stored encrypted at the google side. You need to specifically set password encryption in the settings. I've also spend a lot of time with understanding password managers in my master thesis. What I can recommend is: https://pfp.works/ The creator was auditing password managers like LastPass, found a lot of issues, and used…

Isn't it encrypted using the Google Account credential, if you don't specifically set a password?

Re: Password Managers

#264

Post by CyberRage » Sun, Jun 06, 2021, 9:18 AM UTC

oefrha wrote: post #262

CyberRage wrote: post #253

Earlier quoted context omitted.

The point is(just gave a couple of examples for issues in the past related to web based PM's) that extensions have tremendous attack surface and lots of complicated little things you have get perfectly right. kbuck made it seem like there's just a single issue here that can be avoided. that's not true.

Program binary delivery CDN compromise is completely orthogonal to whether the password manager is "web based". Upon some cursory research, the compromised Passwordstate thing is an on-prem enterprise solution, the upgrade package compromised looks like an asp.net application meant to be placed on a server. I guess you can call it compromise of a web-based password manager... But you can compromise native programs th…

I see, definitely valid criticism. Cannot edit my comment now.

My point wasn't the specific incident that was linked but more about the fact that updates are a threat for extensions as they update automatically without user input

Re: Password Managers

#265

Post by tarsiec » Sun, Jun 06, 2021, 9:18 AM UTC

The problem described doesn’t apply at all with external password managers. Pass hosted in a git repo is still the best.

Re: Password Managers

#266

Post by gspr » Sun, Jun 06, 2021, 9:19 AM UTC

ajross wrote: post #183

I just keep a (symmetrically) encrypted secrets file on my main work machine with a strong pass phrase stored in a gpg-agent. It's simple (emacs will happily transcrypt it simply by opening it) and amenable to straightforward backup/duplication wherever I need it, though obviously it does assume a command line and that I'm not exclusively on a phone or whatever (not that that's impossible, but...). It also has the ad…

Sounds like you have a good system. If you ever find yourself wanting some more convenience commands around a system that's just like what you describe, I wholeheartedly recommend Pass [1]. It's exactly like your homebuilt setup, but with a bunch of convenience commands and git integration built in.

[1] https://www.passwordstore.org/

Re: Password Managers

#267

Post by [deleted] » Sun, Jun 06, 2021, 9:21 AM UTC

ben0x539 wrote: post #207

noahtallen wrote: post #200

Earlier quoted context omitted.

This is a recent development, but 1Password is now available on Linux as a native program, and it’s probably my favorite implementation! https://1password.com/downloads/linux/

I have this installed but I have no idea how to make it put passwords into a given password field, or save the password as I'm setting one somewhere, so I went back to the browser addon. I think I'm getting too old to copy+paste passwords by hand. :/

[deleted]

Re: Password Managers

#268

Post by ubercow13 » Sun, Jun 06, 2021, 9:25 AM UTC

brabel wrote: post #261

kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

> exploiting a browser-based password manager likely means escaping the sandbox that contains web pages and accessing the shadow DOM Any PM that injects a script into the DOM is vulnerable, as the article explains, because the script runs with the exact same privilleges as everything else in the DOM (so the existing DOM can mess with your script or with the changes your script tries to make). Also, the shadow DOM has…

Why does that matter if the content script doesn’t have privileged access to anything itself?

Re: Password Managers

#269

Post by fredsted » Sun, Jun 06, 2021, 9:34 AM UTC

I've always found password manager browser extensions to be finicky and brittle. They never really seem to work all that good, and as the author writes, the security is bad. I much prefer just copying the credentials from another application.

Re: Password Managers

#270

Post by KronisLV » Sun, Jun 06, 2021, 9:36 AM UTC

tialaramex wrote: post #172

KronisLV wrote: post #41

Earlier quoted context omitted.

> Passwords are a lost cause. I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? What's to prevent me from using a similarly long, randomly generated secret as my password, using a different one for every site? Because that's what I'm doing with KeePass. Backing up the auth database/file and having enough redundancy in place, as well as ha…

> I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? No. I find it easiest to keep this straight in my head with a line from the U2 song "The Fly", "a secret is something you tell one other person". You're thinking of Ed25519 private keys, you mustn't tell those to anybody and they're minted as a pair with a public key you can tell to ever…

This makes me wonder about something else: why not just hash the passwords client side and send the hashed value to the server? Better yet, why not make the hashes salted with something like a timestamp (similarly to how TOTP works), so that those hashes couldn't be reused later?

What's inside of the private key is a long secret (albeit not a shared one), a password also feels like it should be a secret that's not shared. So why hasn't the industry made that happen? Why can't we have solutions where one's password does not leave their browser?