Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Kaspersky Password Manager: All your passwords are belong to us

donjon.ledger.com

Post reply on HN
Print view View original

31–40 of 122 posts

Re: Kaspersky Password Manager: All your passwords are belong to us

#31

Post by varjag »

nix23 wrote: post #16
varjag wrote: post #3

Earlier quoted context omitted.

Kaspersky's Advanced School of KGB graduation photos: https://cs6.pikabu.ru/post_img/big/2017/07/04/11/14991974131...

KGB school student and later KGB officer...sounds plausible. BTW: that whole thing must be before 1991 (KGB) and kaspersky was founded in 1997 (where KGB wasn't anymore).

KGB was renamed and split into four agencies (FSB, SVR, FAPSI and FSK) that were later merged down back to FSB and SVR. There are still KGB people working there that didn't even have to move their offices.

The country is now ran by a clique of ex-KGB hardliners but I guess that does not count because it was renamed in 1991.

Re: Kaspersky Password Manager: All your passwords are belong to us

#32

Post by Biganon »

llampx wrote: post #14
propwash wrote: post #5

I use Bitwarden and it's open source. Switched over from LastPass and haven't regretted it since

I have to use 1password for work and hate the UI compared to bitwarden

Could you please elaborate? I've been using 1password for a while, and I can't imagine how it could be any better

Re: Kaspersky Password Manager: All your passwords are belong to us

#33

Post by Scaevolus »

Tempest1981 wrote: post #19

Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too: - getRandomValues() is not guaranteed to be running in a secure context. - There is no minimum degree of entropy mandated by the Web Cryptography specification - User agents are instead urged to provide the best entropy they can when generating random numbers, using a…

Being able to call getRandomValues from HTTP endpoints doesn't specifically break a password extension unless it was somehow serving over HTTP and had its Javascript modified.

It doesn't mandate entropy requirements, probably because that's a somewhat contentious measure that not all OSes provide information about (see also: the long and tedious arguments about merging /dev/random and /dev/urandom). As long as the browsers use the underlying OS primitives, it will be fine.

Browsers do a thousand things essential for security that are far harder than providing cryptographically random numbers, and I highly doubt they'll screw it up.

Re: Kaspersky Password Manager: All your passwords are belong to us

#34

Post by [deleted] »

Tempest1981 wrote: post #19

Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too: - getRandomValues() is not guaranteed to be running in a secure context. - There is no minimum degree of entropy mandated by the Web Cryptography specification - User agents are instead urged to provide the best entropy they can when generating random numbers, using a…

[deleted]

Re: Kaspersky Password Manager: All your passwords are belong to us

#36

Post by ComodoHacker »

varjag wrote: post #30
ComodoHacker wrote: post #22

Earlier quoted context omitted.

Just to remind you all why it's not a coincidence and also not an argument for conspiracy. The only organizations in the USSR who were hunting for best talent were KGB and military. So when the first businesses emerged and started hunting, almost all talent came from there.

Factually incorrect: only a small minority of talented people went working for KGB. It had many perks but wasn't a place where a serious talent would thrive.

Are there any data, if we talk factual?

Re: Kaspersky Password Manager: All your passwords are belong to us

#37

Post by dchest »

Tempest1981 wrote: post #19

Ok, we know that Math.random() is bad, and they recommend using window.crypto.getRandomValues(). But the docs for getRandomValues() raise concerns too: - getRandomValues() is not guaranteed to be running in a secure context. - There is no minimum degree of entropy mandated by the Web Cryptography specification - User agents are instead urged to provide the best entropy they can when generating random numbers, using a…

There is no better solution for the client-side web. getRandomValues() generates cryptographically secure random bytes in all current popular browsers.

Re: Kaspersky Password Manager: All your passwords are belong to us

#38

Post by stef25 »

simias wrote: post #9
123pie123 wrote: post #6

>All the passwords it created could be bruteforced in seconds Can somebody please correct me if I'm wrong, but to bruteforce a password attackers need offline access to the stored passwords data and I'm assuming it mustn't be stored in a proper encrypted way why should the onus be on the end client/ user to use 'crazy' lenght and complex passwords(I'm excluding stupidily simple passwords such as 123456 etc..) surely…

I think the attack vector would be something like: - Website is compromised, database is dumped - It contains hashed user passwords that you'd have to bruteforce if you want to recover them - If you know roughly how long the password is and when it was generated (and what character set it uses) and that you know that it was probably generated by this Karspersky product, you can use that to generate all possible combi…

This creates the weird scenario where using the Kaspersky product to create unique passwords + a leaked database would be super bad because the created_at value of the profile would give you a good indication of when the password was generated (in my case usually less than 60 sec before)

Re: Kaspersky Password Manager: All your passwords are belong to us

#40

Post by varjag »

ComodoHacker wrote: post #36
varjag wrote: post #30

Earlier quoted context omitted.

Factually incorrect: only a small minority of talented people went working for KGB. It had many perks but wasn't a place where a serious talent would thrive.

Are there any data, if we talk factual?

Poke any notable Soviet science and technology figure and see if they have KGB in their biography.

Soviet R&D wasn't structured within end users but was own network of research institutes and design bureaus. So if you wanted to work say on solid state rockets you wouldn't go to artillery school but rather something like Central Scientific Research Institute of Heat and Mass Exchange. There you'd be working for tactical rocket stuffings for the rest of your life, have a certain academic career track and as a perk have an occasional international publication with peripheral results.

Post reply on HN