Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser password managers – flawed security, by design

fractionalciso.com

Post reply on HN
Print view View original

41–50 of 127 posts

Re: Browser password managers – flawed security, by design

#41

Post by aaronbrethorst »

m8s wrote: post #39
aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

I recently had to tell my bank, with my voice over the phone, that the make and model of my first car were the three random words 1Password generated for me. “Yes, the make and model of my first car was… a Venerated Breakfast Platoon.”

I hope you either made up that code or changed it after posting this.

Re: Browser password managers – flawed security, by design

#42

Post by Double_a_92 »

aimor wrote: post #16

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this. It feels l…

To be fair my phone is probably the safest device I own. If I had do to 2FA that's where I would want to receive it, locked behind my fingerprint...

Re: Browser password managers – flawed security, by design

#43

Post by Double_a_92 »

politelemon wrote: post #24
modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

> You need hardware second factor tokens. Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.

What would the alternative even be? Having the users keep a buch of different RSA keys?

Re: Browser password managers – flawed security, by design

#44

Post by Double_a_92 »

quickco wrote: post #25

A lot of the criticism of this article seems to be: “If they already have access to your local file system, you already have bigger problems” What about defence in depth? This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers. So this article is bringing attention to a we…

Because it might imply to users that using nothing is better. Which leads to people reusing simple passwords... or post-it notes.

Re: Browser password managers – flawed security, by design

#45

Post by MarkSweep »

quickco wrote: post #25

A lot of the criticism of this article seems to be: “If they already have access to your local file system, you already have bigger problems” What about defence in depth? This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers. So this article is bringing attention to a we…

The article states that there is a big problem, but the solution it gives only incrementally improves the situation.

If passwords stored in plaintext is a problem, don’t just use slightly harder to access storage. Use SSO so there are not credentials to steal.

If the article gave a complete picture of what to do to mitigate the damage of endpoint compromise or was less alarmist in its assessment of risk, I would have liked it better.

Re: Browser password managers – flawed security, by design

#46

Post by Timshel »

olliej wrote: post #22
torstenvl wrote: post #3

Even if the user doesn't turn on a master password, having the key in a predictable place on an encrypted volume with appropriate access permissions is still far more secure than sticky notes on the monitor. Contrary to the OP link's statement, it isn't enough for the attacker to get access to the user's system, they have to get access to the user's account. And if the organization in question isn't using Bitlocker o…

I'm sorry, but this view is fundamentally incorrect. You have to consider what the actual threat model is. The reality is that your primary threat model is not going to be one employee compromising another's, nor is it someone malicious physically tracking down your employees and stealing and/or physically compromising their devices. Those threats do technically exist, but your employees have to be extraordinarily va…

How else would you define a phishing attack than getting "access to the user's account" ???

Re: Browser password managers – flawed security, by design

#47

Post by plaguepilled »

hn_throwaway_99 wrote: post #33
plaguepilled wrote: post #21

Earlier quoted context omitted.

SMS TOTP is indeed bad and your suspicion is well warranted. Its a lazy way to implement 2-factor authentication and exposes the user to MITM attacks as well as a host of other nastiness. U2F (stuff like what Google Authenticator does) is way better and less phone dependent. The only reason a team would opt for TOTP if they had the resources to implement U2F is because its a good way to get your phone number. Edit: e…

You seem to be mixing and matching acronyms that don't really make sense. "TOTP" means "Time-based one time password". It's where the server and client (like the Google Authenticator app) share a secret and then the one-time password changes every 30 seconds. "SMS TOTP" doesn't make sense because SMS codes can be anything random that is sent out to the user attempting to log in. As I stated above, the Google Authenti…

You are completely right, I misspoke (mistyped?) in my previous comment. Apologies for the error.

What I referred to as U2F is TOTP as you say, and what I referred to as TOTP is plaintext OTPs. That's an embarrassing mistake.

What I had meant to highlight is that SMS based authentication is more vulnerable than an authenticator app because the SMS exposes data that can be intercepted or collected by a third party. A timed algorithm solution does not expose this risk at read time (only when synchronising - unless I've missed something?), which is why I strongly prefer it.

Re: Browser password managers – flawed security, by design

#48

Post by dmateos »

One thing i often do when i forget one of my passwords, is go into chrome, goto the webpage corresponding to the login of the thing in question and let it autofill, then i turn the password area to a plain text area in the HTML editor.

I've always thought this kind of bypasses most checks you get if you try to go into the password db in the browser it self.

Re: Browser password managers – flawed security, by design

#49

Post by MattPalmer1086 »

iueotnmunto wrote: post #20

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement.

If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine.

Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't terrible, it's just pointing out something in browsers that works ok for home users but puts businesses at some risk.

Re: Browser password managers – flawed security, by design

#50

Post by Gigachad »

iueotnmunto wrote: post #20

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

I’m so sick of these security articles. It’s become a boy who cried wolf situation with endless articles claiming something is critically insecure when the situation involves the attacker basically having end game access and ability to do just about anything anyway.
Post reply on HN