Earlier quoted context omitted.
Do hardware keyloggers trigger endpoint security?
No, but hardware keylogger require physical access.
What is the difference between "physical access" and "powerful position with local access"
Bitwarden Heist – How to break into password vaults without using passwords
41–50 of 209 posts
Re: Bitwarden Heist – How to break into password vaults without using passwords
#42I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#43Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…
>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory.
Yes, otherwise known as "if you run code on your computer, it can run code on your computer".
If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#44Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…
> The response was that if access to %Appdata% is completely blocked Windows won't work anymore.
Yikes. I really wish that instead of Microsoft wasting resources on telemetry nonsense, they would focus on optimizing their OS and modernizing some of these blatant security issues.
I guess it wont happen until we have another wave of ransomware malware or something of the sort.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#45I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.
Without using a vault, people end up re-using passwords or using weak passwords, which is IMO worse.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#46Earlier quoted context omitted.
Yes, it requires an attacker in a powerful position with local access. However, it does not require special privileges or techniques that may trigger endpoint security (such as keyloggers or memory dumping). The only requirements are reading a JSON file and making a single Windows API call to retrieve the key.
Do hardware keyloggers trigger endpoint security?
A hardware keylogger has to sit as a MitM between the keyboard and the USB port.
Sufficiently paranoid endpoint security could trip when the keyboard is unplugged and then plugged back in.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#47I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.
They make it easy to have strong passwords and sync across devices.
You could use a local vault and sync yourself, use a piece of paper in a safe, or use your brain to store them.
All of these come with tradeoffs and their own risks. Pick your poison.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#48Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…
>python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Yes, otherwise known as "if you run code on your computer, it can run code on your computer". If a random python program can "decrypt" the passwords, that's not encryption. And browser password management isn't about security, but convenience.
Full unrestricted disk access for all users and code isn’t the only way an OS can be designed.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#49Microsoft's %Appdata% directory is a security nightmare in my opinion. Ideally applications should only have access to their own directories in %Appdata% by default. I recently came across a python script on GitHub that allows to decrypt passwords the browser stores locally in their %Appdata% directory. Many attacks could be prevented if access to %Appdata% was more restricted. I also found a post of an admin a few d…
"AppData" is where user specific application data is supposed to be stored.
"The Registry" is where application configuration is supposed to be stored.
"ProgramData" is where application specific data is supposed to be stored.
"Program Files" is where read-only application binaries and code is supposed to be stored.
It really is a simple concept from a Windows perspective. What ruins everything is overzealous and/or ignorant programmers who don't take any pride in their work, or lack all respect for the users environment. For example; an .ini file should not be a thing in Windows. That is what the registry is for. But the programmer writes the code for Linux, half-ass ports it to Windows, and leaves the .ini file because his code is more important to him than the end-users operating system.
There is nothing wrong with AppData permissions. The problem is with the users understanding of what it is for, and the developers understanding of how it should be used.
Re: Bitwarden Heist – How to break into password vaults without using passwords
#50I've always considered password vaults as a single point of failure that will compromise all of your passwords. I've had lots of intelligent, well-informed programmers argue that my concern is groundless.
Everything is a tradeoff - but the basic balance is very strongly in favor of password managers:
1. without a password manager that is shared on all your devices, you WILL re-use passwords out of frustration. 2. without a password manager, if you do any sort of regular sharing passwords with a engineering team, friends & family, you'll resort to pretty insecure channels. 3. true E2E encryption, while still providing some surface area, has proven in the field through multiple pretty bad breaches[1], that it's a security model that holds up under real-world circumstances.
On the flip side, you are right: you are one compromised browser extension / binary away from having your local vault decrypted, and ALL your passwords compromised. But think about this: if someone has this much local access, chances are they can install a keylogger anyway, or read your clipboard, so the real difference is you've conveniently pre-loaded all your sensitive information in one go for the bad actor.
[1]For example: https://blog.lastpass.com/2022/12/notice-of-recent-security-...