Live data from Hacker News

Browser password managers – flawed security, by design

fractionalciso.com

51–60 of 127 posts

Re: Browser password managers – flawed security, by design

#51
I remember there being a lot of buzz about security issues related to allowing Browsers storing passwords, this was more than 10 years ago, but ever since that I have just not trusted them. I reluctantly use a open source password manager, keepass, and figure it is still better than using the same password everywhere.

Why would we store password in the browser? Seriously. I want my passwords to be available wherever I need to use them, and that only happens if I somehow share the passwords between my devices. I would not trust a proprietary browser developer do store my passwords securely. Period. I have no way of seeing or knowing what is going on on their cloud servers.

There are very simple ways to sync files between systems, which are open source, and are much more unlikely to compromise your passwords. E.g. The database itself is encrypted, and the methods of sharing are so simple that it is easy to cover many of the most probable points of entry. Obviously, sharing a password database file over the internet is extremely bad, but if you feel you must, do at least manage the server where you keep the pw db yourself. Heck, I would even 7zip it with another layer of security, because I can not know for sure if Keepass' encryption is safe.

Re: Browser password managers – flawed security, by design

#52

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

Compromised sessions is not necessarily a concern, unless the attacker has physical access to the location, since systems can detect if the location changes. E.g. Ip address change prompts the user. Not perfect, and hugely inconvenient for people with dynamic IPs.

AND filesystem access IS a concern, and that is not just if someone has physical access. E.g. You do not know for sure that the code running on your own system was designed with your interests in mind.

Intentionally or by mistake, a password database file could be leaked and broken into if uploaded to a server on the internet outside of your control, and if they also upload your encryption key along with it, goodbye passwords. It could be as simple as a piece of software uploading "telemetry" data, and "accidentally" including the password database from a browser along with the encryption key.

Re: Browser password managers – flawed security, by design

#53
post #25

A lot of the criticism of this article seems to be: “If they already have access to your local file system, you already have bigger problems” What about defence in depth? This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers. So this article is bringing attention to a we…

The article states that there is a big problem, but the solution it gives only incrementally improves the situation. If passwords stored in plaintext is a problem, don’t just use slightly harder to access storage. Use SSO so there are not credentials to steal. If the article gave a complete picture of what to do to mitigate the damage of endpoint compromise or was less alarmist in its assessment of risk, I would have…

That's a fair assessment of the article I think. It's a genuine threat, and one we have had to deal with in a small way before.

Most of the criticism I've read here seems to be dismissing the threat entirely, using the weak "if that happened you've got bigger problems" argument.

Re: Browser password managers – flawed security, by design

#54

This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. The author / website does seem to be offering services in the security industry, but they seem compliance-focused rather than security-focused (compliance is a component of security). So likely offering legal & administrative expertise rather than technical.

On reflection, I think this article is why I find it extremely difficult to hire qualified security experts. The vast majority of "security experts" I find tend to be "box tickers", who can require lots of rules like this ("don't use the built in password manager"), but whose advice is worse than useless because they don't understand the actual threat models. I know great security people exist, but in my experience I…

I used to develop custom Node+React web apps for an org that required security audits.

I was happy to get my code audited for vulnerabilities, but when the audit came it was just a bunch of boxes ticked for Drupal/WordPress/etc. vulns.

Re: Browser password managers – flawed security, by design

#55

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…

or he could simply wait until the employee unlocks his password manager and steal the password?

Re: Browser password managers – flawed security, by design

#56
post #25

A lot of the criticism of this article seems to be: “If they already have access to your local file system, you already have bigger problems” What about defence in depth? This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers. So this article is bringing attention to a we…

Why the strong criticism of this article?

These articles always assume everyone has the same threat model: you are head of the NSA's IT department, and hostile nation-states are spending billions to attack your security with everything from 1024-qubit computers to $5 pipe wrenches.

Forcing users to employ the same security tools and practices that would be appropriate for dealing with far more serious threats is just annoying, and likely to result in passive-aggressive resistance.

Re: Browser password managers – flawed security, by design

#57
post #34

Lastpass just sent us a bill for $750 and unless we pay it they locked the whole company out of out shared password database and refuse to supply even chat or email support to discuss it

Lastpass was acquired by some shady chinese company. It's time to migrate to some reliable open source manager like Bitwarden (also provides cloud sync)

No it wasn't. LastPass is (soon to be was) owned by LogMeIn - now GoTo - which was originally a Hungarian company and is now owned by an American investment firm. LastPass is being spun off into a standalone company again.

Re: Browser password managers – flawed security, by design

#58

> Note – many of these dedicated password managers have browser plugins or extensions to help users save and fill passwords. These are very different and much more secure than the built-in password managers that are the subject of this article! This is a shitty article from someone who doesn't really know what he's talking about. Here is a post from Tavis Ormandy, well-known security expert at Google Project Zero, ad…

Although I trust Tavis Ormandy more than this random blog post, I disagree with the idea that the password managers built into your browser are somehow superior.

I use Bitwarden and there's simply no comparison between what Firefox/Chrome offer me and what Bitwarden offers; you can't even add an extra field to the browser password manager and Google helpfully "encrypts" your data with the password they're already receiving when you're setting up their browser. You can change that, of course, but like a router's default password, if you don't have to change it, people won't. There are also other UI/UX problems (had a side move TLDs, good luck fixing that in your browser!) that browsers don't seem to care about for the sake of "simplicity".

The dangers that come with external password managers are because of a lack of good password manager APIs in browsers, forcing them to break the security model. It's easy to say "don't use them, they break some design", especially if you work for a company that designs their own browser, but there are quite tangible benefits to taking the risks, the most important of which is probably "not handing over your data to some browser giant".

Re: this article: if the attacker has access to the browser password database, they have access to cookies and the ability to monitor key strokes. You can encrypt passwords all you want but the attacker can still move laterally between services by just copying your session cookie and hitting the next vulnerable target. Credentials will come next time the user logs in. Thinking about secure passwords is important, but there's a bigger picture that needs to be accounted for.

The writer of this article mostly seems interested in ticking boxes based on how much they hammer on writing policy and enacting policy and talking to people about policy. I'm not sure who the target audience for this blog is, I would guess managers who are looking to improve their company's security?

Re: Browser password managers – flawed security, by design

#60

Earlier quoted context omitted.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…

or he could simply wait until the employee unlocks his password manager and steal the password?

That there exist additional attack vectors is not an argument to ignore one which is simple and requires no user interaction to pull off.

If your point is that password managers aren't a total solution to the issue, I'd agree.

Post reply on HN