Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser password managers – flawed security, by design

fractionalciso.com

Post reply on HN
Print view View original

61–70 of 127 posts

Re: Browser password managers – flawed security, by design

#61

Post by dustinmoris »

iueotnmunto wrote: post #20

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

A hijacked session is bad, but nowadays not nearly as bad as a leaked password:

- Sessions can be linked to a user's location and/or browser finger print

- Sessions are short(er) lived

- Sessions can easily get invalidated (e.g. device wide logout)

- Almost all critical actions are behind additional security (e.g. can't change password without 2FA or change billing information without confirming password and/or 2FA in order to apply changes, etc.)

- Sessions are not shared across properties, whereas many users share their password across multiple internet sites/properties

Re: Browser password managers – flawed security, by design

#62

Post by zokier »

lsh123 wrote: post #9

As usual with security discussions, one needs to start from analyzing security threats and attack vectors. Is a simple to memorize and likely multi-use password is a bigger security threat than a unique, hard to guess passwords in a file storage? It depends. Is this a laptop without disk encryption that travels a lot and especially internationally? Sure, these semi-unencrypted passwords on disk are likely not very sa…

> Is this a laptop without disk encryption that travels a lot and especially internationally?

If yes then password storage is not the thing you should be concerned about. There is no excuse for not having FDE on laptops in 2022.

Re: Browser password managers – flawed security, by design

#63

Post by lmns »

MattPalmer1086 wrote: post #49
iueotnmunto wrote: post #20

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…

>When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement.

So you think this isn't the case with home users? Maybe I still misunderstand the point that is being made here, but from my perspective it's only a matter of time until my encrypted password store gets exposed to the local attacker (as soon as I unlock it).

Re: Browser password managers – flawed security, by design

#64

Post by zokier »

tomxor wrote: post #30
modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

> Using a password manager without a master password is way more secure than not using a password manager at all. I disagree, diceware AND hardware security keys, is stronger, no password manager needed at all. However I agree the article is overblown. For most people, browser based password managers are probably a vast improvement, since most will likely never educate themselves on such things or accept the solution…

How does diceware reduce the need for password managers at all?

Re: Browser password managers – flawed security, by design

#65

Post by olliej »

Timshel wrote: post #46
olliej wrote: post #22

Earlier quoted context omitted.

I'm sorry, but this view is fundamentally incorrect. You have to consider what the actual threat model is. The reality is that your primary threat model is not going to be one employee compromising another's, nor is it someone malicious physically tracking down your employees and stealing and/or physically compromising their devices. Those threats do technically exist, but your employees have to be extraordinarily va…

How else would you define a phishing attack than getting "access to the user's account" ???

Given the comment I was replying to that was considering "access to the user's account" being the unlikely case, it seemed reasonable to go into very clear detail on what the real world attack vector is.

That said, phishing does not necessarily mean gaining access to an account. The typical path is the low cost "trick someone into providing their credentials to a malicious party" - something browser based password managers do well, as they are very careful in ensuring they only ever enter passwords into the correct domain. You can also phish someone who is very careful by not asking for their account credentials, but having them do something innocuous that compromises their machine. For example you can have a fake company interview them and provide them a PDF with the job offer, and then have the PDF install malware.

But the important thing is that the primary attack vector for any device is remote access. So things like disk encryption don't matter, and things like password notebooks are not accessible.

The real problem is that once you have malware running on your machine, the presumption is that malware interested in credentials is going to elevate itself to super user at least and so generally gain code injection abilities in most processes that it could be interested in (e.g. all the password managers, or the system pasteboard, or whatever mechanism whichever the target password manager uses). Modern protections such as aggressive code-signing enforcement, sandboxing, SIP (or the windows equivalent), etc make such compromises harder, but harder != impossible.

Re: Browser password managers – flawed security, by design

#66

Post by MattPalmer1086 »

lmns wrote: post #63
MattPalmer1086 wrote: post #49

Earlier quoted context omitted.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…

>When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. So you think this isn't the case with home users? Maybe I still misunderstand the point that is being made here, but from my perspective it's only a matter of time until my encrypted password store gets exposed to the local attacker (as soon as I unlock it).

I didn't say it wasn't a problem for home users. I said that the browser security model works OK for home users who aren't at all bothered by security unless it gets in their way, in which case they will switch to a product that doesn't. It's poor security but probably the best we can do by default.

So that default browser behaviour creates a risk that a business should acknowledge and assess.

A home user can of course also decide it's too risky, or that password managers are too risky and only a yubikey will do.

Re: Browser password managers – flawed security, by design

#67

Post by denton-scratch »

MattPalmer1086 wrote: post #49
iueotnmunto wrote: post #20

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…

> When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement.

/me not a security expert. But isn't this the mistake I used to make for years: to believe that the hacker is a human, responding to his environment and making decisions? It took me a long time to acknowledge that nearly all network attacks are automated, and unless it's a highly targeted attack, the attack script won't care whether you're a corporation or a couch-potato in a basement.

Re: Browser password managers – flawed security, by design

#68

Post by olliej »

modeless wrote: post #7

This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all. If you are a business and you want your employees to be secur…

Safari already gates password autofill on the secure element (or enclave, I can never remember the difference) when such is available, which is what you're suggesting :D

That said you're absolutely correct, making autofill harder to use would mean people wouldn't use it, and would revert to predictable and reused passwords, and if you're a business you should be using token based authentication be they dongles or phone and PC's secure elements.

Re: Browser password managers – flawed security, by design

#69

Post by MattPalmer1086 »

denton-scratch wrote: post #67
MattPalmer1086 wrote: post #49

Earlier quoted context omitted.

You have misunderstood the threat. When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. If the user's passwords to the rest of the corporate systems are sitting unprotected in a browser password store, it is a gold mine. Yes, they should have 2fa and single sign on and so on, but many places don't. The article isn't t…

> When an attacker gains a foothold in a corporate environment, they will immediately try to find any accessible credentials to assist in lateral movement. /me not a security expert. But isn't this the mistake I used to make for years: to believe that the hacker is a human, responding to his environment and making decisions? It took me a long time to acknowledge that nearly all network attacks are automated, and unle…

It can either be a human directing it once a foothold is established, or an automated attack. Initial compromise may be automated but lateral movement is harder to automate.

If you work on highly sensitive systems then you should expect a human in the loop at some point.

Re: Browser password managers – flawed security, by design

#70

Post by pieresqi »

hn_throwaway_99 wrote: post #23

> Note – many of these dedicated password managers have browser plugins or extensions to help users save and fill passwords. These are very different and much more secure than the built-in password managers that are the subject of this article! This is a shitty article from someone who doesn't really know what he's talking about. Here is a post from Tavis Ormandy, well-known security expert at Google Project Zero, ad…

That's bad article too. It talks about 1 bad "feature" of specific password manager extension and then dismisses every other password manager extension without verifying if they have this bad "feature" too. And this is from security expert ? Bruh
Post reply on HN