Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser password managers – flawed security, by design

fractionalciso.com

Post reply on HN
Print view View original

91–100 of 127 posts

Re: Browser password managers – flawed security, by design

#91

Post by GekkePrutser »

dustinmoris wrote: post #61
iueotnmunto wrote: post #20

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not. If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.

A hijacked session is bad, but nowadays not nearly as bad as a leaked password: - Sessions can be linked to a user's location and/or browser finger print - Sessions are short(er) lived - Sessions can easily get invalidated (e.g. device wide logout) - Almost all critical actions are behind additional security (e.g. can't change password without 2FA or change billing information without confirming password and/or 2FA i…

> whereas many users share their password across multiple internet sites/properties

Does this still really happen??

I've given up that malpractice years ago.

Unfortunately it's very hard to gauge this in our company but I would hope users take their security training to heart.

Re: Browser password managers – flawed security, by design

#92

Post by GekkePrutser »

lucideer wrote: post #11

This is a bad bad article, the advice is dated and the counter-arguments are well known and oft-discussed by anyone who's actually in the security community. The author / website does seem to be offering services in the security industry, but they seem compliance-focused rather than security-focused (compliance is a component of security). So likely offering legal & administrative expertise rather than technical.

Their site seems focused on CISOs which in my experience lack serious technical skills.

In fairness this is part of their job, but it is sometimes annoying when they refuse to recognise real risks and just focus on stuff that's just show. Like bitsight scores. In our case they don't reflect our actual environment at all (they don't recognise 99% of our traffic), but the CISOs love bitsight because our score is an A.

Re: Browser password managers – flawed security, by design

#93

Post by throwawayffffas »

GlitchMr wrote: post #8

I don't think there is anything wrong with storing passwords unencrypted locally assuming the machine itself has encrypted storage. Malware that retrieves passwords from password manager could get them from an unlocked password manager as well.

Reading a file and code execution (which is required for reading another processes memory) are two different levels of vulnerabilities.

Essentially if you have a piece a software with a bug that allows someone to remotely read files from you system, your browser stored passwords are compromised while your passwords stored encrypted are safe-ish depending on how good your passphrase is.

Of course if you have malware that can run arbitrary code on your system you are hosed either way.

Re: Browser password managers – flawed security, by design

#94

Post by GekkePrutser »

denton-scratch wrote: post #73
jeroenhd wrote: post #58

Earlier quoted context omitted.

Although I trust Tavis Ormandy more than this random blog post, I disagree with the idea that the password managers built into your browser are somehow superior. I use Bitwarden and there's simply no comparison between what Firefox/Chrome offer me and what Bitwarden offers; you can't even add an extra field to the browser password manager and Google helpfully "encrypts" your data with the password they're already rec…

> I disagree with the idea that the password managers built into your browser are somehow superior. I use Password Safe. It doesn't integrate with my browser, and the database is stored locally. So I'm exposed to no threat from the subscription company; and there's no content script. It's easy to back-up the database. I can store the database and the Password Safe program on a memory stick. And I can use the password…

Pass is amazing. Along with yubikeys to do the encryption and "touch to sign" to avoid agent exploitation (so you need to touch it for every use) it's pretty safe too. There's good browser plugins available.

It's a bit of a pain to set it all up on every OS. Especially on Windows it feels far from native. But it works well.

Re: Browser password managers – flawed security, by design

#95

Post by lucideer »

throwawayffffas wrote: post #89
lucideer wrote: post #88

Earlier quoted context omitted.

> makes a valid point. Encrypting something and writing the key on the same place is pointless. The backlash is due to this not being a valid point. Security best practice has long moved on from dogmatic binaries and treating humans like robots. Encrypting something in transit and writing the key in plaintext locally, while not ideal, is far from pointless. Building perfectly secure systems that nobody will use is wh…

It's not in transit, it's the equivalent of storing your passwords in plaintext, which I don't think can be actually defended as a good practice. Regardless the question that arises which is a lot more worrisome is what happens when you turn on synchronization on these browsers? Do they encrypt the passwords with a key only you know? Or do they just ship the "encrypted" passwords along with the key, so that your pass…

> which I don't think can be actually defended as a good practice

Allow me to try defending it:

Even storing your passwords in plaintext locally using an integrated password manager would:

1. discourage password reuse

2. usually encourage generated strong passwords/phrases (best password is one you don't know)

3. allow easy automated password auditing

4. prevent phishing-based credential capture via domain matching

Just point (1) above is a much greater threat than the likelihood of physical access (or rootkit/malware in which case key logging would invalidate keyed encryption either way)

> what happens when you turn on synchronization on these browsers? [...] Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers?

The typical approach is to ship the encrypted password without the key: provided it's a key known by the user, this makes it easy to download the encrypted credentials on any device and decrypt locally. If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable.

Re: Browser password managers – flawed security, by design

#96

Post by jwcybsafe »

ggm wrote: post #10
jwcybsafe wrote: post #2

Keen to understand the hackernews take on this...

Read above. Skeptical, misunderstood the threat/risk surface, lack of coherent adoption of modern NIST expectations, focussed on the one story they know, which is the password manager keys are at risk if the machine is compromised.

Thanks! Super useful

Re: Browser password managers – flawed security, by design

#97

Post by stjohnswarts »

I'm just not sure why they haven't built in something like Apple's face ID. I know security experts hate anything that isn't locked down with 3 forms of verification but my goal is to have security to the point that it isn't a hastle every time I want to go to a new website.

Re: Browser password managers – flawed security, by design

#98

Post by pdpi »

quickco wrote: post #25

A lot of the criticism of this article seems to be: “If they already have access to your local file system, you already have bigger problems” What about defence in depth? This article is suggesting an alternative, which are password managers such as 1Password. These Password managers do not suffer from the same weak key storage as the browser’s build-in password managers. So this article is bringing attention to a we…

The problem is that the article takes on this hyperbole-laden all-or-nothing tone that does nobody any favours.

If you go along with the all-or-nothing mentality, then local file system access is pretty much game over anyway.

If you want to take the security-in-depth approach, you have to first apply it to these password managers and take an honest look at the problems they solve. And it turns out they’re amazing from a cost:benefit benefit perspective.

Put differently: go read the spectre/meltdown papers. Imagine if _those_ were written in the same tone this is. That’s the problem.

Re: Browser password managers – flawed security, by design

#99

Post by Symbiote »

Double_a_92 wrote: post #43
politelemon wrote: post #24

Earlier quoted context omitted.

> You need hardware second factor tokens. Be careful what you wish for. It's happening but not in the way you're envisioning. A lot of logins now require a phone app. That's the hardware offloading, and reduces overhead of having to manage dedicated hardware. Instead, users manage it themselves and the business piggybacks off it.

What would the alternative even be? Having the users keep a buch of different RSA keys?

You can use a single key (e.g. YubiKey), or the security key in a[n Android?] phone.

Re: Browser password managers – flawed security, by design

#100

Post by tmikaeld »

julienpalard wrote: post #59
quickthrower2 wrote: post #6

Does this cover things like LassPass, OnePassword, BitWarden? Or just the built in managers?

Just the built in managers. Other are worse: they do vendor locking for profit.

Bitwarden is fully open source, both client and server - no lock-in.
Post reply on HN