Browser password managers – flawed security, by design
fractionalciso.com
Browser password managers – flawed security, by design
1–10 of 127 posts
Re: Browser password managers – flawed security, by design
#2Keen to understand the hackernews take on this...
Re: Browser password managers – flawed security, by design
#3Even if the user doesn't turn on a master password, having the key in a predictable place on an encrypted volume with appropriate access permissions is still far more secure than sticky notes on the monitor. Contrary to the OP link's statement, it isn't enough for the attacker to get access to the user's system, they have to get access to the user's account.
And if the organization in question isn't using Bitlocker or FileVault or some other encryption, browser password stores are way down the list of security worries.
Re: Browser password managers – flawed security, by design
#4Sure, encrypting the passwords is better, but to steal all the stored unencrypted password the attacker would need access to the users computer.
If they have that access you have bigger problems on your hand. Yes, this can lead to privilege escalation, but for the vast majority of people access to the desktop is enough for that anyway.
If you need better security, you probably already are using more advanced measures.
Re: Browser password managers – flawed security, by design
#5Whoever wrote this seems to have no modern security training.
> then your average employee is probably doing one of these three things: Writing passwords down on paper
> Hopefully, you have a corporate security awareness training program and have long been discouraging
Please, please encourage people to write down passwords on paper! That provides really good safety against most modern threat models, especially in a world where people are working from home.
> Even though Chrome, Firefox, and Edge browsers all store passwords in encrypted databases, by default all three products intentionally leave the associated encryption keys completely unprotected in predictable locations.
There was (is?) a long lived Chrome issue (which I can't find now). They reasonably make the point that operating system level protection is the correct way to protect this (ie, if a person can log onto your device they are assumed to be you).
Re: Browser password managers – flawed security, by design
#6Does this cover things like LassPass, OnePassword, BitWarden? Or just the built in managers?
Re: Browser password managers – flawed security, by design
#7This is a bunch of silly hand-wringing. I guarantee that if browsers required creating and memorizing and typing a master password all the time, users would be less secure overall. Because people simply wouldn't use the annoying password manager. Using a password manager without a master password is way more secure than not using a password manager at all.
If you are a business and you want your employees to be secure, forget about anything to do with passwords. You need hardware second factor tokens. Which I notice the article doesn't mention at all. An article about login security in 2022 that doesn't even mention hardware tokens for two factor authentication is not worth anyone's time.
Re: Browser password managers – flawed security, by design
#8I don't think there is anything wrong with storing passwords unencrypted locally assuming the machine itself has encrypted storage. Malware that retrieves passwords from password manager could get them from an unlocked password manager as well.
Re: Browser password managers – flawed security, by design
#9As usual with security discussions, one needs to start from analyzing security threats and attack vectors. Is a simple to memorize and likely multi-use password is a bigger security threat than a unique, hard to guess passwords in a file storage? It depends.
Is this a laptop without disk encryption that travels a lot and especially internationally? Sure, these semi-unencrypted passwords on disk are likely not very safe from lost laptops, customs inspections, etc. Might still be better than a common and simple password though.
Is this a laptop sitting at home most of the time with a strong disk encryption? I’ll take unsecured browser password storage with unique hard passwords any day.
Edit: formatting
Re: Browser password managers – flawed security, by design
#10Keen to understand the hackernews take on this...
Read above. Skeptical, misunderstood the threat/risk surface, lack of coherent adoption of modern NIST expectations, focussed on the one story they know, which is the password manager keys are at risk if the machine is compromised.