Password Managers: Under the Hood of Secrets Management

https://www.securityevaluators.com/casestudies/password-manager-hacking/

by thenaturalist • 7 years ago

350 193 7 years ago

securityevaluators.com

mediocrejoker5• 7 years ago

Why did they evaluate 1Password v4 instead of v7?

velcrovan• 7 years ago

If you read the whole thing, they evaluated both, and found that v7 is actually far worse than v4.

mediocrejoker5• 7 years ago

Yes sorry I replied without reading the entire paper. Would be good to see some responses from the companies.

edit: looks like AgileBits has already responded

https://discussions.agilebits.com/discussion/comment/493044/...

Too2• 7 years ago

4 is the last version with fully offline vault that doesn't tie you to their cloud subscription service.

peterwwillis4• 7 years ago

I don't care if the password manager is secure against local attacks, because the average user will still be vulnerable without extensive security policies. Sure, there's the "anything is better than nothing" argument, but if we're just throwing darts at the wall, deciding which dart board is nicer isn't going to affect your score.

If you can read local memory, you can probably write to (at least other) memory, and then it's a short hop to content injection and session hijacking. Erasing key material from memory or preventing its misuse then only seems useful against cold boot attacks.

Ajedi329• 7 years ago

Very interesting results. I'm not sure I agree that it's necessary to keep password information out of memory in an unlocked password database, since an attacker could always just extract the decryption keys from memory and use those to decrypt the database on disk to get the same information.

The other findings about sensitive information remaining in memory even _after_ the password managers are locked are concerning however. It'd be great if the article included a link to the CVEs or bug tracker issues for these vulnerabilities so we could keep track of whether or not they've been fixed.

dontbenebby12• 7 years ago

The other findings about sensitive information remaining in memory even _after_ the password managers are locked are concerning however.

Sounds like a reasonable countermeasure is to quit the manager when not in use.

After all, I'd need to enter my password if I was "unlocking" or restarting the app either way. (At least in my manager)

megakid• 7 years ago

I just migrated from LastPass to 1Password7, happier with the GUI/interfaces but I hope they fix these issues up to at least make it harder to extract the passwords when in a locked state.

selectodude• 7 years ago

One thing that is nice about 1Password going to a subscription model is that they have to work for your business every month or every year. In the comment they made, they talked about looking into a transition to Rust, which has better memory security capabilities.

whelchel• 7 years ago

Can anyone comment on how concerning this is? It doesn’t seem good. I was considering updating from 1Password4 to 7 and biting the bullet on the subscription model. Based on this case study it seems 7 is a security regression trade for UX improvements. Now, I’m considering Keepass or at least waiting to hear some responses from providers involved.

peterwwillis4• 7 years ago

It's not a concern. As an average user your only consideration is "Do they keep my passwords safe on the disk?", and the answer is "yes" for all of them.

If you work for the NSA and cover yourself with a tinfoil blanket to enter your passwords, just lock and close the password manager completely after you've used it to login to a service, and you're all good.

petee• 7 years ago

And if something crashes and dumps memory, you're right back to the answer being "no", your passwords are no longer protected on disk

UnFleshedOne4• 7 years ago

Why is having _all_ password being unencrypted available to _all_ processes running under the same user context considered an esoteric attack?

Basically we are one browser exploit away from using ad-networks to steal all your passwords (from 1Password7).

dontbenebby12• 7 years ago

If there's malware that can read your memory on your machine, they could also just intercept the paste buffer. Basically, this is a rather esoteric attack that if someone was in a position to perform, they could also do much simpler ones.

Keep using a password manager. Write down your 2FA codes separate in a safe place. (I recommend everyone own a safe deposit box)

everdev• 7 years ago

First and foremost, password managers are a good thing. All password managers we have examined add value to the security posture of secrets management, and as Troy Hunt, an active security researcher once wrote, “Password managers don’t have to be perfect, they just have to be better than not having one”

I would assume that a pseudo-random moderately strong password per site stored in your brain would be more secure than a random strong password that's stored electronically and vulnerable to attack, but maybe not?

nkrisc• 7 years ago

Storing it in your brain is likely better. Unfortunately I can't remember a pseudo-random moderately strong password per site for as many sites as I use, I am just a lowly human.

Ajedi329• 7 years ago

Depending on what you mean by pseudo-random, you may be correct. Most people can't remember very many random passwords however, which makes that an untenable alternative.

dontbenebby12• 7 years ago

I have 50+ entries in my password manager. Even if I use passphrases, I couldn't remember them all.

There's no such thing as perfect security, and IMO a good middle ground is memorizing a long, strong passphrase to unlock a password manager full of random PWs for individual sites.

I guess you could write them down instead, but personally I'm much more worried about someone stealing a physical notebook than getting malicious software onto my computer.

(For example, what happens when you cross a border and an enterprising young border officer photographs the contents of your passwords notebook? This would be perfectly legal in most countries.)

I would assume if that were the case they can intercept the password from the paste buffer anyways.

SlowRobotAhead8• 7 years ago

50+, that sounds nice. I have 300+ and they are all 20 char random except where dumb sites required special rules like 14 char max.

Asking someone to brain more than 5 good passwords is entirely pointless. We just aren’t wired for that.

I’ll agree that secure paper is best for security, but not many people understand what “secure” is. A notebook on your desk isn’t, in a safe is. If I need to log in to AWS at the supermarket, that notebook does me no good.

ocdtrekkie3• 7 years ago

Your threat assessment is backwards. Someone needs physical access to your computer area to steal your notebook. Anyone anywhere on the globe can make a reasonably trivial attempt to get malicious software on your computer.

At any given time, the number of people who can attack your notebook is... maybe five. The number of people who can attack your computer at any given time is seven billion.

(Also, there are trivial things you can do to make a paper notebook even better. Write the passwords consistently slightly wrong, according to a rule that you only know in your head, or have a common part of all of your passwords only you know, and then use the notebook for uniqueness.)

astura2• 7 years ago

The only way I can realistically operate without a password manager while keeping a unique password per account would be to reset my password every single time I use an account. Which would be... very tedious.

AnIdiotOnTheNet• 7 years ago

For important things you can use the Munroe method and randomly choose several words from an appropriately large dictionary. The result has the advantage of being much easier to memorize as it lends itself to mnemonic techniques.

The method has detractors who would argue that the word choice wouldn't be random enough, but that's because they employ a strawman who insists on either choosing their own words or using only words they are familiar with. If you actually pull words randomly from a really big dictionary, it has plenty of entropy. Having some obscure words in your passphrase only make it even more memorable anyway.

For unimportant things, like your HN account, who cares.

ocdtrekkie3• 7 years ago

Password managers are universally terrible, but until security experts stop telling people to use them, everyone's going to dump their sensitive passwords into incredibly poor apps written to put all your access in one place secured by one single password.

A lot of password advice today is bad. You only should be making valuable passwords (those that control sensitive data or access) unique. Forum accounts do not need that level of security and you waste cognitive power by doing so.

Banks, email accounts, and a handful of others are the only ones worth truly securing. And passphrases can be incredibly easy to remember, unlike passwords.

ubercow132• 7 years ago

How is it more secure to have a passphrase in your head? If an attacker is in a position to exploit your password manager in the way described in this paper, they are in a position to sniff your bank password as soon as you type it

hombre_fatal• 7 years ago

Forum accounts do not need that level of security

Though it's also in the platform's best interest to defend itself from weak passwords because there are usually a lot more defenses against fresh accounts than existing accounts that get taken over. We're seeing websites becoming more and more proactive here like rejecting passwords that appear on haveibeenpwned.

Also, I recognize your username from your extreme stance against password managers in the past and you seem to make the mistake of not acknowledging trade-offs. I think it weakens your point, especially when talking about end-user security where 90%+ of people are reusing passwords, not debating whether they should use a password manager or roll their own physical password pad scheme.

If you reject current password managers, can you envision a digital solution that would satisfy you?

Fnoord• 7 years ago

You only should be making valuable passwords (those that control sensitive data or access) unique.

I have access on a forum where if I log out it asks shows me my sessions, including my IP address. My IP address is PII. I have my e-mail address hidden on this forum as well. My e-mail address is PII.

I have ordered something on AliExpress. My physical address can be found by logging in to my account. I actually have multiple addresses on my eBay account where some can save me some costs due to being in a different country.

And if anyone logs in to my account on AliExpress, they'd be able to log in on that other forum or eBay as well if it weren't for a password manager.

My password manager allows me to make a passphrase, btw. The terrible thing about a passphrase is it takes long to type it, and a typo takes even longer. I prefer a YubiKey plus a decent PIN though it doesn't work very well against a hostile government.

dontbenebby12• 7 years ago

Banks, email accounts, and a handful of others are the only ones worth truly securing. And passphrases can be incredibly easy to remember, unlike passwords.

You could also use one long passphrase for your password manager that even a state level adversary probably can't crack:

https://theintercept.com/2015/03/26/passphrases-can-memorize...

Edit: To be clear, one passphrase for your password manager not 1 passphrase used on every site.

UncleMeat4• 7 years ago

Nope. Password strength barely matters and password managers with autofill help prevent phishing, which is an actual threat.

nickjj4• 7 years ago

I really like the pass manager (CLI): https://www.passwordstore.org/

It stays encrypted at rest on your machine protected by GPG keys and when you want to access a password you can choose to copy it to your clipboard for 45 seconds or print it to stdout.

No subscription services, and everything stays local on your machine, but you can easily sync it to other devices using whatever file syncing service you want since it's just encrypted files on disk.

peterangular3• 7 years ago

This was brought up last time - but even having something like the path "./Banking/bankofamerica.com" visible on the filesystem is a disclosure of sensitive information, even if the password is encrypted at-rest. Otherwise I love the idea of *nix based philosophy for password management =)

tanderson92• 7 years ago

This is why pass-tomb was invented.

nickjj4• 7 years ago

The path does leak some information but in that case the bad actor would also need to know the username along with the password (both of which would be encrypted).

But you have to ask yourself. Who are you protecting against here? Are people browsing around your laptop / workstation without you monitoring what they're doing?

If someone has your machine without your consent, then you're pretty much screwed because 99.99999% of people will leave themselves logged into things like gmail which requires no password to access it once the machine is powered on. It's basically this xkcd scenario: https://xkcd.com/1200/

taeric4• 7 years ago

Is it possible to use a security token with this? My last search was not fruitful. :(

nickjj4• 7 years ago

Token in what sense? A pass phrase? If so, yes because you can assign a pass phrase to your gpg key.

Then you can choose to either type it in every time you unlock a password or cache it for your session (depends on how important security is for you).

Personally I cache it for my session. This way I only need to type in my pass phrase once when I power on the machine.

The best part about the pass utility is that it piggy backs off GPG for its encryption mechanism.

pier253• 7 years ago

In the iterations it says that LastPass requires "100,100" iterations to brute force in non running state, but in the image table at the end with colors it says "5K" for LastPass.

Is this a mistake or am I missing something?

TheDong• 7 years ago

requires "100,100" iterations to brute force

That phrase doesn't really capture what iterations means there. How you said it makes it sound like you only have to try 100k computations to brute force a valid answer, which is certainly not true.

It's talking about key stretching / key derivation [0].

That is not 100100 iterations to brute force it, that is 100100 iterations of PBKDF2-SHA256 applied to the password you type in as the master password.

It does look like the tables are not identical. However, since lastpass's docs [1] say it's 100100 (and configurable), I'd say that's likely the accurate default value.

[0] https://en.wikipedia.org/wiki/Key_stretching

[1] https://support.logmeininc.com/lastpass/help/about-password-...

pier253• 7 years ago

Thanks for the explanation

jsutton3• 7 years ago

5000 iterations (of PBKDF2) was the original default, and last year it was increased to 100,100 iterations to keep up with hardware capabilities.

thecopy• 7 years ago

I just moved from LastPass to 1Password7, and this sentence will make me consider moving back:

Surprisingly, we found that it is less secure in the running state compared to 1Password4. 1Password7 decrypted all individual passwords in our test database as soon as it is unlocked and caches them in memory, unlike 1Password4 which kept only one entry at a time in memory. Compounding this, we found that 1Password7 scrubs neither the individual passwords, the master password, nor the secret key (an extra field introduced in 1Password6 that combines with the master password to derive the encryption key) from memory when transitioning from unlocked to locked.

That is unacceptable, what type of developers do they have?

Ajedi329• 7 years ago

If you're going to hold that against them, LastPass is just as bad:

During a workflow to derive the decryption key, the master password is leaked into a string buffer in memory and never scrubbed, even when LastPass is placed into a locked state.

SlowRobotAhead8• 7 years ago

Not that storing a masterpass as sting is acceptable - nor that I readily believe that statement entirely. But why would you be using any of these without 2FA?

SlowRobotAhead8• 7 years ago

If it’s an interesting annecodte to you, I moved myself an 5 people in my company from 1Pass v4 to LastPass, no complaints from anyone and the iPhone integration is unbeatable.

Altogether I’ve moved 100 people to LastPass and some of those users have been not-exactly-power-users, yet, zero complaints from 100 people. A year later almost every single one is still using and the downstream effect of children/friends/kids is surely in the hundreds. They owe me a shirt or something really!

LastPass isn’t perfect but it’s pretty great for the price. What made you switch to 1P v7?

johnmarcus2• 7 years ago

As an admin, laspass is anything but great. Having to create a shared folder for every user and group is ridiculous. I will switch to 1Password teams soon most likely, although bitwarden is the new hotness these days.

throwawaymath• 7 years ago

Are the people using LastPass commenting on how nice the interface is, or are they just not saying anything at all?

I have to use both LastPass (enterprise) and 1Password 7 (personal). The experience is pretty incomparable: the LastPass user interface and browser extension are abysmal, whereas 1Password is very enjoyable. On the most recent version of Chrome, the LastPass extension is slower, less intuitive and less organized than the 1Password extension. 1Password also has more features and a fast desktop application for macOS.

Note that I'm not saying LastPass doesn't work. It works...but it's an incredible pain for me to use every day at work after using 1Password at home. I think the design sucks, to put it bluntly.

stanski• 7 years ago

I've been using lastpass for 8+ years and had a previous employer move their password management to lastpass as well (they are still using it from what I hear). I've been nothing but supportive of them from the get go. But I have to say I'm starting to get a little disappointed. While security/functionality are the number one priority, I feel like once you get those figured out you can at least try to work on the UI a little bit. I don't think that aspect has changed since I started using it and if anything it's been getting worse. I now have multiple pet peeves with it: 1. Firefox now sometimes complains about the lastpass addon slowing pages down (sounds like they don't care much to maintain their FF addon) 2. I can't turn off the login field icons while lastpass is logged out so those are always present in login forms (until I login and it reads my addon settings to turn them off) - this is probably an addon bug but see above. 3. I think the default security settings when you install the plugin are too permissive, probably in an attempt to increase uptake (which is a big no-no to me) 4. Lately it's taken multiple back and forths when emailing support because they just can't be bothered to read the initial request. I end up repeating myself a number of times before they stop responding with some canned response that doesn't apply to my support request.

I'm probably done renewing. I've been using keepassx for things like banking and trying out bitwarden for the less consequential stuff. Sorry - this turned into a rant.

mediocrejoker5• 7 years ago

They also address that in their response. It stems from the fact that they use memory-managed programming environments, so they don't have that level of control over memory.

pier253• 7 years ago

Here is the response from 1Password: https://discussions.agilebits.com/discussion/comment/493044/...

Ajedi329• 7 years ago

Interesting, so their augment is essentially that the memory-safety provided by the use of a memory-managed language is more valuable to them from a security standpoint than the memory scrubbing capabilities afforded by a lower-level language?

mediocrejoker5• 7 years ago

I think that's a fair characterization of their response, yeah.

As someone in that thread pointed out, I would say that the onus should be on the OS SDK to provide memory management primitives specifically for the purpose of security that can be zeroed out after use.

They also point out that the threat profile is someone who can read your system memory when 1P is locked (serious compromise already), but is unable to read it when it's unlocked (otherwise why bother reading it when locked), which is a pretty small set of use cases.

gruez3• 7 years ago

The threat model used for this assessment pretty much never happens in reality. If you're arbitrarily reading memory using software, then you can also install a keylogger or steal clipboard contents, which the authors themselves concede no password managers can protect against. So what's really being evaluated is how well password managers can withstand physical attacks (DMA/coldboot), which isn't a concern for 99.999% of people. Furthermore, if your attackers had physical access, they could very well install a physical keylogger to steal your passwords, bypassing your password manager's countermeasures entirely.

SlowRobotAhead8• 7 years ago

In the case of 2FA devices, a keylogger won’t get you much on a remote machine.

I think the more obvious path is that if you have memory access, just wait for the decrypted contents to be exposed.

blitmap• 7 years ago

- I am no security person myself. -

I always liked this idea: https://krypt.co/

Basically using an entirely separate device to authorize your access. 2FA devices still connect to the computer requesting access, I liked the idea that your phone act as the gatekeeper without ever touching your computer.

Problem is: It's a phone. Apple has done much but I wouldn't trust it either.

xoa4• 7 years ago

Even for many 2FA devices however, root access on the accessing machine can allow for hot online attacks. Not all tokens include some kind of system independent operator intention mechanism, ie., you must touch the token or input a PIN or biometrics on the token itself for each action. Many instead have the PIN inputted via the connected system. The token does protect the private keys themselves of course, so a remote attacker can't take them and then utilize them independently later, nor prevent the operator from removing the token or whatever. But with root, and while the token is in the system, attackers who had already taken the secondary auth (trivial with that level of system access) would be able to silently use it for anything the operator could. And even for tokens that do require an independent physical operator presence and decision indicator, root would still open up a lot of paths for social engineering (ex, wait for them to want to perform a real 2FA action, intercept it insert the attacker's own, then show an "error try again", then allow it to proceed so it looks like a brief blip which many users will ignore).

Basically even pretty good 2FA systems aren't at all full defenses if an attacker has root. They can help in very important ways to minimize the potential damage, to make recovery easier (since private keys are never compromised), to aid discovery/auditing, etc. But it's hard to avoid there having to be some trust in the client at the end of the day. And it's often a lot better to decentralize trust into client devices rather then something that can be centrally compromised. It's much harder for attackers.

Password Managers are no different, their raison d'etre is essentially trying to move the trust foundation more to clients. Client trust is a req though and any "compromise" that depends on controlling the client is uninteresting. They're basically a hack recreating PKI badly, but in a world where the technical foundations for a proper one didn't develop it's a good bandaid.

Ajedi329• 7 years ago

What if someone steals your laptop and decides to see if they can get any sensitive info off of it before they wipe it and sell it?

Probably not a common scenario right now, but if this threat goes unfixed for a long time and tools become available to automate the attack I could see it becoming a problem.

xoa4• 7 years ago

What if someone steals your laptop and decides to see if they can get any sensitive info off of it before they wipe it and sell it?

That's what full disk encryption and (eventually) hardware security chips and the like are for. It's not a threat model that has anything to do with password managers.

Probably not a common scenario right now

It never can be, that's the point. Physical attacks simply do not scale like purely online attacks do, let alone attacks on centralized single points (ie., a central password database).

but if this threat goes unfixed for a long time and tools become available to automate the attack I could see it becoming a problem.

What? What tools "automate" stealing your notebook?? And also breaking through whatever physical security it has, like TPM or Apple's T-series chips or even just plain soldered on storage/memory/everything? The latter make repairs more of a PITA but they also make physical attacks significantly more difficult, even stuff like cooling memory and swapping (and encrypted memory based around tamper resistant security chips is a potential thing too).

dontbenebby12• 7 years ago

Yeah, just as a thought exerise I took a look at my DB.

The high value things (bank, email, web hosting accounts) all have 2FA enabled.

The lower value ones, I can easily recover from a breach by simply resetting the PW via my email.

The only real threat I see is if you're storing passwords to things like encrypted containers (Veracrypt, TrueCrypt etc) but as you pointed out if they'd had something running on your system you're hosed either way.

bronco21016• 7 years ago

Don’t you also store the 2FA recovery codes in the PW manager though? I haven’t found any other good method for this other than printing them out but that comes with its own issues obviously.

jgalt212• 7 years ago

I love 2FA for high value services, but I worry about adversaries getting access via social engineering ("I lost my key fob, and I'm on vacation please help!")

nickpsecurity• 7 years ago

Exactly. Attacker is already in God Mode. Doesn't need to be probing password managers. The report has some value in testing a claim about how well secrets were hidden in or scrubbed from memory. Not like advertised...

Ill also add that mitigating stuff like this was an early, easy use of separation kernels. They put the secret-protecting components, like disk encryption and VPN, in dedicated partitions outside Linux VMs. That worked well.

DanHulton• 7 years ago

Except for the case where they entire password DB can be decrypted and read (in the case of 1Password 7, at least). Sure, a keylogger could eventually get all of the passwords I use on the regular, but it couldn't get literally every password I have and in a nice, neat format along with where the passwords are used.

Reading the current password from memory = keylogger, I'm not worried about that. Reading every password I have or have ever had, including (I assume) encrypted notes and such? = keylogger on steroids.

UncleMeat4• 7 years ago

Is that different? "Eventually get all of your passwords" sounds just as bad to me, especially since only some passwords are worth anything and my email password can be used to reset all other passwords.

xoa4• 7 years ago

Sure, a keylogger could eventually get all of the passwords I use on the regular, but it couldn't get literally every password I have and in a nice, neat format along with where the passwords are used.

But passwords aren't just about you, they're about the server they're also stored on too. Without a password manager, how do you propose remembering unique fully random passwords for dozens to hundreds of services over the course of decades? And they must still be easy enough to enter that most people will actually use it. And also be trivial to change at will, for when (not if) the password database is compromised. And in fact you directly bring up the problem of that being worse for services you use extremely infrequently. So if you use it frequently the keylogger gains it anyway, and if you don't use it frequently then what's your usable system again? Also, are not the most important things you want taken the least also the ones that tend to be used the most frequently? And with access to your email and in fact all communication services used on that system you don't see how an attacker wouldn't just be able to "I forgot my password" for many if not most services?

Reading the current password from memory = keylogger, I'm not worried about that.

You're not worried about your system being rooted? I'd say you have an awfully different set of priorities when it comes to security then most of the world even beyond HN.

tedunangst• 7 years ago

At some point you're going to enter the master password to unlock the next password, at which point it will be stolen, giving up every password.

m1sta_• 7 years ago

Masterpassword compromised = all compromised.

jiveturkey• 7 years ago

yup. if the report is meant to be other than marketing, they would have done well to have an outside review before publishing. i don't see any acknowledgements section so i assume that didn't happen.

this is basically soft marketing of the skills they bring to the table. realistic/practical threat modeling not being one of them.

sec_evaler• 7 years ago

I would argue that while memory read vulnerabilities are not normally commonly known, that does not begin to mean they don't exist. Look at any number of stories where vulns have escaped detection (or reporting) for 10, 20, even 30 years!

gcbw2• 7 years ago

ignoring the fact that a password manager makes this as convenient as microformats (which we never got, ironically) for stealing secrets.

phyller2• 7 years ago

Consider this. I am in a coffee shop. Someone walks by and grabs my machine. This is a huge annoyance, need to replace and setup a new machine vs. (with my password manager getting hacked) my life is basically over because as far as anyone is concerned the thief is more me than I am. Depending on who took it, I might as well move to the forest and live in a mud hut because I am never going to be able to clean this up.

This actually happened to someone at my company. But their passwords weren't compromised. If they were, I can't even imagine, the guys who took the machine were really trying to do whatever they could to ruin him and the company.

pvg3• 7 years ago

my life is basically over

You make it sound like there's no mitigation at all for a password being compromised which isn't the case in practice.

dasil003• 7 years ago

Hold on, are laptop thieves skilled in cracking encrypted password managers? Even if they are I think you'd have time to rotate passwords.

kerng• 7 years ago

It's about degrees of freedom.

Even if an adversary has access to a machine, there is a difference if they can choose when/where to exploit/steal something, or if they have to wait for an action. If the adversary cant get persistence, a simple reboot of the machine might get them evicted and the keylogger is gone. That's just a simple example but it shows that things are more nuanced.

Apple for instance has efforts so that even root can't just debug arbitrary processes or unlock keychains of other users without them agreeing to it or disabling SIP.

It's about raising the bar and removing degrees of freedom for an adversary, so it becomes more dfficult. In the end of course systems can always be exploitable (given enough resources are allocated in breaking in).

deepsun• 7 years ago

Yep, just like your home locks are not rated as "breakable/unbreakable", but "how many minutes to break". Most locks are below 5 minutes.

Locks requiring more than 30 minutes are considered pretty much unbreakable (easier to break through the nearest wall).

dalf• 7 years ago

What about Thunderbolt device plug into a laptop ? If the device scans the memory using PCI-E ? See https://www.cl.cam.ac.uk/techreports/UCAM-CL-TR-934.html ( https://news.ycombinator.com/item?id=19216781 )

SloopJon• 7 years ago

Reposting my comment from the previous submission:

From a Washington Post article on this study: "LastPass had me speak with its top technical executive -- but it also got [lead researcher] Bednarek banned on Bugcrowd, the site for researchers to report flaws, because he disclosed the bug to me."

https://www.washingtonpost.com/technology/2019/02/19/passwor...

More from CyberScoop:

https://www.cyberscoop.com/bugcrowd-adrian-bednarek-lastpass...

iambateman• 7 years ago

"First and foremost, password managers are a good thing. All password managers we have examined add value to the security posture of secrets management"

This is the point for 99.9% of people. If you're at risk of having someone attack you and your digital life in a targeted way, perhaps consider evaluating the security implications of each password manager.

Otherwise, pick any damn password manager and focus on something else.

SlowRobotAhead8• 7 years ago

Otherwise, pick any damn password manager and focus on something else.

Absolutely! For me, choices narrowed down to needing something cloud portable, 2FA, not needed another service like Dropbox just to access it, IOS integration, easy to share passwords with auto-update and revocation. But yea... just use something!

yinyang_in• 7 years ago

I always prefer if it's via Dropbox or some other sync provider, so that my data is safe. For example dropbox, they are into storage and their speciality is in storage, safety of data. Password manager app can be good in app making part but storage with them always scares me and I think their speciality is in app making.

What do you think about it, just want to understand your perspective nothing else.

Yes i use a password manager.

seppin• 7 years ago

Otherwise, pick any damn password manager and focus on something else.

People make the same mistake at the gym. "Which workout plan should I use?"

Any plan. Any of them.

iamkroot• 7 years ago

I've always said that the best workout plan is the one that you'll actually do.

jrockway• 7 years ago

Any computer program is going to have data in RAM. It's up to something else to protect that. (This is why ARM machines have that encrypted RAM, this is why real security software runs in some sort of tamper-proof area, etc. This paper shows the general "whatever" attitude that general-purpose computers adopt towards attacks where someone has physical or root access.)

phishfi• 7 years ago

Can't a password manager use the TPM to encrypt/decrypt the passwords in real time, a la Windows Hello?

loeg3• 7 years ago

It seems like a TPM would be a good way for the OS to implement CryptProtectMemory.

asdz• 7 years ago

clipboard sniffing? I remember years ago, there's some tools that you install and it will automatically encrypt all the clipboard content to prevent sniffing.

Nowadays, a password manager can't even do that?

* might not be straightforward as it install some DLL inject stuff

r1ch• 7 years ago

I wonder if password managers should consider running under a higher privileged account (eg administrator). This would prevent lower privileged processes (eg your typical drive-by malware) from being able to get a handle to read memory without also using a privilege escalation technique.

gruez3• 7 years ago

It's not foolproof because the malware could also hook your browser and sniff your passwords from there. It's better than nothing though (instead of getting all your passwords they only get whatever you've entered).

briHass• 7 years ago

That's exactly how I have KeePass configured on Windows 10. I've set my keyfile (additional entropy for the encrypted password DB, combined with master password) access to only allow the Admin account. Then, I set keepass.exe to always run as Admin, which of course prompts the UAC whenever it is launched.

This actually accomplishes a few things:

* The keyfile is safe from processes launched using the standard user account (i.e. non-elevated). Malware accidentally launched by 'me' can't read it.

* Keepass.exe is running in the admin process space, which protects its memory from processes running in non-elevated space.

* Launching admin-space Keepass, and seeing the UAC prompt, Microsoft includes information about how the exe is signed -- which Keepass is -- that allows me to verify every time that I'm not launching a bogus keepass.exe.

* The password database file is still in user-land, so it can be synced with standard cloud sync tools. It is worthless without the keyfile though, even if my master pass ever slipped.

calibas• 7 years ago

I had a client who required me to use LastPass because he didn't want me to see the the actual password. I was wondering how that was even possible, maybe some kind of magic I didn't know about. Turns out it's trivial to get the passwords using a browser's built-in inspector.

entity345• 7 years ago

Are there any decent password managers that do not charge monthly fees?

I don't mind paying to buy a good tool but the Saas model is getting out of hand.

steve19• 7 years ago

Bitwarden

7v3x3n3sem9vv• 7 years ago

Bitwarden. It's open source, even the server side, which allows you to set up something like lastpass without depending on someone else's servers, not that you need to; you can totally use Bitwardens' default setup. I'm an open source proponent, so it's a no brainier for me to support them as a paying customer, given the quality of the product and knowing that they're releasing most of their work under an open source license.

8fingerlouie• 7 years ago

I'd love to host my own Bitwarden, but it seems kinda odd that they've locked in on MSSql, even for self hosting. I really don't need yet another DMBS to maintain and secure.

If i ever find the courage to run Docker in production, i will probably give it a try.

zokier2• 7 years ago

Keepass, or its XC incarnation, does not charge monthly fees. It also incidentally fares best in the summary comparison table in Figure 21 in the article, although as others have pointed out that does not really mean much.

qudat• 7 years ago

I use https://www.passwordstore.org/ and love it. It's a lot more manual than lastpass or 1password but all I care about is keeping my devices synced, being in full control of my data, and not having to pay anything.

kdtsh• 7 years ago

It's so good. It's incredibly simple and fast (it's just a script which works as a front end to git and GPG); it's very well documented and there are only a few commands you need; devices are sync'd by way of git; it's got a heap of add-ons, including an OTP generator. There's even a great iOS app, PassForiOS, which also handles OTP 2FA (the only downside to the app is that you have to clone from an existing pass repository, but that's not a big deal unless you don't have a computer or you were planning on starting to build your password database on your phone). Never used it on Windows or Android so I can't say what it's like there, but if you're on macOS, a combination of GPG Suite, pass, and the default Terminal make password management easy.

edit: there's the unfortunate fact that the names of files in which passwords are stored are in plaintext, since it's all ordinary files and directories. pass-tomb is supposed to be a good way of encrypting your .password-store directory, but I don't think this is compatible with the iOS app. Still, not a serious problem for my use case anyway, and a solution is available if I'd be willing to forego the iOS app.

gnfurlong2• 7 years ago

I'm surprised there's not more discussion of passwordstore in this thread. In light of the parent article, I want to point out one of it's killer features (from my perspective). As it's built on top of PGP, you can move your private key to a PGP smart card and then decryption operations are done entirely on the smart card. Your private key never leaves the card. If you're using a Yubikey as the smart card, there's also a feature where you have to touch the card to approve of any operation (even when already unlocked by entering the smart card's password).

tejado• 7 years ago

https://github.com/tejado/Authorizer

Please note, I'm the owner of this project.

"The idea behind Authorizer is, to use old smartphones as a hardware password manager only. To avoid manual typing of long and complex passwords everytime you need them, Authorizer pretends to be an USB keyboard (e.g. over an USB On-The-Go adapter). With a button press inside the App, it will automatically enters the password for you on your pc, laptop, tablet or main smartphone."

taco_emoji• 7 years ago

Keepass + Dropbox is what I use.

hsnewman• 7 years ago

So why don't these tools use CryptProtectMemory to protect the memory: https://docs.microsoft.com/en-us/windows/desktop/api/dpapi/n... ?

Someone12342• 7 years ago

Your own article tells you why:

Using CryptProtectMemory and CryptUnprotectMemory for password encryption is not secure because the data exists as plaintext in memory before it is encrypted and at any time the caller decrypts it for use.

In order to benefit from CryptProtectMemory you have to carefully lifecycle strings in and out of secure storage as needed; this wouldn't mitigate some of the issues presented in the article.

loeg3• 7 years ago

C# has a core class to safely lifecycle protected strings. The decryption key is only resident in kernel memory, so a dump of the user process when protected theoretically cannot read the protected string contents. (Of course, this doesn't prevent against a cold boot attack unless the keys are escrowed in a TPM.)

https://referencesource.microsoft.com/#mscorlib/system/secur...

gabriel34• 7 years ago

Keepass does have coutermeasures against clipboard sniffing (auto-type instead of copying to clipboard) and keyloggers (Two-Channel Auto-Type Obfuscation).

These are effective against non-specialized attack software.

https://keepass.info/help/v2/autotype_obfuscation.html

illumin8• 7 years ago

These evaluations all happened on Windows, which is notoriously bad at protecting memory from snooping by other processes.

Does anyone know how well MacOS versions of all the password managers would have fared? I suspect the JavaScript based password managers like LastPass would fare similarly, but it would be interesting to see if 1Password has better security on MacOS than Windows.

bndw• 7 years ago

MacOS isn't much better. I just tried it myself using fridump[0] and was able to see plaintext secrets when dumping memory.

But as pointed out above, if someone has access to dump your machine's memory then you've got bigger fish to fry.

[0] https://github.com/Nightbringer21/fridump

zokier2• 7 years ago

Windows, which is notoriously bad at protecting memory from snooping by other processes

Whaaat? I'm going to call citation needed here. Afaik there is not significant difference in the memory protection model between any of the mainstream OSes

ashton314• 7 years ago

How much does this apply to secret managers like [Hashicorp Vault](https://vaultproject.io)? I get it it's more than "just" a password manager.

nothrabannosir• 7 years ago

What I don’t see this paper focus on is security offered by the OS. Historically and commonly, for “normal people” apps, we’ve only been able to rely on one kind of compartmentalisation: memory is not readable between apps. However, any file the user has access to is fair game for any app. This is a Bad Time for any password manager, or really any app (think e.g. about your email cache in a thunderbird profile, or Firefox session tokens which can be siphoned , etc).

For ages, on Unix this could be solved with users and daemonisation. Later came SELinux which is criminally underused.

In the popular OS market, for a while there was flocker, on OSX. It used event hooks in the kernel to allow fine grained control over filesystem access, locking certain dirs down to certain apps. The app was bought by some enterprise offering (f-secure) and taken offline. The creator (Jonathan Zdziarski) was then hired by Apple. Recently, similar features have been rolled out by Apple natively for OSX. Try reading your iMail or calendar cache using the terminal: you’ll get an iOS-like pop up window asking you if this app has permission to your mail, or contacts. This is a step in the right direction.

All that’s left is for Apple to allow the user (or app developers) to specify such locks ourselves. This was already possible with flocker, but unfortunately that’s nowhere to be found, anymore. Perhaps it’s possible for apps delivered through the App Store? This would solve the problem that a password manager offers any process access to your full (encrypted) password DB, which is a pretty serious problem (makes the master password too valuable!).

Given the direction things are moving in, and the hire of Jonathan, I’m very hopeful this will eventually arrive. It would be a tremendous win for security on OSX. This everything-goes mentality of FS access has been a pet peeve of mine for over a decade. :) and, tbh, I think it’s a much more relevant attack vector than some process “reading memory”.

https://techcrunch.com/2017/04/06/f-secure-buys-little-flock...

ComputerGuru• 7 years ago

It doesn't help that many of these password managers are written in high-level languages (some are Electron based, ffs!) where you have zero control over the actual allocation (and subsequent clearing) of bits. The best you can do is overwrite the memory and hope that the framework/runtime/GC does the right thing.

magnat• 7 years ago

For .NET, there is SecureString class [1] which provides reasonable protection against stealing secrets from memory. Not many password managers (if any) use .NET, though.

[1] https://docs.microsoft.com/en-gb/dotnet/api/system.security....

Someone12342• 7 years ago

Here's the source code if anyone is interested in how it works:

https://referencesource.microsoft.com/#mscorlib/system/secur...

NoblePublius• 7 years ago

I use Dashlane. Am I dumb? Lastpass looks better.

Password Managers: Under the Hood of Secrets Management

Related Stories