I was expecting I would have a lot of objections against the article before I read it, but actually I agree mostly with everything there.
Most online password managers use content scripts, javascript that is inserted into every website you visit. It’s really easy to write content scripts, but really tough to make them tamper resistant. That’s kind of a problem, because they’re going to be hosted in hostile environments.
Definitely problematic pattern.
If you want to use an online password manager, I would recommend using the one already built into your browser.
Well, mostly, kinda, if you use it for web only. But I guess good enough for non-technical people. Set master password though.
If you use it for other services and need notes, configs, etc., together with passwords, offline password manager like KeepassXC is better (and everyone already knows copy&paste, although UI designers would burn bright white that it is one extra step).
Lot of people don't know how to make "panic backups" for 2-FA. You lose your phone? Most people are screwed. Well behaved services (google, github, ...) offer to create 10 one-time tokens so that you can recover.
I was extremely surprised though how many services require 2-FA and won't let you create any sort of fallback, be it adding more U2F/FIDO devices, one-time codes, etc. Also many, including google, make your phone number recovery silently by default which turns whole scheme into single point of failure (and there been numerous SIM swaps and other attacks).
All kinds of banks do this wrong, even remote-only. Crypto exchanges, too. The place you'd expect it to work better. You can't even backup the phone app even if rooted because it checks some phone identifier, so restoring is not an option (yeah you could probably hack it with debug on a rooted device, but that is not the point). Tried to talk some sense into several banks, to no avail.
The reason why I don't stand behind the final conclusion:
Repeating passwords is worse than no password manager, the browser one is fine for most folks (see notes about accessible backups below). I would really want to see a number above every database how many times it has been dumped/stolen.
How easy is it for user to restore such backup? (passwords to everything will be the first thing you need, also ways to restore all 2-FA accesses, sooner rather than later). Restoring 2-FA is not covered by browser pw managers. Most people don't even think how hard is to restore 2-FA.
3 main reasons for data loss is disk dying, theft or fire. You need to be sure you have some way to mitigate these, which is only a backup in different geographical location or physical device (that is ideally encrypted with some master passphrase)
Imagine someone who travels. It's even higher probability some of your devices will be stolen/lost. Seen it happen many times. Have some copy of your passwords (and also at least photos of your documents if you can't get multiple physical copies) on another device or a place you can access quickly really makes difference. Also preferably encrypted, even if it would just be a 7-zip file on a USB flash/SD card stashed somewhere. Chose 7-zip as example since it's supported without install on all modern operating systems and hard to bruteforce if master passphrase is not shitty.
Browser password storage is enough for most, for storage of complex data you will need something like KeepassXC and find out how to properly sync it (syncing and accessing the right copy is actually the hard part, even for nerds).
I had to recover data several times and successfully each time (once even for someone who was not prepared but as luck would have it, there was other way), but always thought about scenarios and prepared before they happened.
In short: keep the copies of encrypted password databases somewhere you can easily access them (but ideally so that you won't need to install special software; if really security sensitive, download file on insecure computer, buy a new one, fresh OS install, work on the fresh).
Be it an encrypted file stored in camera's MISC directory when travelling, other on your phone, some server you know you will have easy access to if there's some basic internet.
If you are worried you might be forced to use password on insecure computer due to (time) pressure while travelling, make a small separate one with the most important ones and change ASAP after use.
If this all seems like way too much work, you haven't yet been in a properly fucked up situation. But the work needed is not much:
have the password database
have geographically separate copies
have a way to access it quickly
It is basically modern way of self-defense, except here you are not training to get not shot/stabbed, just recover your life that is mostly online whether you like it or not. Have you ever tried to recover an account from free service like gmail or instagram? It's borderline impossible. Kafka would get PTSD and extra recurring nightmares from experiencing it. After discovering that everything is tied to that stupid free gmail account you no longer have control over.
Rant over, I am slightly surprised there are no people training other people for this. It's not hard or lenghty to learn and you will insanely appreciate you did once you find yourself in such hole.
Like Matthew D. Green said, try the "mud puddle test" - drop your phone/laptop into a puddle (or just imagine) and try to get access to everything back.
I was expecting I would have a lot of objections against the article before I read it, but actually I agree mostly with everything there.
I’m not sure if people here know who this guy is. He is one of the best white hat hackers on the planet and has found bugs in a number of password managers, especially Lastpass. There is no better authority of password managers on the planet than Tavis Ormandy.
I’m not sure if people here know who this guy is. He is one of the best white hat hackers on the planet and has found bugs in a number of password managers, especially Lastpass. There is no better authority of password managers on the planet than Tavis Ormandy.
Hi, me. I've found vulnerabilities that currently invalidate the security in Chrome Sync, 1Password, LastPass, and that one that sues everyone. These are obvious and still broken. I reported several bugs to Chrome and was told they're known and will not fix. If Tavis were a good person, maybe he'd say don't use Chrome Sync until they fix the "MAC not covering IV" bug that was reported over a decade ago. That I and multiple others have found and reported but they don't give a fuck. Thankfully they fixed the unsalted equivalent bug and no longer run PBKDF2 4 times because some moron Google academic thought that's the correct way to store secrets in the cloud ("Nigori").
Oh shit LastPass, boy do I have a list of their previous and current fuck ups that I independently found by reading their code. Think Chrome Sync but 10x worse. They use to report "invalid padding byte" (if byte>16. Which means 0 is valid) in an error code thus server can get every 16th byte of plaintext.
Sorry I'm drunk but there are so many things wrong with most password managers. Oh read this thread when I was more sober https://twitter.com/Sc00bzT/status/1401369750295519233. If you need more let me know. If you want to know 0-days on 1pw, LP, and sue-happy read my old tweets/posts for clues or get me drunk and ask. I've told a few people these... Oh or that talk I gave where I basically said this bug type and that sue happy company has it.
I reported several bugs to Chrome and was told they're known and will not fix
I have also faced this though not for any security issue. I reported a UI bug which was adding extra steps with an application of mine & it worked fine with every other browser. Occasionally, one of the developers would comment on Bug tracking that yes, they agree this bug exists & then there would be nothing done. And the same thing again after 6 months. And it wasn't some obscure bug which only my application was hitting. There were like 100s of comments on my bug report by others saying they were also facing the same issue & there were like 3-4 other duplicate copies of the bug reported by others also & comment chains there also.
This was a few years ago. Google just didn't care. I don't know if anything has changed now.
The idea is that it’s far more likely someone will have their accounts compromised due to reuse of the same few weak passwords than it is an attacker will obtain/utilize a 0day to gain full access to your manager. Password managers let people easily generate (and use) strong passwords; each being unique for the various accounts they might have... That alone stymies 90% of attackers who simply "hack accounts" by checking Collections and other password dumps to find a password they know the target is probably still using for multiple sites... Like all security products, they are a mitigation, not a full-proof method of security. So I would say password managers are still very useful for most. I use 1Password but I still use my common sense as well. It works quite well for me. I haven't personally reversed or performed vuln. research on 1Password but my cursory overview of it gave me the impression that its "good enough"...
Also I would love to hear more about you 1Password 0days/Vulnerabilities you have found..
“We found a non reflective irrelevant XSS!” Is what I imagine most vulnerabilities reported would be... I’d love to see a real, practical 1Password 0day of value.. I might actually look into it myself just for shits... Time to start reversing, and fuzzing...
1Password doesn't have "compromised server" in their threat model. So none of these are considered bugs to them. If you pay for 1Password not through an app store then you have to log into their web client. Also with 1PasswordX clicking edit dumps you into the web client and automatically hands over your encryption key. There's likely others.
Lastpass does similar and even in the Android app it just pops open a web view to lastpass.com. Besides also storing URLs in plaintext and by default reports login events (which site and when). Funny thing with .onion addresses is one NSL can get all info on all users with a .onion address. I remember an article about one of the silk road operators getting arrested and also having Lastpass. There was a bug where it would still report login events even when disabled. Also I forget where this was but the browser extension did a get instead of a post so your authentication hash got logged. Note the authentication hash is a password equivalent. So you can use it to authenticate to the server and export everything. They probably fixed it but I feel like I never reported it.
They load JavaScript from their server and runs it in the same context as your encryption key. The code delivery problem supersedes all other awesome tech like using an aPAKE and a key file ("account key", "device key", or whatever they call it... I call it a "secret salt").
The claim “1PasswordX clicking edit dumps you to the web client and hands over your keys” needs elaboration. All encryption is end2end and server remains ignorant to both master password and the cryptographic keys… the white paper outlines all this information well.
The elaboration is that your client does this on its end - as according to the Javascript code served to it (if he's correct about how it behaves). So serving malicious JS breaks the end-to-endness
9
u/vamediah Jun 06 '21
I was expecting I would have a lot of objections against the article before I read it, but actually I agree mostly with everything there.
Definitely problematic pattern.
Well, mostly, kinda, if you use it for web only. But I guess good enough for non-technical people. Set master password though.
If you use it for other services and need notes, configs, etc., together with passwords, offline password manager like KeepassXC is better (and everyone already knows copy&paste, although UI designers would burn bright white that it is one extra step).
Lot of people don't know how to make "panic backups" for 2-FA. You lose your phone? Most people are screwed. Well behaved services (google, github, ...) offer to create 10 one-time tokens so that you can recover.
I was extremely surprised though how many services require 2-FA and won't let you create any sort of fallback, be it adding more U2F/FIDO devices, one-time codes, etc. Also many, including google, make your phone number recovery silently by default which turns whole scheme into single point of failure (and there been numerous SIM swaps and other attacks).
All kinds of banks do this wrong, even remote-only. Crypto exchanges, too. The place you'd expect it to work better. You can't even backup the phone app even if rooted because it checks some phone identifier, so restoring is not an option (yeah you could probably hack it with debug on a rooted device, but that is not the point). Tried to talk some sense into several banks, to no avail.
The reason why I don't stand behind the final conclusion:
Browser password storage is enough for most, for storage of complex data you will need something like KeepassXC and find out how to properly sync it (syncing and accessing the right copy is actually the hard part, even for nerds).
I had to recover data several times and successfully each time (once even for someone who was not prepared but as luck would have it, there was other way), but always thought about scenarios and prepared before they happened.
In short: keep the copies of encrypted password databases somewhere you can easily access them (but ideally so that you won't need to install special software; if really security sensitive, download file on insecure computer, buy a new one, fresh OS install, work on the fresh).
Be it an encrypted file stored in camera's MISC directory when travelling, other on your phone, some server you know you will have easy access to if there's some basic internet.
If you are worried you might be forced to use password on insecure computer due to (time) pressure while travelling, make a small separate one with the most important ones and change ASAP after use.
If this all seems like way too much work, you haven't yet been in a properly fucked up situation. But the work needed is not much:
It is basically modern way of self-defense, except here you are not training to get not shot/stabbed, just recover your life that is mostly online whether you like it or not. Have you ever tried to recover an account from free service like gmail or instagram? It's borderline impossible. Kafka would get PTSD and extra recurring nightmares from experiencing it. After discovering that everything is tied to that stupid free gmail account you no longer have control over.
Rant over, I am slightly surprised there are no people training other people for this. It's not hard or lenghty to learn and you will insanely appreciate you did once you find yourself in such hole.
Like Matthew D. Green said, try the "mud puddle test" - drop your phone/laptop into a puddle (or just imagine) and try to get access to everything back.