Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

Critical Vulnerabilities In Web-Based Password Managers Found

samzenpus posted about 3 months ago | from the protect-ya-neck dept.

Security 114

An anonymous reader writes A group of researchers from University of California, Berkeley, have analyzed five popular web-based password managers and have discovered vulnerabilities that could allow attackers to learn a user's credentials for arbitrary websites. The five password managers they analyzed are LastPass, RoboForm, My1Login, PasswordBox and NeedMyPassword. "Of the five vendors whose products were tested, only the last one (NeedMyPassword) didn't respond when they contacted them and responsibly shared their findings. The other four have fixed the vulnerabilities within days after disclosure. 'Since our analysis was manual, it is possible that other vulnerabilities lie undiscovered,' they pointed out. They also announced that they will be working on a tool that automatizes the process of identifying vulnerabilities, as well as on developing a 'principled, secure-by-construction password manager.'"

Sorry! There are no comments related to the filter you selected.

KeePass? (3, Interesting)

Electricity Likes Me (1098643) | about 3 months ago | (#47449247)

I'd be really curious to here there opinions on KeePass, which isn't web-based but certainly in the same category.

Re:KeePass? (4, Informative)

mlts (1038732) | about 3 months ago | (#47449281)

I'd probably say KeePass is as secure as things get, since it doesn't use the Web in any way, shape, or form.

What I'd like to see with password apps that use a cloud provider for backend storage, (be it 1Password, mSecure, or so on), would be a keyfile that is manually transferred between devices, and never is put on the cloud backend. This way, if/when the cloud provider is hacked, the password file is not just protected by the passphrase, but by a keyfile that an attacker would have to compromise a physical device to get.

Re:KeePass? (2)

mlts (1038732) | about 3 months ago | (#47449297)

Hate responding to my own posts, but adding another idea... Each endpoint device has its own private key... so the data that is stored on the backend cloud provider would be conventionally encrypted, but would be unlockable by any key in the access list, similar to a PGP attachment that lists multiple public keys. That way, one can add and remove devices by using their key, and no common file needs to be shared.

Re:KeePass? (5, Funny)

Anonymous Coward | about 3 months ago | (#47449311)

I e-mail myself my passwords with the site name in the subject line and the password in the body of the e-mail. It works really well for sites I forgot the password for, and it's 100% safe as Google uses HTTPS by default now.

Re: KeePass? (0)

Anonymous Coward | about 3 months ago | (#47449685)

Why not just keep them in a Google Doc marked private?

Re: KeePass? (0)

Anonymous Coward | about 3 months ago | (#47449875)

I use Pastebin!

Re:KeePass? (2)

allquixotic (1659805) | about 3 months ago | (#47449373)

I have a YubiKey NEO that works perfectly with LastPass, both on desktop systems via USB, and on my mobile device via NFC. The key has internal non-volatile storage but no battery; when it's plugged in and used, it atomically reads from storage; uses the input from storage as a salt to generate a unique one-time password (a long ASCII string); transmits the password to the host device; then updates the non-volatile storage with some magic to ensure that the next one-time password is unique, unguessable and cryptographically secure.

An attacker would need my LastPass password (which is not, itself, stored in my LastPass vault); my physical YubiKey; and the knowledge to use both in tandem, in order to gain access to my LastPass account.

Re:KeePass? (3, Informative)

Anonymous Coward | about 3 months ago | (#47449457)

The "magic to ensure that the next one-time password is unique" is a counter, an integer one higher than the previous time.

The checksum of (counter + internal private key) is what results in the final 32 chars of the sequence (the first 12 being your userid).

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47451957)

while still a counter in a technical sense, likely it's some sort of maximal-length LFSR, rather than an n-bit binary counter... less hardware, and possibly less-easily predicted (though still 100% deterministic, so not cryptographically secure by itself)..

Re:KeePass? (1)

mysidia (191772) | about 3 months ago | (#47450659)

An attacker would need my LastPass password (which is not, itself, stored in my LastPass vault); my physical YubiKey; and the knowledge to use both in tandem, in order to gain access to my LastPass account.

Yes, because the Lastpass website enforces this two factor scheme.

On the other hand, once it's open on your computer: the entire database is available for RAM-scraping malware to take a peek.

Or to decrypt using only the master password, since, as I understand: it's just the Lastpass website that requires the 2-factor, before allowing your software to download the DB.

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47453243)

If you have RAM scrapping malware on your computer, you're pwned anyway.

Re: KeePass? (0)

Anonymous Coward | about 3 months ago | (#47451817)

What we need is cloud storage accessible by API and that is all. Unfortunately simple economics and good ol' fashioned business prevent that. No company would dare offer a simple service for data storage because they'll be out of business tomorrow. Similarly, no company wants your encrypted data because they can't mine it to turn a profit. If there's one thing the internet of things could do for us is it might decentralize mass data...store your replicated photo album on someone's fridge by enabling rented shared storage. Turn everyone into an IT drone. I'm hating this future already.

Re: KeePass? (0)

Anonymous Coward | about 3 months ago | (#47452165)

What about maidsafe? Isn't that exactly what you're talking about?

Re:KeePass? (1)

Snotnose (212196) | about 3 months ago | (#47449337)

I've got my keePass database on my phone. It's always with me, readily available if I need to logon somewhere and I have a trusted computer handy (and a USB cable, of course),

Re:KeePass? (1)

CastrTroy (595695) | about 3 months ago | (#47449365)

Why not just install the app as well? Then you don't need the USB cable. You just load up you database, and opt to view the password. Then type it in manually. Just be on the lookout for people looking over your shoulder or cameras that could read the screen.

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47449525)

That is essentially what I do: use KeePass(X) on my devices, self-host the database on OwnCloud, and use a non-cloud keyfile plus passphrase.

Re:KeePass? (1)

LordLimecat (1103839) | about 3 months ago | (#47449595)

You can do this with KeepPass, Google Drive, and a sneakernet'd keyfile. Move the keyfile to a non-synced location on each common computer (and / or carry it with you on your phone or USB drive), stick the KP database in Google Drive, viola. Secure access to everything from everywhere.

Re:KeePass? (1)

lhunath (1280798) | about 3 months ago | (#47450801)

How about no keyfile at all [masterpasswordapp.com] ? Keeping backups of a keyfile in secure locations, syncing a keyfile between multiple devices and handhelds securely and without conflict, etc all needlessly complicate password management and eventually affect overall security. Also, if an authority obtains your keyfile through any form of search, they are legally within their right to force you to provide the key to unlock it. Not so if there is no encrypted vault.

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47451175)

I have seen other apps/extensions like that, which pretty much take the site name XOR-ed with your passphrase, spit it through a hashing algorithm like MD5, then spit out a random password. For a lot of things, that is decent, but if someone ever guesses your passphrase, you are completely hosed. I prefer to have a unique password [1] for each website. If someone compromises one password, it is tough to figure out what the password from another site will be from my last.

[1]: I tend to use Diceware and casino dice (not "seconds" or cast offs from the pit boss, but the expensive dice that are of the correct grade, which have a sharp edge and will tumble well on softer surfaces.

Re: KeePass? (2)

lhunath (1280798) | about 3 months ago | (#47451425)

That is very dangerous: when the master password is trivial to reverse from the site password, an attacker could easily set up a hoax site, get your site password and reverse your master key. Master Password above uses a hmac-sha-256 of a 64 byte master key which is something you can't just reverse. It also uses an expensive scrypt based salted key derivation to get that key from your master password, which is also something you can't reverse.

Re:KeePass? (1)

Just Some Guy (3352) | about 3 months ago | (#47450823)

This way, if/when the cloud provider is hacked, the password file is not just protected by the passphrase, but by a keyfile that an attacker would have to compromise a physical device to get.

If you believe Apple, that's how their iCloud Keychain [apple.com] works. They say they can't decrypt your keychain, because the keys are embedded in your phone and never transmitted.

Re:KeePass? (1)

Noah Haders (3621429) | about 3 months ago | (#47450847)

what is a keyfile if not a password?

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47449421)

Is "automatize" even a word? (Captcha: Odious. Sounds about right)

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47449483)

I had the same question, googled it and found that it seems to be a real word. Never heard it before.

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47449615)

Is "automatize" even a word? (Captcha: Odious. Sounds about right)

Try pronouncing it this way: au-tom-at-ize

Re:KeePass? (3, Funny)

Mister Liberty (769145) | about 3 months ago | (#47449675)

Which in Dutch --translated for the occasion to English-- would mean 'Ouch! Tom Ate Ice".

Re:KeePass? (1)

Anonymous Coward | about 3 months ago | (#47449669)

No, but automate is.

Re:KeePass? (3, Informative)

itsownreward (688406) | about 3 months ago | (#47449447)

I have KeePass installed on my computers and KeyPassDroid on my phone and tablet. The file is shared between them all using Dropbox. This way, if I change it one place it's available at all the others automagically, and in case it gets corrupted I have a 30-day history of changes at Dropbox's site. I've had no problems, I like its built-in and configurable password generator, and it works a treat with the KeeFox plugin for Firefox.

(YMMV in that you may have issues with Dropbox, but for me, it works.)

Re:KeePass? (1)

Erioll (229536) | about 3 months ago | (#47449493)

I do the same, except I use Google Drive as my "sharepoint" for the file. After looking at a bunch of the "costs money" ones, Keepass just made the most sense.

Re:KeePass? (1)

gbjbaanb (229885) | about 3 months ago | (#47449679)

same here - only I don't try to keep it in sync with other devices (don't want changes I make to my PCs keepass db to be automatically synced to my phone that might be stolen)(I might be going a little too paranoid here)

I also use Mozy for the cloud storage, as it encrypts everything stored (with a different key) and it has history.

Keepass is awesome, my only worry is that I forget which file I used as the encryption 2nd part and delete it one day!

Re:KeePass? (1)

esperto (3521901) | about 3 months ago | (#47451803)

I do the same as well, but also use a key file that I keep only on the devices and not on any cloud based service, that way it is harder if dropbox gets compromized to break the keepass database (altough I bet NSA has a trick or two).

Re:KeePass? (1)

itsownreward (688406) | about 3 months ago | (#47452273)

From all reports, Dropbox is compromised by default. However, I also figure they have an easier way to get into any account I have via NSL or preexisting backdoor than to go crack my KeePass file. I'm just trying to keep everyone else out.

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47452857)

The NSA aren't going to waste resources attempting to break your KeePass database for the hell of it. Please put into perspective how totally insignificant you are to the interests of the NSA. If you do end up becoming a target of inquiry, nothing you can do will prevent them from getting what they want out of you (short of living like a hermit completely cut off from civilization).

Re:KeePass? (1)

Anonymous Coward | about 3 months ago | (#47449571)

I have no issues with KeePass, but I do wish to note that Password Safe [sourceforge.net] is good enough for Bruce Schneier [wikipedia.org] , which is more than good enough for me.

Re:KeePass? (1)

TechyImmigrant (175943) | about 3 months ago | (#47450145)

KeePass has mac/pc/android clients. Password safe (which I used to use) does not. The PC client is great, but the mac options in particular suck huge donkey balls.

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47450407)

pwSafe [app77.com] is a port of Password Safe for OS X and iOS. It isn't free, but it is cheap. I have a password vault that is synced among OS X and Windows clients via SpiderOak [spideroak.com] , with Password Safe on Windows and pwSafe on OS X able to read and write to it with no problems.

Re:KeePass? (1)

TechyImmigrant (175943) | about 3 months ago | (#47450797)

My wife tried the elephant one on her mac (I forgot the name, but there's an elephant in the logo). It was awful.
This was a while ago. There may be better now.

I couldn't find a good Android one. I don't know if that has changed either, since I switched to KeePass.

Re:KeePass? (1)

Smerta (1855348) | about 3 months ago | (#47452875)

I think it's literally called "Elephant" (as in, "an elephant never forgets").

(Honestly, at first I thought you might be thinking of Evernote (apologies!), but then I saw your UID & figured that was very unlikely...)

Re:KeePass? (1)

Mister Liberty (769145) | about 3 months ago | (#47449689)

It pulls in a lot of mono libs on Linux, I see. Yuck!!

Re:KeePass? (4, Informative)

Jesus_666 (702802) | about 3 months ago | (#47449773)

You can always try KeePassX [keepassx.org] (for Linux and OS X; use the latest 2.0 Alpha release) and MacPass [github.io] (for OS X), both of which are compatible with the KeePass 2.x database format. They might not have all the features but they work rather well and you don't have to deal with the monstrosity that is KeePass on a non-Windows system.

Re:KeePass? (1)

Mister Liberty (769145) | about 3 months ago | (#47449837)

Will look into it. Thanks!

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47454525)

KeepassX is awesome. I've had no problems with it during several years of use.

Re:KeePass? (1)

TechyImmigrant (175943) | about 3 months ago | (#47449791)

KeePass works well.

The logic is sound. You own your password file, it is encrypted and integrity checked. You can keep it somewhere shared (like google drive or dropbox) so each of your client machines has a copy for redundancy, but changes are shared and available to all devices.

I have a home PC, a work PC and Mac Book and an Android phone all using the same keepass file and it works great.

Web based services make no sense whatsoever. Why trust a website company when you don't have to?

Re:KeePass? (2)

Dutch Gun (899105) | about 3 months ago | (#47450909)

You're telling us not to trust a web based service, but then tell us you keep your data shared like google drive or dropbox? I see no appreciable difference in practice there. Lastpass is essentially Keepass + a specialized dropbox-type service. Your advice is especially ironic given the spotty security dropbox is known for [zdnet.com] .

At some point, you have to make informed decisions about the tradeoffs between security and convenience. For me, using Lastpass is a convenient way to synchronize the strongest possible unique passwords - essentially gibberish - across my multiple computers. I feel that having strong, unique passwords across the web is critical to keeping my numerous accounts secure.

This is exactly how security is supposed to work - a researcher discovers a potential flaw, discloses it to the vulnerable companies, who then promptly fix it and discloses this fact in detail to it's customers [lastpass.com] . The system is arguably more secure than before, not less.

Incidentally, as it turns out, this attack is apparently only applicable to those not using a browser plugin. That's not to discount the seriousness, but I was never actually vulnerable to this attack, since I only use Lastpass from my PC using Firefox + Lastpass plugin.

Re:KeePass? (1)

TechyImmigrant (175943) | about 3 months ago | (#47450949)

>You're telling us not to trust a web based service, but then tell us you keep your data shared like google drive or dropbox? I see no appreciable difference in practice there. Lastpass is essentially Keepass + a specialized dropbox-type service. Your advice is especially ironic given the spotty security dropbox is known for [zdnet.com].

The problem is not in the remote storage. It's in the local client that does the work to turn your clicks and typing into a secured file that doesn't need to trust the storage medium to do anything except store.

The 'web integration' puts your password manager in a really bad place - in the browser. What could possibly go wrong? Surely no one attacks web browsers.

Re:KeePass? (1)

Dutch Gun (899105) | about 3 months ago | (#47454315)

>You're telling us not to trust a web based service, but then tell us you keep your data shared like google drive or dropbox? I see no appreciable difference in practice there. Lastpass is essentially Keepass + a specialized dropbox-type service. Your advice is especially ironic given the spotty security dropbox is known for [zdnet.com].

The problem is not in the remote storage. It's in the local client that does the work to turn your clicks and typing into a secured file that doesn't need to trust the storage medium to do anything except store.

The 'web integration' puts your password manager in a really bad place - in the browser. What could possibly go wrong? Surely no one attacks web browsers.

Yep, that's very true. At this point, though, most attacks are directed at Java, Flash, or the browser's Javascript interpreter. These vectors are still dangerous because of potentially malicious content being served by untrustworthy servers. I uninstalled Flash some time ago, and make good use of noscript to prevent untested scripts from running, as that's still a dangerous attack vector. Keep in mind that plugins are run in separate processes, which affords some natural protection and isolation. Note that the attack mentioned in this article was not possible when using the plugin, which nearly everybody actually does, according to Lastpass statistics.

I well understand how it sounds extremely risky to trust your password database to a third-party service, but I feel that Lastpass itself has been built very carefully with security as the primary concern. After all, that's their first and only business. This makes it a bit different than many other web-based services, for whom security is often a distant secondary issue, or one which was hastily implemented or improved only after a disastrous breach. Still, if there's ever a massive security breach at Lastpass, feel free to send me a big "I told you so". Security can be only really validated over the course of time and many determined attacks, and so far, Lastpass has proven itself to be secure.

Keepass is a fine product, and there's nothing wrong with keeping your password database more directly in your own control. Security is always a tradeoff between protection versus convenience, and obviously, using a third-party database escrow service leans too far in the "convenience" direction for some. There's nothing wrong with that, as you can never get bitten by leaning in the "protection" direction.

Re: KeePass? (-1)

Anonymous Coward | about 3 months ago | (#47449827)

Niggers,niggers, and yet more nigggers. Oh and a Paki.

Re:KeePass? (-1)

Anonymous Coward | about 3 months ago | (#47449855)

I'm sorry but... "here there"? That's so silly it has to be intentional, surely?

Re:KeePass? (0)

Anonymous Coward | about 3 months ago | (#47450039)

I'd bee reely curious too hear their opinions won KeePass, wich isn't web-bassed butt certainly inn thee category.

Re:KeePass? (2)

znrt (2424692) | about 3 months ago | (#47450519)

I'd be really curious to here there opinions on KeePass, which isn't web-based but certainly in the same category.

i've always had trouble with putting all my apples in the same basket, so i never touched things like keepass, kisskiss nor any other keyring. that there's folks doing that *OVER THE WEB* is staggering. if i weren't speechles right now i'd say they deserve being raped in their most intimate identity.

Surprise (2)

pmontra (738736) | about 3 months ago | (#47449301)

The web in insecure, don't store passwords in the web. Use keepassx [keepassx.org] instead. You get it for Windows and OS X on the site, for Linux using package managers, for Android on the Play Store and maybe also for iOS (look for MiniKeePass).

Re:Surprise (1)

allquixotic (1659805) | about 3 months ago | (#47449333)

To claim that it is impossible or futile to store passwords on the web is missing the point. The nature of the content is immaterial. If you are of the opinion that passwords can't be securely stored on the web, then you must also believe that NO content can securely be stored on the web -- in which case, have fun living in the dark ages, where the only thing you can do with the web is share information that you're fine with being released to the general public.

I, on the other hand, really like it when I can click a few buttons and a package with something I need shows up on my doorstep a day or two later. But oh, if it's "futile" to secure anything on the web, you couldn't give a company your address or financials to bill you for shipment! Better call them up on the telephone to place your order, because nobody has ever wiretapped a telephone, right?

No. The fix here is to identify the security vulnerabilities and fix them, not to spread FUD about security on the web.

Re:Surprise (5, Insightful)

jsherma2 (549469) | about 3 months ago | (#47449385)

I think there's a difference between "being willing to accept the risk of my credit card(s) being compromised on the internet" and "being willing to accept the risk of every account password I have being compromised on the internet". I essentially have insurance to help me recover losses from my credit cards. Having every bank account and retirement account drained by an enterprising criminal with access to all of my account and personal details is on a completely different risk level.

Re:Surprise (3, Insightful)

allquixotic (1659805) | about 3 months ago | (#47449519)

I think there's a difference between "being willing to accept the risk of my credit card(s) being compromised on the internet" and "being willing to accept the risk of every account password I have being compromised on the internet". I essentially have insurance to help me recover losses from my credit cards. Having every bank account and retirement account drained by an enterprising criminal with access to all of my account and personal details is on a completely different risk level.

Let's assume for the moment that you're correct and that there is a difference in risk level between submitting your name, address, email, credit card number, CVV2 (these are the fields required for a standard online order form), and storing all your passwords on the Internet.

Let's assume someone actually does intercept your order form, and gets all the above-mentioned personal data on you (perhaps because the company processing your order stored all your order info in an unprotected SQL database). Many people acknowledge that, with this amount of personal information, a lot of damage can be done, starting with identity theft. Yes, there are many protections on credit cards, but other personal details can be used as leverage to get access to even more details. This is starting to look like more than simple credit card theft.

Also, if you're not storing your passwords on some website, where ARE you storing them? If you don't store any passwords anywhere, chances are you don't have a perfect, long-term eidetic memory, so you probably use the same password everywhere. That's just as risky, if not riskier, than using LastPass -- if an attacker compromises just one of the sites you use, they can try that password on random sites across the web and gain access to a slew of your accounts.

Let's be a bit more charitable and assume you use completely different passwords on different sites. OK, now we're getting serious. You are going to need somewhere to store all these passwords -- that's the simple reality of it. Only the extremely rare individual can remember them all in their head. So what do you use? A paper card file? That's great, unless you invite a guest in your house who may not prove 100% trustworthy, like an A/C repairman... Or if you happen to live in a dangerous part of the world where house robberies are common, a password card file would definitely be something a thief would want to steal. Or you could just get really unlucky, even in a low-crime area, and get robbed anyway. The same logic as the card file effectively applies to such things as KeePassX, since an unhindered thief can take your laptop, phone, or whatever you use to store your KeePass database on. Once they have your device, you're basically owned. Remember, we have to be fair here; you're assuming the thief is smart enough to break the security model of a business that builds its entire reputation around security, like LastPass, so we have to also assume the thief is smart enough to break the security model on your physical box, whatever it may be. Most people are not going to employ physical or digital countermeasures that are sufficient to keep very sophisticated thieves from breaking into your box once they have physical access. Full disk encryption is still quite the rare thing, and brute forcing a typical-length KeePass password isn't all that hard anymore with GPGPU or an EC2 compute cluster once you've obtained the database file.

Now, since LastPass supports two-factor authentication via various physical methods, such as the YubiKey, simply obtaining your LastPass password will not be sufficient for them to gain access. They'll also have to be a sophisticated thief, which brings us back to square one, where LastPass and KeePass are about equal on security: you'd have to get robbed, and the thief would have to steal the correct things, then break into them in order to gain access. I concede that users of LastPass or similar services who opt out of two-factor authentication are taking a greater risk, but that's their prerogative. I choose to use two-factor authentication.

Having considered all the factors, I think a properly-secured LastPass account with two-factor authentication is not especially riskier than using KeePass. Probably the safest-available method would be to store your passwords on paper in a locked safe; then hire guards to guard you and the safe, and build a military-spec bunker to live in on a deserted island. Outside of that, I don't think the distinctions are bright enough to say, "aha! that's significantly riskier!" (one last time, assuming you use two-factor auth on LastPass.)

Re:Surprise (2, Insightful)

Anonymous Coward | about 3 months ago | (#47449859)

Your entire argument is based on a false premise.

Food For Thought - It is easy to develop a simple algorithm to remember passwords and thus remember different passwords to any website. Essentially, unless you are being tortured, no one will be able to know your algorithm for setting passwords (you store the algorithm in your head). Your algorithm may appear "weak" if someone knew it but no one has to know it (i.e. you could use the first 5 letters in the web address to seed your algorithm).

Re:Surprise (0)

Anonymous Coward | about 3 months ago | (#47450249)

comment subject, is, ironically: "Surprise"(!)

Surprise, the algorithm solution is a great one... until you consider that different websites, especially and particularly sites that would be damaging for a malicious stranger to gain access to, have different password requirements.

banks, credit card, student loans repayment (personal example), etc...

Point being, once you throw a few of those outliers into the equation, you're back at square one...

Re:Surprise (1)

Anonymous Coward | about 3 months ago | (#47451767)

Not really. Your algorithm can deal with these requirements fairly easily and you can guess your password more than once (failed password means you couldn't use your algorithm 100%, so proceed to "alternate") OR look up what the "rules" where for creating a password OR reset your password.

A decently well defined and broad algorithm should handle most of these issues without a problem. I know mine does.
Basically, make sure your algorithm will always result in the use of a capital, a number and a special character and will always result in a moderate length password. Make sure that the special characters can be systematically "substituted" if not allowed.

As always, you can use your brain a little if all of these safeguards result in an ineligible password. Maybe you have to remember a few passwords separately; Or remember two algorithms - then you may have to guess twice but its not a big deal.

The ONLY problem is generating and remembering passwords that a) need to be shared with others or b) are created by others. Any
(mental memory) ideas for this?

Re:Surprise (1)

SrLnclt (870345) | about 3 months ago | (#47451739)

I tried something like this in the past. I had a root phrase I used, and added some other things like certain characters from the URL at the beginning/end. A few common issues with this. Say you want to use the last character in the company name as a modifier for your base password. For Dish Network, do you use h for the last character of the URL (dish.com) or k for the full name (dish network)? Some of the sites I have accounts with have an obscure, seemingly unrelated website/URL for their billing and such. Do you use that URL or the company name you think of typically? If you use the URL, what if they change the URL on you (say from dish.com to dishnetwork.com)? Also, there are outliers. Some require capitals, lowercase, numbers, and/or symbols. Some don't allow symbols. Some have minimum character lengths, others have maximums. If one of them requires a password change quarterly, do you change the root phrase and change all your passwords 4 times a year? This sounds good, but in practice it can be problematic when dealing with dozens of passwords.

Re:Surprise (0)

Anonymous Coward | about 3 months ago | (#47453305)

I do this and it is problematic for the reasons you cite. What happens is you try a couple guesses and you normally get it. A few times of that and you remember the oddities of the site. I still use KeePass, but more for the metadata. Addresses (I move a lot), security questions, account numbers, what email address I used, random birthdate, etc...

I plan to move off this system for passwords that change often or ones I have to type often. Too many places are starting to copy Google in their horrible 'never able to reuse a password' policy. Pick a password that's something you want to change. Ex: sp3nMoreT!meWithFam1ly; And you'll soon find yourself following your advice. For the random sites with likely weak security and you don't visit often, an algorithm works best. Within a few guesses you'll get it. If not, take the time to dig out your encrypted and offline password database. If it's not worth the time, then the site isn't worth it.

Re:Surprise (0)

Anonymous Coward | about 3 months ago | (#47451829)

Your algorithm may appear "weak" if someone knew it but no one has to know it

Security through obscurity is no security at all.

Re:Surprise (1)

lgw (121541) | about 3 months ago | (#47451161)

I have a simple text file with a mnemonic for my password for each site I use. I have half a dozen or so passwords - not so many I can't remember each, but too many to keep straight which is for which site. So I might have a note that this bank uses my strong financial password, while that one uses my weak financial password, and that store uses my merchant password, and so on.

There's nothing recoverable from that file.

Re:Surprise (0)

Anonymous Coward | about 3 months ago | (#47451589)

That's exactly what I do.

Re:Surprise (0)

Anonymous Coward | about 3 months ago | (#47449687)

None of which should be connected to the Internet.

Ahh, so many old and true truisms still ignored for greed and laziness.

"Informtion wants to be FREE!"

"The Internet is only useful for the FREE and OPEN exchange of information."

"There is not now, never has been and never will be such a thing as a secure server."

And so on,,,,

Wouldn't be a bit surprised if I could retire nicely just on the money stolen around the world via Internet while I typed this.

Re:Surprise (2)

mlts (1038732) | about 3 months ago | (#47449471)

Done right, storing passwords on the web can be decently secure, especially if there is some part of the decryption key (be it a public key, a secondary authenticator, or a keyfile) that is not available to the attacker, in combination with the master passphrase.

I'd say the best implementation of this would be a utility that piggybacked on the cloud provider of choice, so one isn't limited to GDrive, Dropbox, Box, Skydrive, iCloud, or others. The utility would ask for permission just for its own directory (if possible), and would store its main DB file, as well as some backups in that directory. That way, the password program author or company doesn't have to maintain a cloud infrastructure.

Re:Surprise (2)

DMUTPeregrine (612791) | about 3 months ago | (#47449895)

The problem is that you can't hide things from the service provider with nothing but a browser. You need an addon or such to do secure crypto. You need to decrypt the password database locally, in-browser, and without an addon that means using JS crypto, which isn't ideal. Your mailing example is very different, since it doesn't matter if the service provider knows the address and financials, they're the intended recipient of the info! With a password manager, you don't want the service to be able to learn the contents of the encrypted database. That means the encryption/decryption must be done client-side.

That said, it's perfectly possible to store the encrypted database on the internet. A local encryption/decryption program (like Keepass) works just fine, and if combined with a cloud storage client that also does local encryption/decryption (Wuala, Spideroak, etc) it should be quite secure.

Re:Surprise (2, Interesting)

Anonymous Coward | about 3 months ago | (#47449729)

The web in insecure, don't store passwords in the web. Use keepassx [keepassx.org] instead. You get it for Windows and OS X on the site, for Linux using package managers, for Android on the Play Store and maybe also for iOS (look for MiniKeePass).

I don't subscribe to this absolutist position. Web based password managers like Lastpass certainly have their uses and are extremely convenient when tons of forums and websites require you to have accounts. They make it easy to login effortlessly and across multiple computers. They are also safer in that they let you have unique passwords for every account.

That being said, the smart thing to do is to:

1) Not save any bank account / Money related passwords on a web based password manager. Heck, I wouldn't even trust my own computer. I store these strictly in my head

2) Enable 2-factor authentication on any website that if compromised, could allow the attacker to steal your identity and cause more mischief. Gmail would be a prime example of such a website.

This strikes a good balance of letting me have the convenience of online password managers for non-critical sites, and even some critical ones that support 2-factor authentication.

Re: Surprise (0)

Anonymous Coward | about 3 months ago | (#47452561)

That only holds true if you believe you can manage infrastructure better than a multi million dollar listed company. Some of these companies suck and you probably can. Some others you can trust today but maybe not tomorrow when the board decides to cut IT spending to 5% to increase shareholder value (??). Your security profile changes daily or hourly depending on the whims of these online entities and the social values of some pissed off hackers living in some basements somewhere or some kingpin hiring one of these pissed off hackers to finance his drugs enterprise, who knows...

It's not that the world is out to get you per se, it's that the world is out to make money and security is one of those things that only has value if it's oversold and overstated. It's a bottomless money pit otherwise.

Fucking what? (0, Troll)

Anonymous Coward | about 3 months ago | (#47449319)

A "web based" password manager is the epitome of the "web based" retardedness which is plaguing our modern society.

Re:Fucking what? (0)

Anonymous Coward | about 3 months ago | (#47449959)

Exactly. That, and putting passwords on a mobile phone.

Automate grammar checker (0)

Anonymous Coward | about 3 months ago | (#47449329)

'automatizes'...let's hope it was the weak grammar of the poster not that of the researchers as I wouldn't trust anyone trying to 'automatize' anything!...now automate...sure I could get on board with that....

For that reason... (5, Funny)

Parker Lewis (999165) | about 3 months ago | (#47449353)

To avoid remember all the password managers, we need a password manager manager.

Re:For that reason... (2)

PPalmgren (1009823) | about 3 months ago | (#47450107)

Passwords all the way down

Re:For that reason... (1)

MobyDisk (75490) | about 3 months ago | (#47450565)

That's actually not a bad idea!

Suppose you used 5 different password managers, and each one stored a password. Then, a password manager manager would glue the 5 passwords together to get the final password. Or maybe hash them to produce the final password. That way, when one password manager is cracked, it would not be enough to get your password.

Of course, then the password manager manager could be cracked. Hmm.... so you would need 5 password manager managers. Which would require a single password manager manager manager.

Storing cloud passwords in the cloud? (4, Insightful)

QuietLagoon (813062) | about 3 months ago | (#47449359)

Even if the cloud-based password repositories are secure (and apparently, they are not), why not just target the cloud services themselves for security exploits?

.
Eliminate the middle-man, go wholesale.

Re:Storing cloud passwords in the cloud? (4, Informative)

Enry (630) | about 3 months ago | (#47449449)

In the case of LastPass at least, the passwords are encrypted locally and then sent to the server for storing. Your only possibility there would be searching through and finding stores with weak passwords, or finding a crack in the encryption. Otherwise, the attacks have to take place on the end user side.

Re:Storing cloud passwords in the cloud? (3, Interesting)

mlts (1038732) | about 3 months ago | (#47449513)

The problem is that there is an conflict between a password suitable enough for protection (i.e. 20+ characters), and something quick enough to access in a short time.

mSecure addresses this in an interesting way -- they cache the extra long sync password used for the cloud. The password that is used to encrypt the synchronized database that sits in iCloud or DropBox is different from the app's passphrase. Since most phones have decent innate protection, it is not impossible, but very difficult to dump the data on a locked device [1], so one can have a fairly easy to type in PIN on the device, but the synchronized backend file is protected with a much longer (and more secure) passphrase.

[1]: iOS on the iPhone 4 and up always encrypts. Android since 3.x has the option of using md-crypt and encrypting the /data partition, then using another tool to separate the password asked on boot to decrypt that partition from the screen locker password.

Re:Storing cloud passwords in the cloud? (1)

Enry (630) | about 3 months ago | (#47450083)

The local password is cached for LastPass as well. You can either have to re-enter it each time you open the browser, after a period of time, or only once. Having had a work laptop that had personal passwords stored in it taken back when I was laid off, I realized I needed a way to store passwords such that I can still store passwords but in a way it doesn't rely on a single system.

the most secure password manager (1)

Anonymous Coward | about 3 months ago | (#47449419)

A zipped text file, that is the most secure password manager there is

Re:the most secure password manager (0)

Anonymous Coward | about 3 months ago | (#47449531)

Add ROT13 and you're good to go.

Re:the most secure password manager (0)

Anonymous Coward | about 3 months ago | (#47449631)

No need, zip files support encryption

Re:the most secure password manager (1)

ColdWetDog (752185) | about 3 months ago | (#47449805)

Do they have a sense of humor?

Question i have Roboform (1)

Stan92057 (737634) | about 3 months ago | (#47449521)

Question i have Roboform and was under the impression it was not a web based program? It does have cloud PW saving but that is an option. All my data is saved on my PC. Can someone explain this to me. I do not want use any web based programs that save my personal data on some server i have no control of.

Re:Question i have Roboform (1)

CreamyG31337 (1084693) | about 3 months ago | (#47449731)

It's all saved on your PC/Mac/USB stick unless you purchase a yearly RoboForm everywhere licence and tell it to sync to the cloud. I think that's the only way to use it from a phone as well.

Web-based password managers (1)

empty_other (1116615) | about 3 months ago | (#47449629)

Does the Windows 8 password vault count as a "web-based password manager"? It does store your password on a third party online server. Hopefully its properly secured by good programmers and doesnt have any obvious (direct quote from the article) "logic and authorization mistakes to misunderstandings about the web security model, in addition to the typical vulnerabilities like CSRF and XSS".

TL;DR - (from a security guy) (5, Interesting)

xxxJonBoyxxx (565205) | about 3 months ago | (#47449751)

From page 7 of the paper (http://devd.me/papers/pwdmgr-usenix14.pdf):
- LastPass, RoboForm and My1login all had "bookmarklet" vulnerabilities (used if you share passwords across the web - shudder)
- LastPass, Roboform and NeedMyPassword all had "web" vulnerabilities
- My1login and PasswordBox both had "authorization" vulnerabilities
- LastPass and RoboForm both had "UI" vulnerabilities

The other thing I wondered at was why the special mention of "creating tools to automatically identify such vulnerabilities" when there's a bunch of packages that already do that...until I looked on page 14 and saw the list of US government grants that sponsored this paper, plus mention of some Intel funding. (If you want the money to flow, first identify the problem...)

Not surprising (1)

Control-Z (321144) | about 3 months ago | (#47449829)

This illustrates exactly why you keep all your important data in-house and preferably offline.

Re:Not surprising (1)

Ksevio (865461) | about 3 months ago | (#47451615)

Yes - clearly you should never type your passwords for online services into anything that might be connected to the Internet.

I don't use LastPass for more important sites like banking (or even email), but I certainly use it to generate and store a secure password for all the random web forums I visit.

Slightly misleading, fearmongery headline (4, Informative)

myvirtualid (851756) | about 3 months ago | (#47449851)

This was on HN a few days ago; my comment there was the same: In the case of LastPass, the headline is misleading and a little fearmongery.

There were two issues with LastPass and NEITHER affected its storage of persistent passwords, that is, neither affected the feature the vast majority of us use passwords managers for!

One concerned a targeted attack against one-time passwords (OTP), the other concerned bookmarklets, which are used by less than 1% of the user base, according to LastPass. Personally I didn't know either feature existed until I read the LastPass blog entry about these two vulnerabilities.

A truer headline would have been Vulnerabilities found in less-frequently used features of LastPass; persistent site password storage unaffected".

Re:Slightly misleading, fearmongery headline (1)

Anonymous Coward | about 3 months ago | (#47450449)

Read page seven of the paper, you're completely wrong. http://devd.me/papers/pwdmgr-usenix14.pdf

They had one job (3, Informative)

Animats (122034) | about 3 months ago | (#47450143)

A "web based password manager" has one job - keeping the passwords secure. That's all it does. If anyone easily finds a vulnerability in that, the service is a failure.

brainpower (2, Insightful)

clam666 (1178429) | about 3 months ago | (#47450303)

I just remember my passwords. As if someone else storing them is possibly safe.

Re:brainpower (1)

Darinbob (1142669) | about 3 months ago | (#47450375)

Remember, don't share your passwords with anyone. This includes a frigging website!

Seriously, how hard is it to just store them in a text file on a thumb drive that is removed and kept separate. Or an encrypted thumbdrive so you only have to remember one password.

If you want a secure one-time pad for very secure transactions, then there are products that do this but which are not web based junk.

Really, 99% of those passwords are for junk stuff, facebook, twitter, slashdot, other fluff, there's really one 1% that you need to pay attention to and keep those ultra secure. (and never let a site log you in automatically via google or facebook)

Re:brainpower (0)

Anonymous Coward | about 3 months ago | (#47450849)

I just remember my passwords.

Me too

"password123" for the win!

Re:brainpower (2)

steelfood (895457) | about 3 months ago | (#47452633)

I use bash.org to store my passwords.

Are people that stupid? (0)

Anonymous Coward | about 3 months ago | (#47450405)

Why would anyone use an online password manager? Dumb Dumb Dumb. If you willingly give your keys to someone else, even under the promise to keep them safe - you deserve to get robbed.

Passpack? (1)

XLT_Frank (2759563) | about 3 months ago | (#47450645)

I would be curious about any vulnerabilities with Passpack.com. :/

Re:Passpack? (0)

Anonymous Coward | about 3 months ago | (#47451085)

+1 I love passpack, yet, I never see reviews or in depth reports like this involving them. I find this a bit weird, I guess it comes down to publicity.

Call me a luddite (0)

Anonymous Coward | about 3 months ago | (#47451095)

But for stuff which can rightfully fuck my life like all my password, I have my own encrypted paper repository. For anybody else this look like a half used crossword book among a staple of others. For me at some precise place I have my secure password, and it is nigh impossible to trace from outside.

Oblig XKCD (1)

esperto (3521901) | about 3 months ago | (#47451837)

Are any of the vunerabilities related to a wrench? http://xkcd.com/538/ [xkcd.com]

News Just In! (0)

Anonymous Coward | about 3 months ago | (#47452161)

Researchers find that One Basket is not the safest way to store all your eggs. Currently undecided as to whether to count them as Chickens prior to hatching; more research needed.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?