8 ms·

I'm a LastPass user and everything here was pretty much as I expected with one exception - the unencrypted metadata in the vault. That's extremely disappointing

I'm a LastPass user and everything here was pretty much as I expected with one exception - the unencrypted metadata in the vault. That's extremely disappointing. The ECB stuff isn't really used any longer, the OTPs are kind of hacked on, no surprise there. I was willing to tolerate that stuff for an overall decent solution. But now realizing that they're handling URLs in this way... I just can't use it anymore or recommend it in good faith. So what do I do? - KeePass looks nice, has multiplatform support and browser extensions but the crpytography in it is sketchy, custom KDF and stuff going on... mobile support might also not be so great though I'm not positive. - PasswordSafe has better looking cryptography, though still not up to where I'd like it to be as well as a worse UI, worse browser support, etc. And last I checked I think Linux support was sketchy. - There are an infinite number of questionable proprietary solutions that have similar problems to LastPass, usually far worse actually... - and a few open source solutions that look good but completely lack in the UI and integration departments. So I'm about to take KeePass, gut the crypto, replace it with simple scrypt and AES-OCB or chacha20-poly1305 and hope I can wind up with something I'm comfortable using - anyone have a better suggestion?

caskance 11y ago
KeePass is open source. If you feel like you can do a better job in certain aspects, please consider sharing those changes so that others can benefit.
- ultramancool 11y ago
  Of course, any eyes I can get on that sort of cryptographic code are invaluable. Applied cryptography is easy to fuck up, as we see time and time again. I'm seriously hoping someone gives me a better solution though, it'd be very nice if somebody had just done this right from the ground up.
bargl 11y ago
I felt the same way until I read the conclusion, "we want to point out that the security team at LastPass responded very quickly to all our reports and lot of the issues were fixed in just a couple days. It was very easy to communicate and work with them." That is why I use LastPass. Because they aren't perfect, but they realize that their reputation for taking any vulnerability very seriously is the most important asset they have. I have heard great things about KeePass so if you make that switch good on you. Edit: Added "very seriously" above.
- bad_user 11y ago
  Does it matter if the support is OK if the app doesn't fulfill its primary purpose which is to keep your data safe?
  - brianbarker 11y ago
    Yes, because every system has flaws in it. Nothing is perfect and given enough time and resources an exploit will be found. Knowing that, if the team listens and fixes the issue, the product goes forward being more secure and trustworthy.
  - vinceguidry 11y ago
    Safe is a relative term and not at all binary. LastPass does exactly the thing I use it for, does it well, and does it mostly transparently. Allow me to easily use different passwords per site. While my LastPass might be hacked one day, if I reuse passwords, then my accounts will be hacked eventually. Not a question of if, but when. Whenever news comes around that a particular site got hacked, I don't even pay attention. Who cares if one of my hundreds of passwords gets hacked? LastPass is somewhat vulnerable, but the architecture of LastPass plus the professionalism of the team means that any threat will be seen coming by anyone paying attention, as reports of an exploit out in the wild. A few people will be caught flat-footed but not everyone. When that happens, we can take steps to mitigate. If worse comes to worst, I can download a copy of the database, change the most important passwords so they're not in the online database, Gmail, banking and such, manage those manually, and hope my database doesn't get hacked. If it looks like it's just getting worse and worse, I can spend an evening changing passwords and migrating to a self-hosted solution. My data is safe in that an adversary would have to break through my personal defenses to get at it. They're not sitting in plaintext on some corporate server somewhere waiting to get hacked.
BostonEnginerd 11y ago
I use Password Store -- uses git + gpg to store all of the passwords. It makes it really easy to maintain a synchronized password store across multiple devices including Android http://www.passwordstore.org/ http://www.passwordstore.org/
- ultramancool 11y ago
  The cryptography in gpg is less than optimal for this purpose and I have to admit I just don't like gpg because it's so big and supports different ciphers, big codebase means more exploitability. But it could work for this purpose, it just seems really inefficient to me. Is there browser integration or a better UI for it?
  - striking 11y ago
    Using GPG means that Password Store is less than 600 lines of bash at its core (minus emacs, completions, so on). http://git.zx2c4.com/password-store/tree/src/password-store.sh http://git.zx2c4.com/password-store/tree/src/password-store.... GPG is maintained, and well. Even as it supports different ciphers, that attack doesn't apply here. And very little functionality is accessed through this script. If that's not a tiny attack surface, I don't know what is.
    - ultramancool 11y ago
      Password Store might be tiny but GPG itself is a huge attack surface - that's the problem. Maintained, yes, well... I'd question that. I don't think it's very heavily reviewed or anything, and vulnerabilities pop up in it quite frequently, enough that I'm uncomfortable using it for serious purposes. https://www.cvedetails.com/vulnerability-list/vendor_id-4711/Gnupg.html https://www.cvedetails.com/vulnerability-list/vendor_id-4711... Many of these vulnerabilities have to do with very important cryptographic code... If you're comfortable with it, that's fine, it's not a bad solution. But personally I'd honestly be more comfortable with plain text files and TrueCrypt, which has no real cryptographic problems even after quite heavy review, the best we've found is a privesc bug in the Windows driver.
emodendroket 11y ago
Take Schneier's advice and write down your passwords: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... I suppose this is a problem if someone breaks into your home and gets into wherever you keep your notebook and steals it but frankly that's hardly the only problem you have in that scenario.
- bargl 11y ago
  I think this paired with LastPass would be great. Email and Banking all on paper with a backup at home. Everything that only has my credit card info and my address can be done through a password manager. Because in my mind those can all be recovered through email, and easily opened through LastPass. Also that advice is from 2005, I wonder if he'd agree with what I said above or disagree.
  - emodendroket 11y ago
    Frankly I don't think anything has changed since then that would change his advice. If anything it seems more sensible than ever.
- m0nty 11y ago
  > We're all good at securing small pieces of paper. Not true, as it turns out. I created passwords for my users and put them on a laminated card as a courtesy, with instructions to keep it in their wallet, purse, etc. They were turning up stuck to keyboards, shelves next to desks, etc. Some people are really crap at securing small pieces of paper.
  - emodendroket 11y ago
    I'll bet you if it were the details to their own bank account they wouldn't do that! It's a problem of how much people care, really (or how much they think the organization cares).
    - m0nty 11y ago
adventured 11y ago
I currently use LastPass, and I previously used KeePass. Now I'm looking to move away from LastPass, post acquisition. I've considered storing text files containing passwords inside of a VeraCrypt or TrueCrypt volume. Or storing the KeePass database file similarly. Any feedback on if this is a bad approach and why?
- ultramancool 11y ago
  It's not a bad approach - it lacks integration, it's easier for malware to grab, but that's about it. Malware can already dump the memory or log the keyboard and mouse to grab what'd be needed to decrypt your LastPass or KeePass, so in the end those solutions are no better than plain text files inside an encrypted container. The lack of integration, generation and other UI niceties is really the biggest loss I think.
  - Solarsail 11y ago
    Well, WRT to malware, KeePass can somewhat mitigate generalized threats. Say, in-memory encryption to protect against memory dumps, using a secure desktop [1] for the master password, and typing obfuscation during auto-type to protect against keyloggers. Well, keyloggers that aren't written with KeePass in mind, at least. Both of those would give it a modest edge over plain text in an encrypted container. [1] http://keepass.info/help/base/security.html#secdesktop http://keepass.info/help/base/security.html#secdesktop This said, both secure desktops and auto-type obfuscation are turned off by default...
    - ultramancool 11y ago
      The whole "secure desktops" thing is a bit of an oxymoron too. If you can gain admin privileges you can steal any desktop and session token you want and keylog it. I've used that trick before to keylog winlogon's "secure" desktop, so surely KeePass would be similarly vulnerable? Additionally a quick patch or in memory modification of KeePass.exe would easily bypass any protection like this, lookup the KeeFarce tool to see an example. I'd hardly call this an "edge" over plain text files in an encrypted container, considering it does nothing to actually prevent exploitation but simply provides a form of security through obscurity. Ultimately once a system is infected, all you can do are half-measures and will wind up worthless against even a mildly sophisticated attacker. Unless you run the software in a separate machine, you're dead in the water and it's pointless to discuss what happens post-infection when anything is really possible.
zeveb 11y ago
> PasswordSafe has better looking cryptography, though still not up to where I'd like it to be as well as a worse UI, worse browser support, etc. And last I checked I think Linux support was sketchy. PasswordSafe is, I think, the current best-of-breed with respect to its crypto. Like you, I have some concerns with it (notably the use of Twofish rather than AES, and a too-low PBKDF2 default), but it's the best you can get without writing your own. It seemed to run ok in WINE last I tried it, and there're one or two native Linux programmes which can read & write its files. These days I just use an org-mode file encrypted with gpg: emacs automatically prompts me for my password and decrypts it when I open it up. > So I'm about to take KeePass, gut the crypto, replace it with simple scrypt and AES-OCB or chacha20-poly1305 and hope I can wind up with something I'm comfortable using - anyone have a better suggestion? Replace the crypto and data model with a PasswordSafe 'v4' format: scrypt plus AES-GCM plus chacha20-poly1305.
- ploxiln 11y ago
  I've used my passwordsafe v3 db with * password gorilla https://github.com/zdia/gorilla * pasaffe https://launchpad.net/pasaffe * passwdsafe (android) https://play.google.com/store/apps/details?id=com.jefftharris.passwdsafe I like a password db format which is portable to different manager implementations on different platforms, and think that passwordsafe v3 is probably a bit better than the keepass format. (EDIT: and I don't care for integrations with browsers or anything else, they're a bad idea...)
ww520 11y ago
I'm curious. What are the sketchy parts about KeePass's cryptography?
- ultramancool 11y ago
  Main thing I don't like is their custom AES-based key derivation function. I'm also not sure if it does authenticated encryption but if I recall correctly it does not. I'll have to have a look at it again soon.
  - briHass 11y ago
    I agree about the key-derivation (just use the PBKDF built into .NET dammit), but I've checked out the code, and it looks sound. It uses standard Windows crypto libs when running on >=Vista. As to the auth'd encryption: they do that above version 2.2 http://keepass.info/help/kb/sec_issues.html http://keepass.info/help/kb/sec_issues.html
    - ultramancool 11y ago
      Thanks, I'll definitely be keeping an eye on keepass, there's a post around indicating that they're going to add Argon2 (the winner of PHC) when it's finalized. I might just do the switch now...
  - ww520 11y ago
    Thanks for pointing out these issues. Authenticated encryption seems to get popular just these last couple years. Besides injecting unwanted data into the encrypted data, what other attacks can be done with it? For encrypted code, injecting unwanted code in the middle of it would be a big problem when decrypted and run. For pure data file like the the password database, would it be just adding extra garbage?
schizoidboy 11y ago
Self-serving, but I'm working on an open source project which handles password storage using AES using symmetric key with the website password (many other features): https://github.com/myplaceonline/myplaceonline https://github.com/myplaceonline/myplaceonline - you can run this locally or test out the beta version online (email me) Specifically: https://github.com/myplaceonline/myplaceonline_rails/blob/af76acd8c3b0d012ff042b12bdac0e61c968d3bc/lib/myp.rb#L331 https://github.com/myplaceonline/myplaceonline_rails/blob/af...
boundlessdreamz 11y ago
Why not 1Password?
- ultramancool 11y ago
  Similar things have shown that 1Password has even worse problems than LastPass.
  - wmil 11y ago
    Could you be more specific? The only issue I've heard about was that in an old format you could see which sites had saved passwords. That's more of a privacy issue than a security leak.
    - ultramancool 11y ago
      On second glance it looks like you're right, I mis-recalled, they had a problem with the old DB format that's about as bad as LastPass has now. KDF they're using isn't the best, on par with LastPass and it looks like they're using authenticated encryption and everything... so overall, not so bad. It's another magical proprietary solution though so I can't help but feel like switching from LastPass to 1Password wouldn't be worth the hassle. I'm looking for something more in the open source and dead simple direction.
      - mahyarm 11y ago
        What I like about 1password is they are proactive and explain their crypto process extensively. They're also small, in Canada and 1password is their only product, so the conflict of interest risk is lower. There are scripts out there that will take your lastpass dump and convert it into a 1password import file. The process to convert over takes about 30m-1hr.
tyho 11y ago
Dropbox seems less than ideal, how about intergrating these three tools? http://www.passwordstore.org http://www.passwordstore.org https://ipfs.io https://ipfs.io https://github.com/larsks/git-remote-ipfs https://github.com/larsks/git-remote-ipfs
- Vendan 11y ago
  as an easier to use alternative to ipfs, look into syncthing
  - tyho 11y ago
    Wow, that looks amazing.
ultramancool 11y ago
Replying to my own comment because I can no longer edit: Looks like KeePass guys are going to add Argon2 and have already added authenticated encryption. Keep an eye on it. Might be worth moving to. http://ehc.ac/p/keepass/discussion/329220/thread/a48066c0/?limit=250 http://ehc.ac/p/keepass/discussion/329220/thread/a48066c0/?l...

caskance 11y ago

KeePass is open source. If you feel like you can do a better job in certain aspects, please consider sharing those changes so that others can benefit.

ultramancool 11y ago
Of course, any eyes I can get on that sort of cryptographic code are invaluable. Applied cryptography is easy to fuck up, as we see time and time again. I'm seriously hoping someone gives me a better solution though, it'd be very nice if somebody had just done this right from the ground up.

bargl 11y ago

I felt the same way until I read the conclusion, "we want to point out that the security team at LastPass responded very quickly to all our reports and lot of the issues were fixed in just a couple days. It was very easy to communicate and work with them." That is why I use LastPass. Because they aren't perfect, but they realize that their reputation for taking any vulnerability very seriously is the most important asset they have. I have heard great things about KeePass so if you make that switch good on you. Edit: Added "very seriously" above.

bad_user 11y ago
Does it matter if the support is OK if the app doesn't fulfill its primary purpose which is to keep your data safe?
- brianbarker 11y ago
  Yes, because every system has flaws in it. Nothing is perfect and given enough time and resources an exploit will be found. Knowing that, if the team listens and fixes the issue, the product goes forward being more secure and trustworthy.
- vinceguidry 11y ago
  Safe is a relative term and not at all binary. LastPass does exactly the thing I use it for, does it well, and does it mostly transparently. Allow me to easily use different passwords per site. While my LastPass might be hacked one day, if I reuse passwords, then my accounts will be hacked eventually. Not a question of if, but when. Whenever news comes around that a particular site got hacked, I don't even pay attention. Who cares if one of my hundreds of passwords gets hacked? LastPass is somewhat vulnerable, but the architecture of LastPass plus the professionalism of the team means that any threat will be seen coming by anyone paying attention, as reports of an exploit out in the wild. A few people will be caught flat-footed but not everyone. When that happens, we can take steps to mitigate. If worse comes to worst, I can download a copy of the database, change the most important passwords so they're not in the online database, Gmail, banking and such, manage those manually, and hope my database doesn't get hacked. If it looks like it's just getting worse and worse, I can spend an evening changing passwords and migrating to a self-hosted solution. My data is safe in that an adversary would have to break through my personal defenses to get at it. They're not sitting in plaintext on some corporate server somewhere waiting to get hacked.

BostonEnginerd 11y ago

I use Password Store -- uses git + gpg to store all of the passwords. It makes it really easy to maintain a synchronized password store across multiple devices including Android http://www.passwordstore.org/ http://www.passwordstore.org/

ultramancool 11y ago
The cryptography in gpg is less than optimal for this purpose and I have to admit I just don't like gpg because it's so big and supports different ciphers, big codebase means more exploitability. But it could work for this purpose, it just seems really inefficient to me. Is there browser integration or a better UI for it?
- striking 11y ago
  Using GPG means that Password Store is less than 600 lines of bash at its core (minus emacs, completions, so on). http://git.zx2c4.com/password-store/tree/src/password-store.sh http://git.zx2c4.com/password-store/tree/src/password-store.... GPG is maintained, and well. Even as it supports different ciphers, that attack doesn't apply here. And very little functionality is accessed through this script. If that's not a tiny attack surface, I don't know what is.
  - ultramancool 11y ago
    Password Store might be tiny but GPG itself is a huge attack surface - that's the problem. Maintained, yes, well... I'd question that. I don't think it's very heavily reviewed or anything, and vulnerabilities pop up in it quite frequently, enough that I'm uncomfortable using it for serious purposes. https://www.cvedetails.com/vulnerability-list/vendor_id-4711/Gnupg.html https://www.cvedetails.com/vulnerability-list/vendor_id-4711... Many of these vulnerabilities have to do with very important cryptographic code... If you're comfortable with it, that's fine, it's not a bad solution. But personally I'd honestly be more comfortable with plain text files and TrueCrypt, which has no real cryptographic problems even after quite heavy review, the best we've found is a privesc bug in the Windows driver.

emodendroket 11y ago

Take Schneier's advice and write down your passwords: https://www.schneier.com/blog/archives/2005/06/write_down_your.html https://www.schneier.com/blog/archives/2005/06/write_down_yo... I suppose this is a problem if someone breaks into your home and gets into wherever you keep your notebook and steals it but frankly that's hardly the only problem you have in that scenario.

bargl 11y ago
I think this paired with LastPass would be great. Email and Banking all on paper with a backup at home. Everything that only has my credit card info and my address can be done through a password manager. Because in my mind those can all be recovered through email, and easily opened through LastPass. Also that advice is from 2005, I wonder if he'd agree with what I said above or disagree.
- emodendroket 11y ago
  Frankly I don't think anything has changed since then that would change his advice. If anything it seems more sensible than ever.
m0nty 11y ago
> We're all good at securing small pieces of paper. Not true, as it turns out. I created passwords for my users and put them on a laminated card as a courtesy, with instructions to keep it in their wallet, purse, etc. They were turning up stuck to keyboards, shelves next to desks, etc. Some people are really crap at securing small pieces of paper.
- emodendroket 11y ago
  I'll bet you if it were the details to their own bank account they wouldn't do that! It's a problem of how much people care, really (or how much they think the organization cares).
  - m0nty 11y ago

adventured 11y ago

I currently use LastPass, and I previously used KeePass. Now I'm looking to move away from LastPass, post acquisition. I've considered storing text files containing passwords inside of a VeraCrypt or TrueCrypt volume. Or storing the KeePass database file similarly. Any feedback on if this is a bad approach and why?

ultramancool 11y ago
It's not a bad approach - it lacks integration, it's easier for malware to grab, but that's about it. Malware can already dump the memory or log the keyboard and mouse to grab what'd be needed to decrypt your LastPass or KeePass, so in the end those solutions are no better than plain text files inside an encrypted container. The lack of integration, generation and other UI niceties is really the biggest loss I think.
- Solarsail 11y ago
  Well, WRT to malware, KeePass can somewhat mitigate generalized threats. Say, in-memory encryption to protect against memory dumps, using a secure desktop [1] for the master password, and typing obfuscation during auto-type to protect against keyloggers. Well, keyloggers that aren't written with KeePass in mind, at least. Both of those would give it a modest edge over plain text in an encrypted container. [1] http://keepass.info/help/base/security.html#secdesktop http://keepass.info/help/base/security.html#secdesktop This said, both secure desktops and auto-type obfuscation are turned off by default...
  - ultramancool 11y ago
    The whole "secure desktops" thing is a bit of an oxymoron too. If you can gain admin privileges you can steal any desktop and session token you want and keylog it. I've used that trick before to keylog winlogon's "secure" desktop, so surely KeePass would be similarly vulnerable? Additionally a quick patch or in memory modification of KeePass.exe would easily bypass any protection like this, lookup the KeeFarce tool to see an example. I'd hardly call this an "edge" over plain text files in an encrypted container, considering it does nothing to actually prevent exploitation but simply provides a form of security through obscurity. Ultimately once a system is infected, all you can do are half-measures and will wind up worthless against even a mildly sophisticated attacker. Unless you run the software in a separate machine, you're dead in the water and it's pointless to discuss what happens post-infection when anything is really possible.

zeveb 11y ago

> PasswordSafe has better looking cryptography, though still not up to where I'd like it to be as well as a worse UI, worse browser support, etc. And last I checked I think Linux support was sketchy. PasswordSafe is, I think, the current best-of-breed with respect to its crypto. Like you, I have some concerns with it (notably the use of Twofish rather than AES, and a too-low PBKDF2 default), but it's the best you can get without writing your own. It seemed to run ok in WINE last I tried it, and there're one or two native Linux programmes which can read & write its files. These days I just use an org-mode file encrypted with gpg: emacs automatically prompts me for my password and decrypts it when I open it up. > So I'm about to take KeePass, gut the crypto, replace it with simple scrypt and AES-OCB or chacha20-poly1305 and hope I can wind up with something I'm comfortable using - anyone have a better suggestion? Replace the crypto and data model with a PasswordSafe 'v4' format: scrypt plus AES-GCM plus chacha20-poly1305.

ploxiln 11y ago
I've used my passwordsafe v3 db with * password gorilla https://github.com/zdia/gorilla * pasaffe https://launchpad.net/pasaffe * passwdsafe (android) https://play.google.com/store/apps/details?id=com.jefftharris.passwdsafe I like a password db format which is portable to different manager implementations on different platforms, and think that passwordsafe v3 is probably a bit better than the keepass format. (EDIT: and I don't care for integrations with browsers or anything else, they're a bad idea...)

ww520 11y ago

I'm curious. What are the sketchy parts about KeePass's cryptography?

ultramancool 11y ago
Main thing I don't like is their custom AES-based key derivation function. I'm also not sure if it does authenticated encryption but if I recall correctly it does not. I'll have to have a look at it again soon.
- briHass 11y ago
  I agree about the key-derivation (just use the PBKDF built into .NET dammit), but I've checked out the code, and it looks sound. It uses standard Windows crypto libs when running on >=Vista. As to the auth'd encryption: they do that above version 2.2 http://keepass.info/help/kb/sec_issues.html http://keepass.info/help/kb/sec_issues.html
  - ultramancool 11y ago
    Thanks, I'll definitely be keeping an eye on keepass, there's a post around indicating that they're going to add Argon2 (the winner of PHC) when it's finalized. I might just do the switch now...
- ww520 11y ago
  Thanks for pointing out these issues. Authenticated encryption seems to get popular just these last couple years. Besides injecting unwanted data into the encrypted data, what other attacks can be done with it? For encrypted code, injecting unwanted code in the middle of it would be a big problem when decrypted and run. For pure data file like the the password database, would it be just adding extra garbage?

schizoidboy 11y ago

Self-serving, but I'm working on an open source project which handles password storage using AES using symmetric key with the website password (many other features): https://github.com/myplaceonline/myplaceonline https://github.com/myplaceonline/myplaceonline - you can run this locally or test out the beta version online (email me) Specifically: https://github.com/myplaceonline/myplaceonline_rails/blob/af76acd8c3b0d012ff042b12bdac0e61c968d3bc/lib/myp.rb#L331 https://github.com/myplaceonline/myplaceonline_rails/blob/af...

boundlessdreamz 11y ago

Why not 1Password?

ultramancool 11y ago
Similar things have shown that 1Password has even worse problems than LastPass.
- wmil 11y ago
  Could you be more specific? The only issue I've heard about was that in an old format you could see which sites had saved passwords. That's more of a privacy issue than a security leak.
  - ultramancool 11y ago
    On second glance it looks like you're right, I mis-recalled, they had a problem with the old DB format that's about as bad as LastPass has now. KDF they're using isn't the best, on par with LastPass and it looks like they're using authenticated encryption and everything... so overall, not so bad. It's another magical proprietary solution though so I can't help but feel like switching from LastPass to 1Password wouldn't be worth the hassle. I'm looking for something more in the open source and dead simple direction.
    - mahyarm 11y ago
      What I like about 1password is they are proactive and explain their crypto process extensively. They're also small, in Canada and 1password is their only product, so the conflict of interest risk is lower. There are scripts out there that will take your lastpass dump and convert it into a 1password import file. The process to convert over takes about 30m-1hr.

tyho 11y ago

Dropbox seems less than ideal, how about intergrating these three tools? http://www.passwordstore.org http://www.passwordstore.org https://ipfs.io https://ipfs.io https://github.com/larsks/git-remote-ipfs https://github.com/larsks/git-remote-ipfs

Vendan 11y ago
as an easier to use alternative to ipfs, look into syncthing
- tyho 11y ago
  Wow, that looks amazing.

ultramancool 11y ago

Replying to my own comment because I can no longer edit: Looks like KeePass guys are going to add Argon2 and have already added authenticated encryption. Keep an eye on it. Might be worth moving to. http://ehc.ac/p/keepass/discussion/329220/thread/a48066c0/?limit=250 http://ehc.ac/p/keepass/discussion/329220/thread/a48066c0/?l...