5 ms·

Well this is scary. How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user?

by antrion 11y ago

digdigdag 11y ago
>How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user? You don't. Assume every online service you use subject to security holes. What defines a secure app from an unsecure one is revealed after a security incident. That's why I continue to use LastPass simply because they exemplified their security practices during their recent scare.
Someone1234 11y ago
Most password managers are heavily audited. Likely why the Trent Macro one wasn't is because nobody with any technical sense is installing their nonsense to begin with. But LastPass, Keypass, Chrome's password manager, Firefox's manager, and IE are audited all the time, with tons of exposé articles supposedly trying to inform us about how weak they are (but all these articles do is further clarity how strong they are, since they only find trivial issues, or they misunderstand a feature as a bug). I cannot recall the last time any of these had what I would consider a REAL security bug.
- thelucky41 11y ago
  Chrome and firefox both store saved passwords in plain-text in easily accessible local databases. Don't rely on them to keep passwords safe. I have no experience with IE's password locker.
  - mhandley 11y ago
    Firefox will encrypt your saved passwords if you set a master password on the Security Preferences panel. Really should do so by default, but at least it's available as an option.
  - Someone1234 11y ago
    > Chrome and firefox both store saved passwords in plain-text in easily accessible local databases. All password managers store plain text passwords. That's literally a requirement for them to work at all. Chrome encrypts the password in the SQLite database[0] using Windows' CryptProtectData() API, and Firefox encrypts the passwords either using your master password, or if none is set then it encrypts but stores the encryption key in the key3.db. > Don't rely on them to keep passwords safe. You've presented no justification for that. If you're using a root compromised machine then no password manager is safe. If your machine is secure then your passwords are secure in both Chrome and Firefox, but more secure in Chrome. [0] http://www.howtogeek.com/70146/how-secure-are-your-saved-chrome-browser-passwords/ http://www.howtogeek.com/70146/how-secure-are-your-saved-chr...
    - tptacek 11y ago
      All password managers store plain text passwords. That's literally a requirement for them to work at all. I'm not sure this is what you mean to say, because, obviously, good password managers don't store passwords in cleartext.
      - Someone1234 11y ago
        You cannot hash passwords in a password manager. It has to be reversibly encrypted and turned back into plain text before utilisation. So when people complain about password managers storing plain text (as opposed to hashing) they're barking up the wrong tree, it is a necessary evil. You just want to see them encrypt those plain text passwords so that offline recovery is harder. That's what both Firefox's master password, CryptProtectData() for Chrome/IE, and the key-chain in OS X provide.
        tptacek 11y ago
        I think you're trying to say something akin to but not quite "plaintext equivalent", and your terminology is mangling your argument.
      - Johnny_Brahms 11y ago
  - smileysteve 11y ago
    ON WINDOWS. A couple of years ago, chrome joined safari in using the OSX KeyChain. (On Ubuntu, Chrome can also use the gnome-keyring)
  - kevincox 11y ago
    This is simply untrue.
- tptacek 11y ago
  Most password managers are not heavily audited. Random third parties look at them and occasionally find things, but that's not the same thing as the development team bringing an auditing team in and giving them access to all the source repositories and documentation.
noondip 11y ago
Have a look at this solution, a shell wrapper around GPG for managing passwords - https://github.com/drduh/pwd.sh https://github.com/drduh/pwd.sh

Well this is scary. How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user?

by antrion 11y ago

Well this is scary. How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user?

digdigdag 11y ago

>How am I to trust a password manager if something as obvious as this is allowed to be shipped to the end user? You don't. Assume every online service you use subject to security holes. What defines a secure app from an unsecure one is revealed after a security incident. That's why I continue to use LastPass simply because they exemplified their security practices during their recent scare.

Someone1234 11y ago

Most password managers are heavily audited. Likely why the Trent Macro one wasn't is because nobody with any technical sense is installing their nonsense to begin with. But LastPass, Keypass, Chrome's password manager, Firefox's manager, and IE are audited all the time, with tons of exposé articles supposedly trying to inform us about how weak they are (but all these articles do is further clarity how strong they are, since they only find trivial issues, or they misunderstand a feature as a bug). I cannot recall the last time any of these had what I would consider a REAL security bug.

thelucky41 11y ago
Chrome and firefox both store saved passwords in plain-text in easily accessible local databases. Don't rely on them to keep passwords safe. I have no experience with IE's password locker.
- mhandley 11y ago
  Firefox will encrypt your saved passwords if you set a master password on the Security Preferences panel. Really should do so by default, but at least it's available as an option.
- Someone1234 11y ago
  > Chrome and firefox both store saved passwords in plain-text in easily accessible local databases. All password managers store plain text passwords. That's literally a requirement for them to work at all. Chrome encrypts the password in the SQLite database[0] using Windows' CryptProtectData() API, and Firefox encrypts the passwords either using your master password, or if none is set then it encrypts but stores the encryption key in the key3.db. > Don't rely on them to keep passwords safe. You've presented no justification for that. If you're using a root compromised machine then no password manager is safe. If your machine is secure then your passwords are secure in both Chrome and Firefox, but more secure in Chrome. [0] http://www.howtogeek.com/70146/how-secure-are-your-saved-chrome-browser-passwords/ http://www.howtogeek.com/70146/how-secure-are-your-saved-chr...
  - tptacek 11y ago
    All password managers store plain text passwords. That's literally a requirement for them to work at all. I'm not sure this is what you mean to say, because, obviously, good password managers don't store passwords in cleartext.
    - Someone1234 11y ago
      You cannot hash passwords in a password manager. It has to be reversibly encrypted and turned back into plain text before utilisation. So when people complain about password managers storing plain text (as opposed to hashing) they're barking up the wrong tree, it is a necessary evil. You just want to see them encrypt those plain text passwords so that offline recovery is harder. That's what both Firefox's master password, CryptProtectData() for Chrome/IE, and the key-chain in OS X provide.
      - tptacek 11y ago
        I think you're trying to say something akin to but not quite "plaintext equivalent", and your terminology is mangling your argument.
    - Johnny_Brahms 11y ago
- smileysteve 11y ago
  ON WINDOWS. A couple of years ago, chrome joined safari in using the OSX KeyChain. (On Ubuntu, Chrome can also use the gnome-keyring)
- kevincox 11y ago
  This is simply untrue.
tptacek 11y ago
Most password managers are not heavily audited. Random third parties look at them and occasionally find things, but that's not the same thing as the development team bringing an auditing team in and giving them access to all the source repositories and documentation.

noondip 11y ago

Have a look at this solution, a shell wrapper around GPG for managing passwords - https://github.com/drduh/pwd.sh https://github.com/drduh/pwd.sh