3 ms·
Except 1Password is also pwnd if an attacker gets mallware on your system? They just snatch the database and record keystrokes when you unlock it.
by tokenizerrr 9y ago
Except 1Password is also pwnd if an attacker gets mallware on your system? They just snatch the database and record keystrokes when you unlock it.
- deleted 9y ago[deleted]
- Xylakant 9y agoAny algorithmic pw-manager can be attacked the same way: just record the keystrokes when the master pass phrase is entered. If the attacker has malware on your system, assume all is lost.
- acdha 9y agoThat was exactly my point – on something other than iOS/ChromeOS there might be a chance if the attacker manages only a partial compromise[1] but in general it's wise to assume that a compromise will get the master passphrase or could simply read the unencrypted data out of the process memory and take precautions based on that worst-case scenario (e.g. using U2F everywhere it's available). 1. e.g. if the compromised process is sandboxed enough that the secure keyboard input features work or something like the macOS securityd running as a separate user prevents unrestricted access.