6 ms·

Aren't all password managers keyloggers too?

the8472 9y ago
There are password managers that don't involve any cloud services.
ransom1538 9y ago
I am too paranoid to use them, but, from what I read (regarding the biggest one): "LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data" If there is an attack still possible (even using LastPass employees) can you post it here?
- rileyteige 9y ago
  Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass) The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form. Aside from that, I am not aware of other "hot" attack vectors.
  - LocalPCGuy 9y ago
    LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are. Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it comes to being as secure as possible.
    - paulryanrogers 9y ago
      I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users
- skymt 9y ago
  Project Zero has found a number of major flaws in the LastPass extension. https://bugs.chromium.org/p/project-zero/issues/detail?id=884&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=88... https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=11... https://bugs.chromium.org/p/project-zero/issues/detail?id=1209&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1217&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... At a glance what they have in common is flaws in the scripts that the LastPass extension injects into pages. The injected scripts can communicate with the extension core with a set of RPCs. Each of these issues is a way of tricking the extension into running RPCs from untrusted JavaScript on any web page. The RPCs available allow an attacker to fetch the credentials for any site in the database or even execute arbitrary code on the host.
- rajasinghe 9y ago
  I used LastPass for a while. Then it filled in my username and password (correctly) on a website without my having authenticated... It looks like there's an unencrypted local cache which is not flushed when your authentication expires or you log out. I wasn't able to reproduce it but I was sufficiently spooked to stop using it after that.
  - stolsvik 9y ago
    Sure it wasn't the browser that filled it in?
nebulous1 9y ago
No?
ocdtrekkie 9y ago
I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "Honey", and they say they like it because it saves them money. And then I point out it can access everything they do online, and ask them if that's a concern or not.
- paulgb 9y ago
  As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.
  - ocdtrekkie 9y ago
    Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published. Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data. People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.
    - paulryanrogers 9y ago
      I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.
- dokument 9y ago
  > I personally stay far away from password managers I am curious how you manage your passwords.
dkonofalski 9y ago
No. 1Password, as far as I know, doesn't trigger anything until after I've given it the OK to do its thing. It can input passwords when I allow it to and it saves the password only after I've confirmed that it's ok to. It's possible that they're secretly logging everything in the background but that seems to be completely antithetical for a company that requires the trust of its users for its product to sell.
bhhaskin 9y ago
Not even close. For instance check out password-store. It's a cli that uses gpg to store passwords. You can install an open source browser extension, but it only allows you to login easily and is manually triggered. It only connects to your local password-store.

There are password managers that don't involve any cloud services.

I am too paranoid to use them, but, from what I read (regarding the biggest one): "LastPass encrypts your Vault before it goes to the server using 256-bit AES encryption. Since the Vault is already encrypted before it leaves your computer and reaches the LastPass server, not even LastPass employees can see your sensitive data" If there is an attack still possible (even using LastPass employees) can you post it here?

rileyteige 9y ago
Not sure if you're using the credential "autofill" feature, but somewhat recently there was an attack in which their autofill extension could be tricked into "autofilling" specific sites' credentials on a malicious webpage. (Not sure if this has been fixed by LastPass) The fix for that was to not use autofill and revert to manually grabbing your username/password when filling out a login form. Aside from that, I am not aware of other "hot" attack vectors.
- LocalPCGuy 9y ago
  LastPass has been very diligent in fixing issues like the one you list. Usually very quickly (sometimes in hours, not even days.) And most of the issues you've read about with LastPass have been fixed before being disclosed because of how responsive they are. Users still need to practice skepticism and ultimately it is their responsibility to protect their passwords. But LastPass has been a very good citizen when it comes to being as secure as possible.
  - paulryanrogers 9y ago
    I would not say "as secure as possible" since the risks introduced by a browser extension are very real. Though the alternatives lately are impractical for non-technical users
skymt 9y ago
Project Zero has found a number of major flaws in the LastPass extension. https://bugs.chromium.org/p/project-zero/issues/detail?id=884&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=88... https://bugs.chromium.org/p/project-zero/issues/detail?id=1188&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=11... https://bugs.chromium.org/p/project-zero/issues/detail?id=1209&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1217&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... https://bugs.chromium.org/p/project-zero/issues/detail?id=1225&can=1&q=lastpass https://bugs.chromium.org/p/project-zero/issues/detail?id=12... At a glance what they have in common is flaws in the scripts that the LastPass extension injects into pages. The injected scripts can communicate with the extension core with a set of RPCs. Each of these issues is a way of tricking the extension into running RPCs from untrusted JavaScript on any web page. The RPCs available allow an attacker to fetch the credentials for any site in the database or even execute arbitrary code on the host.
rajasinghe 9y ago
I used LastPass for a while. Then it filled in my username and password (correctly) on a website without my having authenticated... It looks like there's an unencrypted local cache which is not flushed when your authentication expires or you log out. I wasn't able to reproduce it but I was sufficiently spooked to stop using it after that.
- stolsvik 9y ago
  Sure it wasn't the browser that filled it in?

nebulous1 9y ago

No?

ocdtrekkie 9y ago

I personally stay far away from password managers, especially as browser extensions. I'd really recommend everyone look at how many of their Chrome extensions have the permission to "access your data on all websites", and consider whether or not they really trust the companies or individuals who made those extensions with that permission. It's eye-opening to people when I ask them about an extension they have, say "Honey", and they say they like it because it saves them money. And then I point out it can access everything they do online, and ask them if that's a concern or not.

paulgb 9y ago
As an open-source extension developer, I wish there was a way to prove that the extension uploaded is generated from a specific git commit. It wouldn't solve everything, but it would make it easier for anyone to audit the code and know that it actually matches the code I've uploaded.
- ocdtrekkie 9y ago
  Indeed. I was thinking about this, and would argue this should really not only exist... but be the only way extensions with this level of wide-sweeping access should be permitted to be published. Chrome team, if they were security-focused, would not permit any closed source extensions which have access to all website data. People don't seem to understand sometimes that if an extension has this sort of access, you need to be able to trust your browser extensions as much as you trust your browser itself.
  - paulryanrogers 9y ago
    I'd add to that "not obfuscated" too since JS minimization and WASM can be as obscure as binary.
dokument 9y ago
> I personally stay far away from password managers I am curious how you manage your passwords.

dkonofalski 9y ago

No. 1Password, as far as I know, doesn't trigger anything until after I've given it the OK to do its thing. It can input passwords when I allow it to and it saves the password only after I've confirmed that it's ok to. It's possible that they're secretly logging everything in the background but that seems to be completely antithetical for a company that requires the trust of its users for its product to sell.

bhhaskin 9y ago

Not even close. For instance check out password-store. It's a cli that uses gpg to store passwords. You can install an open source browser extension, but it only allows you to login easily and is manually triggered. It only connects to your local password-store.