4 ms·

Back in my younger, move naive days when I first started using a password manager and such a practice was not as widespread, I had the same question I think mos

Back in my younger, move naive days when I first started using a password manager and such a practice was not as widespread, I had the same question I think most other people have: "If my computer gets hacked or infected, won't the attacker instantly grab all the passwords from the manager?" I chose to use a manager anyway, with the logic that if my system was compromised I was owned either way; memorizing passwords provided very little, if any, "softening" of the damage. It's funny looking back on that fear now. Password managers have become more mainstream, and we, collectively as users, have learned something interesting. One of the assumptions of that hacking fear was that it was more likely for a user's machine to become compromised than it was for the service's the user uses to be compromised. Well, as it turns out, the opposite was true and the fear was unfounded. The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. Perhaps that makes sense in retrospect. But it wasn't obvious a decade ago. Back then viruses and malware were rampant on the internet. In many ways they still are, but not like it was back then. Those were the days of pandemics like the Blaster worm. So it made sense to be more afraid of your own machine being compromised. But the tides have turned. The landscape of OS security has improved dramatically. The single points of failure offered by servers are far more valuable now than the unwashed masses of networked user computers. Just a funny retrospective that I thought I'd share.

hyder_m29 8y ago
> The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. Something to consider is that malware-based compromises of personal systems don't raise as much brouhaha as corporate-level compromises.
- fpgaminer 8y ago
  My statement is based not on frequency of news, but rather on my understanding of the provenance of passwords in password lists. The vast majority of passwords in password lists are sourced from service hacks; not from user malware. And that makes sense. Malware events net maybe thousands of user passwords? On a good day maybe 100k. But hacks of major services like LinkedIn ... those yielded hundreds of millions of passwords. The two just don't compare in magnitude. Remember that HIBP's list is sitting at something like half a billion password combos right now.
  - geofft 8y ago
    One thing to note is that a remotely-compromised computer gets you access to the actual browser session and not solely to the password. In fact, most of the time the user has already logged in, and so the session is accessible but the password isn't (users without password managers have no persistent store, and password managers try to keep the secrets encrypted except when the master password has been recently typed). So it's not often useful to take a password from an individual user and put it in a password list, but it is often useful to maintain persistence on their machine. Tools for doing that (RATs) are definitely common, both from random internet attackers and from e.g. angry exes with physical access to your device. But those aren't the attacks that e.g. HIBP is interested in, so if you're looking at data from people interested in password compromises, the effect is that you'll undercount client-side compromises.
  - Cyph0n 8y ago
    > Malware events net maybe thousands of user passwords? On a good day maybe 100k. You are underestimating how much malware there is out there, both on desktop and mobile. There are probably botnets that consist of >100k compromised machines.
  - Retric 8y ago
    At the height of gold farming when hacking WoW accounts was very profitable 1/2 our guild was individually hacked over a six month period. Normally it's much harder to detect password being leaked but it was really noticeable and hardware/cellphone tokens made a huge difference. So, I suspect the reverse is true with standalone PC's being more likely to be compromised, what makes this less noticeable is it's harder to automated extracting value from those hacked accounts beyond sending gmail spam etc. PS: This is also why cryptocoin software on users machines is basically a non starter.
taurath 8y ago
It amuses me to compare what a virus laden desktop pc looked like 10 years ago, vs what almost every major commercial/media website looks like now. They’re practically the same with all the ads and popups.
PhasmaFelis 8y ago
I wonder if it has to do with the changing motivations of malware authors. In the pre-internet and early internet days, it was mostly young folks doing it for shits and giggles, as a power trip. It wasn't targeted; they just wanted it widely distributed to make a big splash, and it often didn't communicate with the creator in any way. Now, malware is a criminal industry. People are making big money off of it. It doesn't make a lot of sense to target individuals when you could go after big, wealthy institutions. Same goes for government malware--they're looking to infiltrate and disrupt rival institutions and industries, not inconvenience private citizens.
lifeisstillgood 8y ago
> The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. Why do you rob banks? Because that's where the money is.
dwild 8y ago
> Well, as it turns out, the opposite was true and the fear was unfounded. The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. That's absurd. I can count on one hand how many account I need to be extremely secured. Accounts that will actually affect me if they were hacked. - Works - Bank - Paypal - Google - AWS All have a different and secure passwords. The remaining accounts that I care about but won't affect me much if they were hacked use variation of a single password. The accounts where I don't care use a simple password. If any one of the first one are hacked or leaked, well I was already screwed I guess, the service was hacked... just hope that they take care of it. If I get hacked, I just hope that I catch it before I log into one of theses accounts, which funnily enough, doesn't happen that much (except for work, but that's mostly at works so not my responsibility). If any other password get leaked? Well not too bad, I request a new password and that's it. > The single points of failure offered by servers are far more valuable now than the unwashed masses of networked user computers. It's true up until it's no longer the case. So many people use cloud backed password manager too... your point currently apply to them too. You see the big leaks but you don't see the peoples that get their passwords stolen from their computers, it's not new worthy. It's also the classical: it won't happen to me.

hyder_m29 8y ago

> The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. Something to consider is that malware-based compromises of personal systems don't raise as much brouhaha as corporate-level compromises.

fpgaminer 8y ago
My statement is based not on frequency of news, but rather on my understanding of the provenance of passwords in password lists. The vast majority of passwords in password lists are sourced from service hacks; not from user malware. And that makes sense. Malware events net maybe thousands of user passwords? On a good day maybe 100k. But hacks of major services like LinkedIn ... those yielded hundreds of millions of passwords. The two just don't compare in magnitude. Remember that HIBP's list is sitting at something like half a billion password combos right now.
- geofft 8y ago
  One thing to note is that a remotely-compromised computer gets you access to the actual browser session and not solely to the password. In fact, most of the time the user has already logged in, and so the session is accessible but the password isn't (users without password managers have no persistent store, and password managers try to keep the secrets encrypted except when the master password has been recently typed). So it's not often useful to take a password from an individual user and put it in a password list, but it is often useful to maintain persistence on their machine. Tools for doing that (RATs) are definitely common, both from random internet attackers and from e.g. angry exes with physical access to your device. But those aren't the attacks that e.g. HIBP is interested in, so if you're looking at data from people interested in password compromises, the effect is that you'll undercount client-side compromises.
- Cyph0n 8y ago
  > Malware events net maybe thousands of user passwords? On a good day maybe 100k. You are underestimating how much malware there is out there, both on desktop and mobile. There are probably botnets that consist of >100k compromised machines.
- Retric 8y ago
  At the height of gold farming when hacking WoW accounts was very profitable 1/2 our guild was individually hacked over a six month period. Normally it's much harder to detect password being leaked but it was really noticeable and hardware/cellphone tokens made a huge difference. So, I suspect the reverse is true with standalone PC's being more likely to be compromised, what makes this less noticeable is it's harder to automated extracting value from those hacked accounts beyond sending gmail spam etc. PS: This is also why cryptocoin software on users machines is basically a non starter.

taurath 8y ago

It amuses me to compare what a virus laden desktop pc looked like 10 years ago, vs what almost every major commercial/media website looks like now. They’re practically the same with all the ads and popups.

PhasmaFelis 8y ago

I wonder if it has to do with the changing motivations of malware authors. In the pre-internet and early internet days, it was mostly young folks doing it for shits and giggles, as a power trip. It wasn't targeted; they just wanted it widely distributed to make a big splash, and it often didn't communicate with the creator in any way. Now, malware is a criminal industry. People are making big money off of it. It doesn't make a lot of sense to target individuals when you could go after big, wealthy institutions. Same goes for government malware--they're looking to infiltrate and disrupt rival institutions and industries, not inconvenience private citizens.

lifeisstillgood 8y ago

> The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. Why do you rob banks? Because that's where the money is.

dwild 8y ago

> Well, as it turns out, the opposite was true and the fear was unfounded. The vast majority of password leaks we've seen over the past decade have been due not to malware but rather server compromises. That's absurd. I can count on one hand how many account I need to be extremely secured. Accounts that will actually affect me if they were hacked. - Works - Bank - Paypal - Google - AWS All have a different and secure passwords. The remaining accounts that I care about but won't affect me much if they were hacked use variation of a single password. The accounts where I don't care use a simple password. If any one of the first one are hacked or leaked, well I was already screwed I guess, the service was hacked... just hope that they take care of it. If I get hacked, I just hope that I catch it before I log into one of theses accounts, which funnily enough, doesn't happen that much (except for work, but that's mostly at works so not my responsibility). If any other password get leaked? Well not too bad, I request a new password and that's it. > The single points of failure offered by servers are far more valuable now than the unwashed masses of networked user computers. It's true up until it's no longer the case. So many people use cloud backed password manager too... your point currently apply to them too. You see the big leaks but you don't see the peoples that get their passwords stolen from their computers, it's not new worthy. It's also the classical: it won't happen to me.