5 ms·

Password managers seem to have the essential flaw of using the clipboard. What prevents a random npm/rubygems/... dependency from running `pbcopy` every second

by vemv 8y ago

Password managers seem to have the essential flaw of using the clipboard. What prevents a random npm/rubygems/... dependency from running `pbcopy` every second, storing interesting-looking results and relaying them to some server once in a while?

Nadya 8y ago
This assumes the machine is already pwned - at which point why wouldn't they just use a keylogger? In that case, typing the password in without the use of a password manager instead of copy/pasting from a password manager wouldn't be any more secure.
- vemv 8y ago
  It's reasonably easy (or at least feasible) to sneak runnable code as an indirect dependency of a development project (node.js, rails, etc), or of a Homebrew formula. No pwning needed - at least as commonly conceived. Presumably, running `pbcopy` is easier and less detectable than writing a keylogger?
- bscphil 8y ago
  This suggests a related question. There's no inherent reason why programs other than your desktop shell and the current focused window (for window based DEs) need to have access to keyboard input. In practice, how good are existing DEs at controlling this access? I know, for example, that the slow move from X to Wayland has removed some of the methods a program might use to access inputs or the clipboard.
UncleMeat 8y ago
If your machine is compromised you already lost. They can just run a keylogger or read memory out of your browser process.
__sharp 8y ago
The passwd manager I'm using wipes your clipboard after a short period of time.
- vemv 8y ago
  You can read the clipboard continuously.
  - richev 8y ago
    Or, on Windows an app can watch for the WM_DRAWCLIPBOARD message[0], which gets sent every time the contents of the clipboard changes. [0] https://docs.microsoft.com/en-us/windows/desktop/dataxchg/using-the-clipboard#adding-a-window-to-the-clipboard-viewer-chain https://docs.microsoft.com/en-us/windows/desktop/dataxchg/us...
pvg 8y ago
the essential flaw of using the clipboard This isn't essential to the operation of a password manager and sensible password managers don't do this.
- vemv 8y ago
  What's a correct workflow then? (I genuinely don't know) Say a password manager wants to let me know that my password for Gmail is d78658b8f207c4256370d3e018e0f3d544607849aa5f6bd8, what should it do then? It seems to me, either the manager or me will copy that value to the clipboard somehow.
  - pvg 8y ago
    A decent password manager has browser integration through browser extensions and fills in passwords for you. Current versions of Safari and Chrome have built-in password managers.
    - vemv 8y ago
      Wasn't fully aware of this. I think most 'hacker-friendly' password managers (like password-store), that are unix-y, can be persisted to git, don't depend on megacorps, etc lack these capabilities? i.e. very few password managers might count as 'decent'. As a last note, a browser extension that doesn't come from Google or Apple shouldn't be trusted. I have zero extensions (other than uBlock), since they essentially have arbitary read/write capabilites into one's digital life. What's really missing is a OS-level widget that acts as a secure clipboard. Similar to how one inserts emojis in macOS.
      - pvg 8y ago
        i.e. very few password managers might count as 'decent'. I think this is true - this is really core browser functionality and all password managers are fundamentally hacks. A tiny number of these hacks are non-awful. 'hacker-friendly' password management is a bit like 'hacker-friendly' dentistry - useful to a tiny minority of exceptionally adventurous people. The safest, sanest thing you can do is use the browser-provided password manager and the browser- or OS- provided sync. Both Safari's and Chrome's use end-to-end encryption (you have to turn it on in Chrome but it's there). The benefits of this far outweigh the downsides, to the point where I actually think the typical recommendation for 1Password is a bit outdated and counter-productive. Browser and platform vendors should obviate the need for this entire class of software and they seem to be moving in that direction.

by vemv 8y ago

Nadya 8y ago

This assumes the machine is already pwned - at which point why wouldn't they just use a keylogger? In that case, typing the password in without the use of a password manager instead of copy/pasting from a password manager wouldn't be any more secure.

vemv 8y ago
It's reasonably easy (or at least feasible) to sneak runnable code as an indirect dependency of a development project (node.js, rails, etc), or of a Homebrew formula. No pwning needed - at least as commonly conceived. Presumably, running `pbcopy` is easier and less detectable than writing a keylogger?
bscphil 8y ago
This suggests a related question. There's no inherent reason why programs other than your desktop shell and the current focused window (for window based DEs) need to have access to keyboard input. In practice, how good are existing DEs at controlling this access? I know, for example, that the slow move from X to Wayland has removed some of the methods a program might use to access inputs or the clipboard.

UncleMeat 8y ago

If your machine is compromised you already lost. They can just run a keylogger or read memory out of your browser process.

__sharp 8y ago

The passwd manager I'm using wipes your clipboard after a short period of time.

vemv 8y ago
You can read the clipboard continuously.
- richev 8y ago
  Or, on Windows an app can watch for the WM_DRAWCLIPBOARD message[0], which gets sent every time the contents of the clipboard changes. [0] https://docs.microsoft.com/en-us/windows/desktop/dataxchg/using-the-clipboard#adding-a-window-to-the-clipboard-viewer-chain https://docs.microsoft.com/en-us/windows/desktop/dataxchg/us...

pvg 8y ago

the essential flaw of using the clipboard This isn't essential to the operation of a password manager and sensible password managers don't do this.

vemv 8y ago
What's a correct workflow then? (I genuinely don't know) Say a password manager wants to let me know that my password for Gmail is d78658b8f207c4256370d3e018e0f3d544607849aa5f6bd8, what should it do then? It seems to me, either the manager or me will copy that value to the clipboard somehow.
- pvg 8y ago
  A decent password manager has browser integration through browser extensions and fills in passwords for you. Current versions of Safari and Chrome have built-in password managers.
  - vemv 8y ago
    Wasn't fully aware of this. I think most 'hacker-friendly' password managers (like password-store), that are unix-y, can be persisted to git, don't depend on megacorps, etc lack these capabilities? i.e. very few password managers might count as 'decent'. As a last note, a browser extension that doesn't come from Google or Apple shouldn't be trusted. I have zero extensions (other than uBlock), since they essentially have arbitary read/write capabilites into one's digital life. What's really missing is a OS-level widget that acts as a secure clipboard. Similar to how one inserts emojis in macOS.
    - pvg 8y ago
      i.e. very few password managers might count as 'decent'. I think this is true - this is really core browser functionality and all password managers are fundamentally hacks. A tiny number of these hacks are non-awful. 'hacker-friendly' password management is a bit like 'hacker-friendly' dentistry - useful to a tiny minority of exceptionally adventurous people. The safest, sanest thing you can do is use the browser-provided password manager and the browser- or OS- provided sync. Both Safari's and Chrome's use end-to-end encryption (you have to turn it on in Chrome but it's there). The benefits of this far outweigh the downsides, to the point where I actually think the typical recommendation for 1Password is a bit outdated and counter-productive. Browser and platform vendors should obviate the need for this entire class of software and they seem to be moving in that direction.