5 ms·

Could password managers like 1Password (AgileBits Inc.) employ similar techniques? They seem to make very little effort in this regards. E.g. on 1Password, http

Could password managers like 1Password (AgileBits Inc.) employ similar techniques? They seem to make very little effort in this regards. E.g. on 1Password, https://discussions.agilebits.com/discussion/101551/article-just-published-in-washington-post-is-saying-1password-and-others-have-security-flaws https://discussions.agilebits.com/discussion/101551/article-....

eridius 7y ago
This kind of mitigation really only makes sense on shared machines (such as servers). On a desktop OS, if an attacker is in a position to read memory from other processes, it's pretty much game over already. Browsers implement Spectre/Meltdown mitigation on desktop OSes because without that, JS could read secrets from other JS contexts executing in the same process. One of the mitigations is in fact to just segregate JS contexts into different processes depending on the domain they belong to. But most apps don't execute untrusted code so most apps don't have this sort of in-process attacker to worry about.
- sedatk 7y ago
  > On a desktop OS, if an attacker is in a position to read memory from other processes, it's pretty much game over already. Not really. Password managers have access information to your other accounts in the cloud. Your desktop may not have your most valuable data.
  - deleted 7y ago
    [deleted]
doomjunky 7y ago
No. I just tested KeePass. 1. I created a new test-entry with a long and random password. 2. Opened the process's memory in the HxD hexeditor. 3. Ctrl+f 4. Found this password 4 times. Even after i locked KeePass i still found the password 2 times. This is bad!
Too 7y ago
Here is a study on how well various password managers try to scrub their memory to avoid RAM dumps: https://www.securityevaluators.com/casestudies/password-manager-hacking/ https://www.securityevaluators.com/casestudies/password-mana...

eridius 7y ago

This kind of mitigation really only makes sense on shared machines (such as servers). On a desktop OS, if an attacker is in a position to read memory from other processes, it's pretty much game over already. Browsers implement Spectre/Meltdown mitigation on desktop OSes because without that, JS could read secrets from other JS contexts executing in the same process. One of the mitigations is in fact to just segregate JS contexts into different processes depending on the domain they belong to. But most apps don't execute untrusted code so most apps don't have this sort of in-process attacker to worry about.

sedatk 7y ago
> On a desktop OS, if an attacker is in a position to read memory from other processes, it's pretty much game over already. Not really. Password managers have access information to your other accounts in the cloud. Your desktop may not have your most valuable data.
- deleted 7y ago
  [deleted]

doomjunky 7y ago

No. I just tested KeePass. 1. I created a new test-entry with a long and random password. 2. Opened the process's memory in the HxD hexeditor. 3. Ctrl+f 4. Found this password 4 times. Even after i locked KeePass i still found the password 2 times. This is bad!

Too 7y ago

Here is a study on how well various password managers try to scrub their memory to avoid RAM dumps: https://www.securityevaluators.com/casestudies/password-manager-hacking/ https://www.securityevaluators.com/casestudies/password-mana...