6 ms·
I would argue that pass isn't that secure other than when your computer is off. Namely that it requires copy and pasting. Any program on your computer can read
by georgyo 7y ago
I would argue that pass isn't that secure other than when your computer is off.
Namely that it requires copy and pasting. Any program on your computer can read your clipboard.
And for a normal user who are more vulnerable to phishing, there isn't automatic domain checking. It would be their normal work flow to copy a password into a malicious site.
- Thorrez 7y agoCan't any program on your computer also just keylog your master password and get your whole database? That's worse than getting individual passwords from the clipboard.
- singlow 7y agoOnly a program with elevated priveleges can record keystrokes when not focused. Unpriveleged programs can see the clipboard data much more freely.
- Thorrez 7y agoHmm, what if a malicious program modifies your PATH (or creates a bash alias) so that whatever command you use before you enter your master password is now replaced with a backdoored one?
- aorth 7y agoYou should specify the full path to the real "pass" when you configure the browser extension. This is a very common problem—with a known solution—in shell scripts since forever.
- Thorrez 7y agoIs the browser extension configuration owned by root? I thought that would be owned by your user. So the malware could modify that configuration.
- sdan 7y agoIf you install Browserpass for Chrome (there's an alternate for Firefox as well) all you need to do is type in your keyboard command and it'll automatically fill out your info for you on the website. Meaning: Suppose you go to gooogle.com instead of google.com, the extension won't fill out info because it doesn't recognize you having an user/pass for gooogle.com
- libeclipse 7y agoDude if your clipboard is untrusted in your threat model then you have bigger problems. Any program that is reading your clipboard could also be logging your keys, watching your webcam, recording your screen, or exfiltrating your files. Have a reasonable security model please
- georgyo 7y agoThe clipboard is extra vulnerable. It requires no privileges at all to read. Up until very recently, JavaScript in your browser could pull content directly out of your clipboard. Even beyond that, copy and pasting is training users to copy and paste. This is an even bigger threat imho. There is no layer of extra validation.