5 ms·

SAASPASS is a password manager that unlocks on the desktop only with multi-factor authentication. There is no master password to be stolen.

oarsinsync 7y ago
Multi-factor means more than one factor. Something you have + something you know are multiple factors. There should still be a password. If there isn't, then it's single factor auth. Also, SAASPASS looks really interesting. Thanks for sharing. Going to take a much deeper look into this now. EDIT: Nope, change of plans. The account recovery flow depends on SMS, which isn't safe given how easy SIM-jacking is: https://saaspass.com/how-to-recover-saaspass-id-account/ https://saaspass.com/how-to-recover-saaspass-id-account/
- tialaramex 7y ago
  Ideally when you have a less capable device-based solution to "Something you have" like a FIDO token you want the user to enter their password (a "Something you know" factor) into that device, not the general purpose computer. So now the password isn't in the computer at all and can't be stolen from it. For example to sign into the web site for my bank account I need to enter a PIN into a chiclet keypad device they gave me, it spits out a one-time code and I type that into the web site. You can't steal the PIN from my PC, even if you have some kind of super zero day exploit and co-operation from the OS vendor, because the PIN gets typed into a separate device that doesn't even have a USB connector. You might as well try to use the PC to steal cash out of my wallet.
- notlukesky 7y ago
  Actually not. There is account recovery options that include a separate custom question and answer (password let’s say), and also the option of cloning it from another device as well. Those two different methods mitigate against SIM jacking.
  - oarsinsync 7y ago
    See this link from today: https://news.ycombinator.com/item?id=22016212 https://news.ycombinator.com/item?id=22016212 The parent's whole point was that this service doesn't have a master password. Nope, instead it has a 4 digit PIN and SMS as it's base flow, with security as an optional extra. A password manager shouldn't need to be caveated to be recommended. It's too important for that.
DownGoat 7y ago
No password managers really help in this scenario, as the attackers have access to the machine the client runs on. Any malware will simply wait untill you unlock it, and then siphon out any credentials.
- notlukesky 7y ago
  True in that case as that has nothing to do with the password manager. Any password that you would type in manually is also vulnerable.

oarsinsync 7y ago

Multi-factor means more than one factor. Something you have + something you know are multiple factors. There should still be a password. If there isn't, then it's single factor auth. Also, SAASPASS looks really interesting. Thanks for sharing. Going to take a much deeper look into this now. EDIT: Nope, change of plans. The account recovery flow depends on SMS, which isn't safe given how easy SIM-jacking is: https://saaspass.com/how-to-recover-saaspass-id-account/ https://saaspass.com/how-to-recover-saaspass-id-account/

tialaramex 7y ago
Ideally when you have a less capable device-based solution to "Something you have" like a FIDO token you want the user to enter their password (a "Something you know" factor) into that device, not the general purpose computer. So now the password isn't in the computer at all and can't be stolen from it. For example to sign into the web site for my bank account I need to enter a PIN into a chiclet keypad device they gave me, it spits out a one-time code and I type that into the web site. You can't steal the PIN from my PC, even if you have some kind of super zero day exploit and co-operation from the OS vendor, because the PIN gets typed into a separate device that doesn't even have a USB connector. You might as well try to use the PC to steal cash out of my wallet.
notlukesky 7y ago
Actually not. There is account recovery options that include a separate custom question and answer (password let’s say), and also the option of cloning it from another device as well. Those two different methods mitigate against SIM jacking.
- oarsinsync 7y ago
  See this link from today: https://news.ycombinator.com/item?id=22016212 https://news.ycombinator.com/item?id=22016212 The parent's whole point was that this service doesn't have a master password. Nope, instead it has a 4 digit PIN and SMS as it's base flow, with security as an optional extra. A password manager shouldn't need to be caveated to be recommended. It's too important for that.

DownGoat 7y ago

No password managers really help in this scenario, as the attackers have access to the machine the client runs on. Any malware will simply wait untill you unlock it, and then siphon out any credentials.

notlukesky 7y ago
True in that case as that has nothing to do with the password manager. Any password that you would type in manually is also vulnerable.