6 ms·

Thunderbird stored OpenPGP secret keys without master password protection

64 points by mritzmann 5y ago

deleted 5y ago
[deleted]
akerl_ 5y ago
Am I reading correctly that ~“GPG private keys were stored unencrypted” and ~“messages could be modified to include non-encrypted chunks, which the client displayed without indicating the distinction” both count as low-severity?
- Egoist 5y ago
  I don’t know what counts as high severity if that’s considered low.
  - methodsignature 5y ago
    Probably high for them are usage issues, like broke buttons in their UI or chopped text.
treve 5y ago
I'm a novice at security, but shouldn't the correct fix be to force the user to revoke the keys?
- edoceo 5y ago
  Yes. Keys compromised? Suspect compromise? Rotate. I think a good policy is to get in the habit of rotation.
  - ben0x539 5y ago
    It's a good policy, but I don't think it would work well as something _forced_ on users.
    - edoceo 5y ago
      Oh yes, like Novell default policy to change password every 90 days. So many help desk calls.
      - whoknowswhat11 5y ago
        Govt still has that - help desk calls galore. Good / bad news - they usually make phone call password reset easy (given volume) - sometimes you can just give your username and get a new password (we can ignore the security risks in that process).
        Spooky23 5y ago
        Local governments that handle data from the IRS (child support units in counties are one example) have to meet IRS 1075 requirements. A few years ago, that included complex passwords that lock in 3 wrong attempts among other things. Worst part is that the rules tend to infect other parts of the business if people do stuff incorrectly.
        whoknowswhat11 5y ago
        No kidding. The lockout rate (which leads to shared passwords so people can work) etc gets crazy with these systems.
    - xbar 5y ago
      It's good to prompt them.
- giomasce 5y ago
  Yes, if a key is or might be compromised it is a good idea to rotate it. Though, since you mention you're novice, you might not be aware that in the case of OpenPGP that doesn't necessarily mean to revoke the primary key, if you set up things properly in the first place. In OpenPGP the thing you call a "key" is actually many keys: there is a primary one and whatever number of subkeys. Subkeys are those that are actually used in day-to-day encryption and signing activity, and that you need on your computer. Primary keys are used to sign subkeys and other people's keys, but you don't need them for day-to-day activities, so you can keep them in a separate storage that is not normally attached to your computer. If your computer gets compromised you have to revoke subkeys, but you can keep the primary key (unless you attached the cold storage to your computer while it was compromised). This makes the rotation much less painful than if you have to revoke your primary key, which implies also re-establishing signatures and trust with other people. If you search for "gpg subkeys" you will find a few tutorials. Even more secure is to keep the primary key offline and the subkeys in a security module, like Yubikey, Gnuk or Nitrokey Start. That makes everything much more secure, and you can easily carry your keys to other computers, knowing that when you detach your security module that computer won't have access to your keys any more.
jokoon 5y ago
Well it's not ideal, but it assumes the computer it is stored on is securely protected, so Thunderbird would not be the weakest link here. Protecting this key would require to ask a password to the user. By default there are none, but users who use gpg are aware of security and would generally set a master password.
- trashcan 5y ago
  > The master password protection was inactive for those keys. Or do you mean setting a master password for the key itself outside of Thunderbird?
u801e 5y ago
Would this only affect keys that don't have an associated passphrase that's used to decrypt them?
- LinAGKar 5y ago
  I think Thunderbird removes the passphrase (or stores it somewhere), since you don't need to enter it to use the key.
  - u801e 5y ago
    Does Thunderbird make use of gpg-agent for that?
skittlesmcgee 5y ago
Thanks alot, Mozilla!
andreasley 5y ago
This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It boggles my mind.
- croutonwagon 5y ago
  Chrome does they same, at least on windows, if you merely have local admin on the box.
  - zamadatix 5y ago
    "if you merely have local admin", yeah the game was lost when you signed on to that machine the first time not when it didn't ask your personal password the Nth time.
- lights0123 5y ago
  So does Chrome, Edge, and GNOME Web. Safari locks it behind a password prompt, but they can still be extracted one-by-one by using devtools to inspect the value of the password field after being autofilled.
  - andreasley 5y ago
    Chrome and derivates require the user's account password to view the stored passwords. Safari uses the macOS keychain and won't show passwords easily. The trick you mentioned only works on Macs without Touch ID and requires more work, so not really the same.
- georgyo 5y ago
  I was fairly sure that firefox is using your OS keyring. IE, it is encrypted at rest. You logging into your computer unlocks your keyring, which unlocks the secret your browser uses to encrypt things like passwords.... However looking at my keyring on Linux, I see secrets for Chrome, I do not see secrets for firefox... Which I find extremely surprising and disappointing...
- 5y ago

64 points by mritzmann 5y ago

deleted 5y ago

[deleted]

Am I reading correctly that ~“GPG private keys were stored unencrypted” and ~“messages could be modified to include non-encrypted chunks, which the client displayed without indicating the distinction” both count as low-severity?

Egoist 5y ago
I don’t know what counts as high severity if that’s considered low.
- methodsignature 5y ago
  Probably high for them are usage issues, like broke buttons in their UI or chopped text.

treve 5y ago

I'm a novice at security, but shouldn't the correct fix be to force the user to revoke the keys?

edoceo 5y ago
Yes. Keys compromised? Suspect compromise? Rotate. I think a good policy is to get in the habit of rotation.
- ben0x539 5y ago
  It's a good policy, but I don't think it would work well as something _forced_ on users.
  - edoceo 5y ago
    Oh yes, like Novell default policy to change password every 90 days. So many help desk calls.
    - whoknowswhat11 5y ago
      Govt still has that - help desk calls galore. Good / bad news - they usually make phone call password reset easy (given volume) - sometimes you can just give your username and get a new password (we can ignore the security risks in that process).
      - Spooky23 5y ago
        Local governments that handle data from the IRS (child support units in counties are one example) have to meet IRS 1075 requirements. A few years ago, that included complex passwords that lock in 3 wrong attempts among other things. Worst part is that the rules tend to infect other parts of the business if people do stuff incorrectly.
        whoknowswhat11 5y ago
        No kidding. The lockout rate (which leads to shared passwords so people can work) etc gets crazy with these systems.
  - xbar 5y ago
    It's good to prompt them.
giomasce 5y ago
Yes, if a key is or might be compromised it is a good idea to rotate it. Though, since you mention you're novice, you might not be aware that in the case of OpenPGP that doesn't necessarily mean to revoke the primary key, if you set up things properly in the first place. In OpenPGP the thing you call a "key" is actually many keys: there is a primary one and whatever number of subkeys. Subkeys are those that are actually used in day-to-day encryption and signing activity, and that you need on your computer. Primary keys are used to sign subkeys and other people's keys, but you don't need them for day-to-day activities, so you can keep them in a separate storage that is not normally attached to your computer. If your computer gets compromised you have to revoke subkeys, but you can keep the primary key (unless you attached the cold storage to your computer while it was compromised). This makes the rotation much less painful than if you have to revoke your primary key, which implies also re-establishing signatures and trust with other people. If you search for "gpg subkeys" you will find a few tutorials. Even more secure is to keep the primary key offline and the subkeys in a security module, like Yubikey, Gnuk or Nitrokey Start. That makes everything much more secure, and you can easily carry your keys to other computers, knowing that when you detach your security module that computer won't have access to your keys any more.

jokoon 5y ago

Well it's not ideal, but it assumes the computer it is stored on is securely protected, so Thunderbird would not be the weakest link here. Protecting this key would require to ask a password to the user. By default there are none, but users who use gpg are aware of security and would generally set a master password.

trashcan 5y ago
> The master password protection was inactive for those keys. Or do you mean setting a master password for the key itself outside of Thunderbird?

u801e 5y ago

Would this only affect keys that don't have an associated passphrase that's used to decrypt them?

LinAGKar 5y ago
I think Thunderbird removes the passphrase (or stores it somewhere), since you don't need to enter it to use the key.
- u801e 5y ago
  Does Thunderbird make use of gpg-agent for that?

skittlesmcgee 5y ago

Thanks alot, Mozilla!

andreasley 5y ago

This reminds me of the fact that Firefox, by default, allows anyone to view stored credentials – no authentication required, as no master password is set. It boggles my mind.

croutonwagon 5y ago
Chrome does they same, at least on windows, if you merely have local admin on the box.
- zamadatix 5y ago
  "if you merely have local admin", yeah the game was lost when you signed on to that machine the first time not when it didn't ask your personal password the Nth time.
lights0123 5y ago
So does Chrome, Edge, and GNOME Web. Safari locks it behind a password prompt, but they can still be extracted one-by-one by using devtools to inspect the value of the password field after being autofilled.
- andreasley 5y ago
  Chrome and derivates require the user's account password to view the stored passwords. Safari uses the macOS keychain and won't show passwords easily. The trick you mentioned only works on Macs without Touch ID and requires more work, so not really the same.
georgyo 5y ago
I was fairly sure that firefox is using your OS keyring. IE, it is encrypted at rest. You logging into your computer unlocks your keyring, which unlocks the secret your browser uses to encrypt things like passwords.... However looking at my keyring on Linux, I see secrets for Chrome, I do not see secrets for firefox... Which I find extremely surprising and disappointing...
5y ago