3 ms·
I mean, if the attacker has writable access to your vault, he likely can observe you handling the unencrypted password or steal all your gpg key material after
by blueflow 4y ago
I mean, if the attacker has writable access to your vault, he likely can observe you handling the unencrypted password or steal all your gpg key material after you unlocked it. This makes the "No binding between keys/values", "No authentication of values" and "My passwords are emails?" sections moot.
- upofadown 4y ago>I mean, if the attacker has writable access to your vault, he likely can observe you handling the unencrypted password or steal all your gpg key material after you unlocked it. To be clear here, only if that implies access to the memory you control, otherwise, no. GPG is pretty good about local file access by an attacker and pass maintains that on platforms where that is possible.
- blueflow 4y agoI would not assume the memory separation on x86 to be reliable.
- gnull 4y agoAccess to the vault ≠ access to unlocked vault. This is the whole point of storing anything encrypted on your disk. The password managers don't protect against a malware running on your laptop with root privileges and attaching to your processes. They protect against someone taking the disk out of your computer and trying to extract the passwords.
- blueflow 4y agoBut if they have the disk and modify is, its still them who have the disk. So the "No binding between keys/values" and "No authentication of values" still dont work out, either. And they are able to modify the contents on my disk, they'd be easier off installing a rootkit, pass cant protect against that.