4 ms·

Even if the user doesn't turn on a master password, having the key in a predictable place on an encrypted volume with appropriate access permissions is still fa

Even if the user doesn't turn on a master password, having the key in a predictable place on an encrypted volume with appropriate access permissions is still far more secure than sticky notes on the monitor. Contrary to the OP link's statement, it isn't enough for the attacker to get access to the user's system, they have to get access to the user's account. And if the organization in question isn't using Bitlocker or FileVault or some other encryption, browser password stores are way down the list of security worries.

olliej 4y ago
I'm sorry, but this view is fundamentally incorrect. You have to consider what the actual threat model is. The reality is that your primary threat model is not going to be one employee compromising another's, nor is it someone malicious physically tracking down your employees and stealing and/or physically compromising their devices. Those threats do technically exist, but your employees have to be extraordinarily valuable to warrant the surveillance required to use physical access to compromise them/their account. It is vastly more likely that the attack vector is going to be spam/scam/phishing leading to malicious software installed on the victim's machine. Notably in regard to the post-it/notebook you claimed was the worst option, computers generally can't read post it notes attached to the monitor. Similarly bit locker and FileVault are obviously important, but do nothing at all to stop a remote attacker, because the only threat model that they protect against is physical access to the hardware. If a remote attacker has got some malicious software installed, then by definition once it's running all the drive content is available to the attacker's software (technically SIP should limit this on macOS, but I'll assume that an attacker also compromises SIP). But it is extremely important to understand that in none of these cases did the attacker need to get "access to the user's account" - that was simply a byproduct of their primary attack.
- Timshel 4y ago
  How else would you define a phishing attack than getting "access to the user's account" ???
  - olliej 4y ago
    Given the comment I was replying to that was considering "access to the user's account" being the unlikely case, it seemed reasonable to go into very clear detail on what the real world attack vector is. That said, phishing does not necessarily mean gaining access to an account. The typical path is the low cost "trick someone into providing their credentials to a malicious party" - something browser based password managers do well, as they are very careful in ensuring they only ever enter passwords into the correct domain. You can also phish someone who is very careful by not asking for their account credentials, but having them do something innocuous that compromises their machine. For example you can have a fake company interview them and provide them a PDF with the job offer, and then have the PDF install malware. But the important thing is that the primary attack vector for any device is remote access. So things like disk encryption don't matter, and things like password notebooks are not accessible. The real problem is that once you have malware running on your machine, the presumption is that malware interested in credentials is going to elevate itself to super user at least and so generally gain code injection abilities in most processes that it could be interested in (e.g. all the password managers, or the system pasteboard, or whatever mechanism whichever the target password manager uses). Modern protections such as aggressive code-signing enforcement, sandboxing, SIP (or the windows equivalent), etc make such compromises harder, but harder != impossible.

olliej 4y ago

I'm sorry, but this view is fundamentally incorrect. You have to consider what the actual threat model is. The reality is that your primary threat model is not going to be one employee compromising another's, nor is it someone malicious physically tracking down your employees and stealing and/or physically compromising their devices. Those threats do technically exist, but your employees have to be extraordinarily valuable to warrant the surveillance required to use physical access to compromise them/their account. It is vastly more likely that the attack vector is going to be spam/scam/phishing leading to malicious software installed on the victim's machine. Notably in regard to the post-it/notebook you claimed was the worst option, computers generally can't read post it notes attached to the monitor. Similarly bit locker and FileVault are obviously important, but do nothing at all to stop a remote attacker, because the only threat model that they protect against is physical access to the hardware. If a remote attacker has got some malicious software installed, then by definition once it's running all the drive content is available to the attacker's software (technically SIP should limit this on macOS, but I'll assume that an attacker also compromises SIP). But it is extremely important to understand that in none of these cases did the attacker need to get "access to the user's account" - that was simply a byproduct of their primary attack.

Timshel 4y ago
How else would you define a phishing attack than getting "access to the user's account" ???
- olliej 4y ago
  Given the comment I was replying to that was considering "access to the user's account" being the unlikely case, it seemed reasonable to go into very clear detail on what the real world attack vector is. That said, phishing does not necessarily mean gaining access to an account. The typical path is the low cost "trick someone into providing their credentials to a malicious party" - something browser based password managers do well, as they are very careful in ensuring they only ever enter passwords into the correct domain. You can also phish someone who is very careful by not asking for their account credentials, but having them do something innocuous that compromises their machine. For example you can have a fake company interview them and provide them a PDF with the job offer, and then have the PDF install malware. But the important thing is that the primary attack vector for any device is remote access. So things like disk encryption don't matter, and things like password notebooks are not accessible. The real problem is that once you have malware running on your machine, the presumption is that malware interested in credentials is going to elevate itself to super user at least and so generally gain code injection abilities in most processes that it could be interested in (e.g. all the password managers, or the system pasteboard, or whatever mechanism whichever the target password manager uses). Modern protections such as aggressive code-signing enforcement, sandboxing, SIP (or the windows equivalent), etc make such compromises harder, but harder != impossible.