4 ms·

There is a lot of backlash against this article, which to be fair is kind of poorly written, but still makes a valid point. Encrypting something and writing the

There is a lot of backlash against this article, which to be fair is kind of poorly written, but still makes a valid point. Encrypting something and writing the key on the same place is pointless. These browsers encrypting the passwords with a key saved on the device is security theater and has to be called out. Security is not all or nothing, most people don't have full disk encryption so their passwords are sitting there completely unencrypted, trivially retrieved from anyone with physical access.

lucideer 4y ago
> makes a valid point. Encrypting something and writing the key on the same place is pointless. The backlash is due to this not being a valid point. Security best practice has long moved on from dogmatic binaries and treating humans like robots. Encrypting something in transit and writing the key in plaintext locally, while not ideal, is far from pointless. Building perfectly secure systems that nobody will use is what's pointless. > trivially retrieved from anyone with physical access Pretty bold using the word "trivial" here: physical access is not the primary threat model for average password manager use.
- throwawayffffas 4y ago
  It's not in transit, it's the equivalent of storing your passwords in plaintext, which I don't think can be actually defended as a good practice. Regardless the question that arises which is a lot more worrisome is what happens when you turn on synchronization on these browsers? Do they encrypt the passwords with a key only you know? Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers?
  - lucideer 4y ago
    > which I don't think can be actually defended as a good practice Allow me to try defending it: Even storing your passwords in plaintext locally using an integrated password manager would: 1. discourage password reuse 2. usually encourage generated strong passwords/phrases (best password is one you don't know) 3. allow easy automated password auditing 4. prevent phishing-based credential capture via domain matching Just point (1) above is a much greater threat than the likelihood of physical access (or rootkit/malware in which case key logging would invalidate keyed encryption either way) > what happens when you turn on synchronization on these browsers? [...] Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers? The typical approach is to ship the encrypted password without the key: provided it's a key known by the user, this makes it easy to download the encrypted credentials on any device and decrypt locally. If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable.
    - throwawayffffas 4y ago
      > If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable. My guess would be that they use the users authentication credentials, but I am not confident that they do.

lucideer 4y ago

> makes a valid point. Encrypting something and writing the key on the same place is pointless. The backlash is due to this not being a valid point. Security best practice has long moved on from dogmatic binaries and treating humans like robots. Encrypting something in transit and writing the key in plaintext locally, while not ideal, is far from pointless. Building perfectly secure systems that nobody will use is what's pointless. > trivially retrieved from anyone with physical access Pretty bold using the word "trivial" here: physical access is not the primary threat model for average password manager use.

throwawayffffas 4y ago
It's not in transit, it's the equivalent of storing your passwords in plaintext, which I don't think can be actually defended as a good practice. Regardless the question that arises which is a lot more worrisome is what happens when you turn on synchronization on these browsers? Do they encrypt the passwords with a key only you know? Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers?
- lucideer 4y ago
  > which I don't think can be actually defended as a good practice Allow me to try defending it: Even storing your passwords in plaintext locally using an integrated password manager would: 1. discourage password reuse 2. usually encourage generated strong passwords/phrases (best password is one you don't know) 3. allow easy automated password auditing 4. prevent phishing-based credential capture via domain matching Just point (1) above is a much greater threat than the likelihood of physical access (or rootkit/malware in which case key logging would invalidate keyed encryption either way) > what happens when you turn on synchronization on these browsers? [...] Or do they just ship the "encrypted" passwords along with the key, so that your passwords are now essentially plaintext on their servers? The typical approach is to ship the encrypted password without the key: provided it's a key known by the user, this makes it easy to download the encrypted credentials on any device and decrypt locally. If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable.
  - throwawayffffas 4y ago
    > If it's a generated key unknown to the user, there's a few different strategies to adding a second client - more complex but doable. My guess would be that they use the users authentication credentials, but I am not confident that they do.