12 ms·

Is it even safe to use browser-integrated password managers? I think they're so much easier to use than external solutions such as KeepassXC, but if it's so eas

Is it even safe to use browser-integrated password managers? I think they're so much easier to use than external solutions such as KeepassXC, but if it's so easy to decrypt their databases...

mrweasel 2y ago
I never found a way to lock the password manager in Firefox with its own password. They probably aren't bad, but they are also way behind on features and general usability, as compared to standalone password managers. If you have passwords that are used outside the browser, putting them into the browsers password manager, getting them out feels a little cumbersome. Related to the tool: Why not just click the export button in Firefox?
- chungy 2y ago
  Check "Use a Primary Password" in preferences.
  - blibble 2y ago
    reasonably certain this doesn't encrypt your cookies which are in some cases better than your passwords (already passed 2FA, etc)
eesmith 2y ago
What is your risk model? An attacker who can install cameras in your house to see your PIN/password? An attacker with a blunt object and the clear intent to harm you if you don't unlock your phone? Your spouse who you trust enough to loan your device to look at a cat pic?
- reddalo 2y ago
  My threat model is accidentally installing malware that reads the database of my passwords. I trust my KeepassXC database because I use a strong and long password, so even if malware can read my KeepassXC file, it won't be able to extract the passwords. I feel like Firefox is not as safe.
  - xvector 2y ago
    Your malware would still need the password for the PBKDF step to decrypt the Firefox database
  - eesmith 2y ago
    So malware which installs a key scanner to read everything you enter is outside of your threat model, as is external surveillance to record what you type. Choose a password manager which you like. I like having a paper book with a dumb-ass encryption scheme, because my threat model is that I am not going to worry about physical attacks, and servers will detect attempts to brute-force the dumb-ass scheme by adding delays after the first few failures. I use Firefox's manager for my Mastodon accounts, because no one cares for my 10 followers, and the instance manager can resolve things if needed.
    - 0xEF 2y ago
      Isn't your last paragraph part of the problem, though? To paraphrase, you use Firefox's password manager for things you don't care about. So, those simple passwords are tied to small accounts that, individually add up to nothing, but together start to build a little cache of your emails, throwaway passwords and other tiny bits of data that all get collated with other data scraped about you. This much larger data cache then gets sold and used I attacks like credential stuffing to access even more data, etc. You're posture is assuming that if it doesn't matter to you, then it doesn't matter at all, and that simply is not true.
      - dwattttt 2y ago
        He stated the higher security model he uses; a paper book. As well as his threat model, which is pretty coherent and relevant in this modern age. I'd love to see someone "hack" his book, it would be quite the impressive hack.
        psychoslave 2y ago
        Surprising that someone care to invest so much effort in it unless it can unlock some institutional level threats to leverage on for some geo-political negotiation or at least plots between big companies. But impressive hack, not necessarily. https://xkcd.com/538/ https://xkcd.com/538/ https://xkcd.com/2176/ https://xkcd.com/2176/
- otabdeveloper4 2y ago
  > risk model Hah. Don't bother us with your mumbo-jumbo, we're doing computer security here.
  - eesmith 2y ago
    I will take Kamchatka from Alaska, using my model cannon, my model horsemen and my three model soldiers.
sureIy 2y ago
Safari's absolutely. It uses a OS-wide keychain secured via hardware.
- larschdk 2y ago
  Does this prevent other software running on the same hardware from accessing the keychain? E.g. on Windows, any program can access the entirety of the credential store for the current user.
  - bdash 2y ago
    Each keychain item on macOS has an access control list associated with it that lists the applications that are granted access to the keychain item. If an application not on the ACL attempts to access a keychain item, macOS prompts the user for authorization. The ACL entries identify applications based on properties of their code signature and so are not spoofable.
    - sureIy 2y ago
      Correct. The best part of this system (Keychain Access) is that it has been around for more than 20 years. Only this year it got a UX makeover. One interesting thing I noticed is that Chrome and Firefox can also seamlessly see and use Passkeys I stored in Safari even if normally they don't read the passwords from there. Using each passkey however still requires a fingerprint every time.
      - bdash 2y ago
        Passkeys are a different story than the keychain more generally. Other browsers that work with passkeys via the system APIs had to jump through hoops and get Apple's approval to do so: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_web-browser_public-key-credential https://developer.apple.com/documentation/bundleresources/en...
- NotPractical 2y ago
  Chrome uses it too. However the CDP protocol allows any local app to control the browser so you can use that to open the browser in windowless mode, examine the list of passwords at chrome://passwords, then open a bunch of tabs to all of those sites and extract the passwords from the HTML forms they get auto-inserted into.
account42 2y ago
Why is this surprising and why do you expect the situation with external password managers to be different? If you can decrypt it other software running on your computer can too.
- graemep 2y ago
  A password manager integrated with the browser could be compromised by a vulnerability in the browser as well exploited by something running within the browser.
  - adrianN 2y ago
    That depends on how it is designed.
    - graemep 2y ago
      Is Firefox's designed in a way that prevents that? Given it can automatically insert passwords for a site, something in the browser can access passwords.
  - psychoslave 2y ago
    Well, unless there is zero integration with the browser, then it’s just a matter of time before some exploit will expose how to retrieve arbitrary information from the external tool. And of course, the external tool can have plenty of exploitable leaks unrelated to whether or not it’s integrated to some browser. If the goal is to have better security, no method of using password alone will bring significant improvement to an authentication system, no matter how great the password manager it’s used with.
    - graemep 2y ago
      Any tool can have leaks, but integration with an application that connects to large numbers of servers over the internet seems to be a huge increase in attack surface to me, compared to a password manager that is external to the browser.
paulryanrogers 2y ago
Every KeePass-based solution I've tried was far from ready for normal users. Because they need browser integration out of the box, and it has to be smooth. Even BitWarden is still too difficult to use.

Is it even safe to use browser-integrated password managers? I think they're so much easier to use than external solutions such as KeepassXC, but if it's so easy to decrypt their databases...

mrweasel 2y ago

I never found a way to lock the password manager in Firefox with its own password. They probably aren't bad, but they are also way behind on features and general usability, as compared to standalone password managers. If you have passwords that are used outside the browser, putting them into the browsers password manager, getting them out feels a little cumbersome. Related to the tool: Why not just click the export button in Firefox?

chungy 2y ago
Check "Use a Primary Password" in preferences.
- blibble 2y ago
  reasonably certain this doesn't encrypt your cookies which are in some cases better than your passwords (already passed 2FA, etc)

eesmith 2y ago

What is your risk model? An attacker who can install cameras in your house to see your PIN/password? An attacker with a blunt object and the clear intent to harm you if you don't unlock your phone? Your spouse who you trust enough to loan your device to look at a cat pic?

reddalo 2y ago
My threat model is accidentally installing malware that reads the database of my passwords. I trust my KeepassXC database because I use a strong and long password, so even if malware can read my KeepassXC file, it won't be able to extract the passwords. I feel like Firefox is not as safe.
- xvector 2y ago
  Your malware would still need the password for the PBKDF step to decrypt the Firefox database
- eesmith 2y ago
  So malware which installs a key scanner to read everything you enter is outside of your threat model, as is external surveillance to record what you type. Choose a password manager which you like. I like having a paper book with a dumb-ass encryption scheme, because my threat model is that I am not going to worry about physical attacks, and servers will detect attempts to brute-force the dumb-ass scheme by adding delays after the first few failures. I use Firefox's manager for my Mastodon accounts, because no one cares for my 10 followers, and the instance manager can resolve things if needed.
  - 0xEF 2y ago
    Isn't your last paragraph part of the problem, though? To paraphrase, you use Firefox's password manager for things you don't care about. So, those simple passwords are tied to small accounts that, individually add up to nothing, but together start to build a little cache of your emails, throwaway passwords and other tiny bits of data that all get collated with other data scraped about you. This much larger data cache then gets sold and used I attacks like credential stuffing to access even more data, etc. You're posture is assuming that if it doesn't matter to you, then it doesn't matter at all, and that simply is not true.
    - dwattttt 2y ago
      He stated the higher security model he uses; a paper book. As well as his threat model, which is pretty coherent and relevant in this modern age. I'd love to see someone "hack" his book, it would be quite the impressive hack.
      - psychoslave 2y ago
        Surprising that someone care to invest so much effort in it unless it can unlock some institutional level threats to leverage on for some geo-political negotiation or at least plots between big companies. But impressive hack, not necessarily. https://xkcd.com/538/ https://xkcd.com/538/ https://xkcd.com/2176/ https://xkcd.com/2176/
otabdeveloper4 2y ago
> risk model Hah. Don't bother us with your mumbo-jumbo, we're doing computer security here.
- eesmith 2y ago
  I will take Kamchatka from Alaska, using my model cannon, my model horsemen and my three model soldiers.

sureIy 2y ago

Safari's absolutely. It uses a OS-wide keychain secured via hardware.

larschdk 2y ago
Does this prevent other software running on the same hardware from accessing the keychain? E.g. on Windows, any program can access the entirety of the credential store for the current user.
- bdash 2y ago
  Each keychain item on macOS has an access control list associated with it that lists the applications that are granted access to the keychain item. If an application not on the ACL attempts to access a keychain item, macOS prompts the user for authorization. The ACL entries identify applications based on properties of their code signature and so are not spoofable.
  - sureIy 2y ago
    Correct. The best part of this system (Keychain Access) is that it has been around for more than 20 years. Only this year it got a UX makeover. One interesting thing I noticed is that Chrome and Firefox can also seamlessly see and use Passkeys I stored in Safari even if normally they don't read the passwords from there. Using each passkey however still requires a fingerprint every time.
    - bdash 2y ago
      Passkeys are a different story than the keychain more generally. Other browsers that work with passkeys via the system APIs had to jump through hoops and get Apple's approval to do so: https://developer.apple.com/documentation/bundleresources/entitlements/com_apple_developer_web-browser_public-key-credential https://developer.apple.com/documentation/bundleresources/en...
NotPractical 2y ago
Chrome uses it too. However the CDP protocol allows any local app to control the browser so you can use that to open the browser in windowless mode, examine the list of passwords at chrome://passwords, then open a bunch of tabs to all of those sites and extract the passwords from the HTML forms they get auto-inserted into.

account42 2y ago

Why is this surprising and why do you expect the situation with external password managers to be different? If you can decrypt it other software running on your computer can too.

graemep 2y ago
A password manager integrated with the browser could be compromised by a vulnerability in the browser as well exploited by something running within the browser.
- adrianN 2y ago
  That depends on how it is designed.
  - graemep 2y ago
    Is Firefox's designed in a way that prevents that? Given it can automatically insert passwords for a site, something in the browser can access passwords.
- psychoslave 2y ago
  Well, unless there is zero integration with the browser, then it’s just a matter of time before some exploit will expose how to retrieve arbitrary information from the external tool. And of course, the external tool can have plenty of exploitable leaks unrelated to whether or not it’s integrated to some browser. If the goal is to have better security, no method of using password alone will bring significant improvement to an authentication system, no matter how great the password manager it’s used with.
  - graemep 2y ago
    Any tool can have leaks, but integration with an application that connects to large numbers of servers over the internet seems to be a huge increase in attack surface to me, compared to a password manager that is external to the browser.

paulryanrogers 2y ago

Every KeePass-based solution I've tried was far from ready for normal users. Because they need browser integration out of the box, and it has to be smooth. Even BitWarden is still too difficult to use.