3 ms·

Strength of password won't really help for key logging, but using e.g. Lastpass helps because it logs you into everything without having to type your passwords.

Strength of password won't really help for key logging, but using e.g. Lastpass helps because it logs you into everything without having to type your passwords. It will even generate and fill in your initial passwords so that you never have to type your passwords even once.

Houshalter 13y ago
Lastpass doesn't have a password itself?
- JangoSteve 13y ago
  Ah great question. It does, but it usually stays logged in on your computer, since it runs locally. So you rarely if ever need to type your password for Lastpass, meaning the keylogger would have had to be running on your computer when you installed and set up Lastpass. On a related note, it can also be set up with 2 factor auth.
  - Houshalter 13y ago
    Presumably the password is stored to a file or in memory (of course that could be arbitrarily difficult to figure out how to decode, but it can't be encrypted since that would require another password.)
    - JangoSteve 13y ago
      Why do you assume it'd be stored in plain text rather than hashed? Also, what does compromising someone's local filesystem have to do with the functionality of a keylogger?
      - Houshalter 13y ago
        Even if it's hashed, then the hash can still be used to reconstruct the lastpass passwords. And I'm just assuming that you can't trust your filesystem if your machine has been compromised by malware. You're right the keylogger probably isn't that complicated. It depends on what level of paranoia you have and how widely lastpass becomes adopted (thus more incentive to hack it.) More likely the keylogger will just get the first time you enter your password into lastpass and then steal it that way. The point is lastpass is designed to protect you from weak passwords and password reuse. It doesn't do anything to protect against attacks on your actual computer.
        JangoSteve 13y ago
        Oh, I misunderstood you; I thought you were referring to the master password of LastPass as being plain-text or reversibly encrypted. You mean that the passwords stored by LastPass must be reversibly encrypted on disk. Yes, that's true. Password managers do open the door for such an attack, but they tend to be much less vulnerable to attacks in general than reusing the same passwords. Of course, it's really up to each person to decide what risks are acceptable in the trade-off between convenience and security. I think the main point was that a password manager would have been much less susceptible to the keylogger attack which lead to this particular incident.

Houshalter 13y ago

Lastpass doesn't have a password itself?

JangoSteve 13y ago
Ah great question. It does, but it usually stays logged in on your computer, since it runs locally. So you rarely if ever need to type your password for Lastpass, meaning the keylogger would have had to be running on your computer when you installed and set up Lastpass. On a related note, it can also be set up with 2 factor auth.
- Houshalter 13y ago
  Presumably the password is stored to a file or in memory (of course that could be arbitrarily difficult to figure out how to decode, but it can't be encrypted since that would require another password.)
  - JangoSteve 13y ago
    Why do you assume it'd be stored in plain text rather than hashed? Also, what does compromising someone's local filesystem have to do with the functionality of a keylogger?
    - Houshalter 13y ago
      Even if it's hashed, then the hash can still be used to reconstruct the lastpass passwords. And I'm just assuming that you can't trust your filesystem if your machine has been compromised by malware. You're right the keylogger probably isn't that complicated. It depends on what level of paranoia you have and how widely lastpass becomes adopted (thus more incentive to hack it.) More likely the keylogger will just get the first time you enter your password into lastpass and then steal it that way. The point is lastpass is designed to protect you from weak passwords and password reuse. It doesn't do anything to protect against attacks on your actual computer.
      - JangoSteve 13y ago
        Oh, I misunderstood you; I thought you were referring to the master password of LastPass as being plain-text or reversibly encrypted. You mean that the passwords stored by LastPass must be reversibly encrypted on disk. Yes, that's true. Password managers do open the door for such an attack, but they tend to be much less vulnerable to attacks in general than reusing the same passwords. Of course, it's really up to each person to decide what risks are acceptable in the trade-off between convenience and security. I think the main point was that a password manager would have been much less susceptible to the keylogger attack which lead to this particular incident.