Comment by Nadya | Hacker News Reader

Comment by Nadya | Hacker News Reader

That is really big news, it also allows me to go find my friend and claim my $20 from our bet that his password manager of choice would succumb to an attack within 5 years that renders it more dangerous than not having it...

> We also found how it is possible to abuse account recovery to ultimately obtain the encryption key for the vault.

If a 3rd party can help recover your information, your information is not secure because account recovery can typically be bypassed by social engineering.

E:

Someone posted the blog outlying more details:

>With all this information, we where finally able to obtain master passwords in cleartext. Woo hoo! Our attack only covers users that click the “Store my password” option though so, don’t store your master password!

So it's hackable, but only if you're an idiot who stores your master password or sets your password reminder to contain your password.

Seems my bet with my friend wages on. I'll probably be out $20 by the years' end.

> renders it more dangerous than not having it

If I were your friend, I would tell you that this is still dubious owing to the fact that without it, many people might use very weak passwords that never change. You gotta weigh that and the vulnerability it presents for large-scale remote attacks/leaks, against the likelihood of these guys getting local access to your machine (i think?) for this exploit.

Please allow me to elaborate a bit.

Storing multiple passwords within a single master password means your security is only ever as strong as your master password is safe. Literally "putting all your eggs into one basket". Same with centralized email. One should separate accounts by email such that if a single email is compromised - not every account is compromised.

My argument (and practice) is to have individual emails for individual accounts. Using a dice selection method [0] they'll be as secure as any individual master password. The issue is burden of memory.

The argument in favor of password managers is that they relieve the user of burden of memory by exchanging a small chunk of security for a large chunk of convenience. Which is why I use a password manager.

The actual bet however is that somewhere in the implementation of password managers there will be found something that is so insecure it allows someone to "seize the basket" and more or less make the trade-off go from a "small chunk of security" to "all security". Specifically, any PM that doesn't require the device being compromised; though physical access is fine. (Physical access allows memory attacks but the device itself is not yet compromised.)

I hope that helped give my position some more nuance.

[0] http://world.std.com/~reinhold/diceware.html

Reply on news.ycombinator.com