Hacker News Reader

Comment by tptacek | Hacker News Reader

From the Cure53 report: the version tested had a terrible vulnerability (unfortunately somewhat common to password managers): it tries to match passwords to subdomains, and in doing so misparses domains, allowing it to be tricked into giving passwords to bogus almost-look-alike domains. Yikes.

Meanwhile: they've got a crypto protocol tunneled over TLS "to avoid heartbleed" and some other convoluted stuff the auditors complain about. You really want to see a password manager get the basics right.

Notice also that the end of the Cure53 report complains about the project scope and the amount of time given. This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before.

View on HN

> This is pretty unusual for Cure53, who have a reputation for being a bit effusive about the products they're paid to review. I'm not sure I've ever seen them throw shade before.

Yes, and it's getting really old. I'm tired of seeing security consulting firms wax poetic about how good the client's security is in their reports, then bend over backwards to frame obviously serious findings in the best possible light. That's not their job, their job is to report security vulnerabilities objectively, with sufficient coherence, context and reproduction steps so as to make the problem evident and motivate a solution.

Naturally, as soon as Cure53 decided to politely categorize what are clearly critical vulnerabilities as high severity, Remembear took to Twitter to crow about how much of a success the security audit was - "No critical findings!" I have serious reservations about the incentives at play between companies and the consultants paid to (security) review their products, especially when the report is publicized.

In my opinion, companies should not be using security consulting firms as a component in a press release. It encourages a mischaracterization of the state of the company's security and the severity of findings, and it puts a pressure on other security consulting firms to "play ball" and gush about their clients' products in publicized reports.

Relevant: https://news.ycombinator.com/item?id=14825508

it's an industry secret that one of the reasons you do an audit is so you don't have to publish the "real" findings

This person gets it. At least NCC doesn't pretend to say something is secure or not. People are getting used to Cure53 reports like they're normal.

NCC writes public-facing reports. They're antiseptic, and rarely make overt endorsements, but it's the whole practice of public-facing reports that needs to end, not just one particularly theatrical subset of them.

That report: https://cure53.de/pentest-report_remembear.pdf

> It can be observed that since the algorithm is removing up to two top level domains, it actually treats victim.co.uk, victim.com, victim.de and even test.victim.co.at as if they were identical

> it has been noticeable that the development process of the RememBear suite was affected by tight deadlines. Evidencing this was the fact that builds were generally provided only one or two days before actual testing started, leaving little room for in-depth reconnaissance

TunnelBear's pull-quote @ https://www.remembear.com/blog/remembear-security-audit/:

> we’re proud to share that no critical security issues were discovered

I'd consider putting credentials on an incorrect domain a showstopper for a password manager, but whatever.

It's got to at least be in the top 3 problem-domain-specific vulnerabilities you can have in a password manager, that's at least for sure.

They also had 3 'Critical' vulnerabilities reported by Cure53 in their extension VPN offering last year.

https://cure53.de/summary-report_tunnelbear.pdf

To be fair though, as per the report all of these "Critical" vulnerabilities were fixed by mid-2017. So they're listening, at least.

And I bet the critical sub-domain vulnerability was fixed too.

The problem is that they are going to keep adding code, but won't get a security audit with every update. So all it takes is a slight mistake for it to be vulnerable again. What you need is a strong in-house pentesting team to be sure about there not being any new vulnerabilities with each release. Or atleast a bug bounty starting with beta releases, and let them bake before releasing them publicly.

The fact that such serious vulnerabilities come up at the time of an audit shows that they don't have one.

A few quotes from it:

> As far as the actual five security vulnerabilities discovered during testing are concerned, one important point to make is that not a single problem was deemed to be of a “Critical” severity or security implications. For the two issues ranked as “High”, the first problem had to do with a design flaw around the autofill functionality and incorrect handling of top level domains

> They are grounded in the deployment of libsodium, which is a state-of-the- art cryptographic library. While various notes and suggestions were collected during the cryptographic analysis, no severe implementation-related vulnerability was spotted. In other words, it is believed that a real-world attacker would remain powerless in face of the employed defense mechanisms

> All in all, the RememBear is a robust and promising project.

What password manager do you recommend?

I feel OK talking about the audit report, the basics of security for password managers, and the dynamics of using an audit report to market a product, and I feel OK talking about what my preferred password manager is, but it occurred to me I wasn't psyched about doing both on the same thread.

It's not hard to figure out, but it's not a conversation I want to have on this thread. Thanks in advance!

I don't understand this response. Why would it be improper to discuss alternative products?

I don't know you, so I guess you have a vested interest? Is that it?

No, I do not.

Bitwarden is open-source and has been working well for me as a LastPass replacement so far.

Pass. It uses plain old gpg. Has git syncing and browser extensions (if you are into that kinda thing).

https://www.passwordstore.org

Bruce Schneier agrees so designed his to not have some convenience features like that. Its kind of a pain sometimes but seems like good design to me.

"Schneier on Security: Security of Password Managers" https://www.schneier.com/blog/archives/2014/09/security_of_p...

Props for using 'effusive' and 'throw shade' in contiguous sentences.

> ...with Safari and Firefox coming very soon.

I’m holding my breath...

Reply on news.ycombinator.com