Hacker News Reader

Comment by vemv | Hacker News Reader

Password managers seem to have the essential flaw of using the clipboard.

What prevents a random npm/rubygems/... dependency from running `pbcopy` every second, storing interesting-looking results and relaying them to some server once in a while?

View on HN

If your machine is compromised you already lost. They can just run a keylogger or read memory out of your browser process.

This assumes the machine is already pwned - at which point why wouldn't they just use a keylogger? In that case, typing the password in without the use of a password manager instead of copy/pasting from a password manager wouldn't be any more secure.

It's reasonably easy (or at least feasible) to sneak runnable code as an indirect dependency of a development project (node.js, rails, etc), or of a Homebrew formula. No pwning needed - at least as commonly conceived.

Presumably, running `pbcopy` is easier and less detectable than writing a keylogger?

This suggests a related question. There's no inherent reason why programs other than your desktop shell and the current focused window (for window based DEs) need to have access to keyboard input. In practice, how good are existing DEs at controlling this access? I know, for example, that the slow move from X to Wayland has removed some of the methods a program might use to access inputs or the clipboard.

the essential flaw of using the clipboard

This isn't essential to the operation of a password manager and sensible password managers don't do this.

What's a correct workflow then? (I genuinely don't know)

Say a password manager wants to let me know that my password for Gmail is d78658b8f207c4256370d3e018e0f3d544607849aa5f6bd8, what should it do then?

It seems to me, either the manager or me will copy that value to the clipboard somehow.

A decent password manager has browser integration through browser extensions and fills in passwords for you. Current versions of Safari and Chrome have built-in password managers.

Wasn't fully aware of this.

I think most 'hacker-friendly' password managers (like password-store), that are unix-y, can be persisted to git, don't depend on megacorps, etc lack these capabilities?

i.e. very few password managers might count as 'decent'.

As a last note, a browser extension that doesn't come from Google or Apple shouldn't be trusted. I have zero extensions (other than uBlock), since they essentially have arbitary read/write capabilites into one's digital life.

What's really missing is a OS-level widget that acts as a secure clipboard. Similar to how one inserts emojis in macOS.

i.e. very few password managers might count as 'decent'.

I think this is true - this is really core browser functionality and all password managers are fundamentally hacks. A tiny number of these hacks are non-awful. 'hacker-friendly' password management is a bit like 'hacker-friendly' dentistry - useful to a tiny minority of exceptionally adventurous people.

The safest, sanest thing you can do is use the browser-provided password manager and the browser- or OS- provided sync. Both Safari's and Chrome's use end-to-end encryption (you have to turn it on in Chrome but it's there). The benefits of this far outweigh the downsides, to the point where I actually think the typical recommendation for 1Password is a bit outdated and counter-productive. Browser and platform vendors should obviate the need for this entire class of software and they seem to be moving in that direction.

I use PassFF which does Firefox integration for pass (and thus you get all the usual pass features, git integration, etcetera).

I have no idea why you feel proprietary goop from Apple is trustworthy while code I can read for myself is not.

Personally I have auto-fill configured. Since I fixed (in my copy and since the PR was accepted eventually everyone's) the lack of any suffix matching beyond TLDs I feel auto-fill security implications are tolerable, I'm sure views vary. But I definitely couldn't put up with manual copy & paste.

Fair observation, thanks for sharing.

I'll start looking into https://github.com/browserpass/browserpass/ .

The passwd manager I'm using wipes your clipboard after a short period of time.

You can read the clipboard continuously.

Or, on Windows an app can watch for the WM_DRAWCLIPBOARD message[0], which gets sent every time the contents of the clipboard changes.

[0] https://docs.microsoft.com/en-us/windows/desktop/dataxchg/us...

Reply on news.ycombinator.com