Why Masked Passwords Are a Serious Security Hole | Hacker News Reader

Why Masked Passwords Are a Serious Security Hole

blog.passpack.com

21 pointsfreejoe7632 comments

It's hard to lose customers due to customer ignorance, but the alternative of giving them what they want (despite it being bad for them) is probably worse. At least, I don't know that I'd be comfortable doing so.

We run into it quite a bit, because our products are extremely complex, have numerous security-sensitive contact points in the system, and we've made some choices that do not match those of our competitors, often due to security concerns. Our refusal to treat chroot as a security tool is perhaps our most common source of "why don't you support this?" questions, and despite years of explaining our position, referencing numerous resources on the subject, providing examples of the futility of it, etc. doesn't make the question go away.

I think the best you can do is try to educate whenever the question comes up. It gets frustrating to answer the same question over and over again for years, especially if it's answered in the FAQ or documentation, but you pretty much just have to do it.

I think it's equally important in those situations to get at why the user wants to do that and coming up with a solution to their problem in your framework. One thing I've learned after years of supporting users is that they often ask for something because "that's how they've always done it," but if you find out what problem that they are trying to solve, you can come to reasonable solution for both parties without having to implement whatever "feature" it is that they are asking for.

Could someone detail the process of "sharing a masked password", or at least how it would theoretically be implemented as a feature? I'm not quite sure I get the scenario. Is the masked password to access passpack user account? Or is it to access some site passpack is managing a password for?

It seems to be some sort of utter nonsense imagined by someone who has no idea how any of this works. Well written article, but I don't see why it's worth taking the time to address this.

You overestimate people's understanding of security. Clearly Passpack have had enough customers request the feature or complain about its absence to be worth writing about it.

The customers don't care about the particular method, they just know what they want to accomplish and try to suggest how they think it may work. It's beside the point and somewhat obtuse to go into detail explaining why a particular way doesn't work.

A much better way to respond to this request would be 'Yes! Here's a one time/time limited password generator that will do what you want'.

passpack already provides the ability to generate one-time passwords.

Great, what I'm saying is they should steer their customers towards the solution and not bother refuting inanity.

I think what they want to do is temporarily grant someone else the ability to authenticate using their passpack account, without actually exposing the passwords.

This is, of course, not possible in the general case. You can (sort of) do it for a specific site by changing the password and changing it back when you're done, which is what I ask people to do whenever they want me to poke around in their accounts. That obviously doesn't generalize across sites.

It is 100% possible actually. They are called temporary generated one-use passwords.

That is a feature that must be implemented by the service in question; it's impossible for a password manager to do it in the general case.

Who shares masked passwords? I thought they were just there to keep someone over your shoulder from reading it.

One usecase might be if you have someone over at your house and they need to use your wifi. You might want to be able to let them connect securely without you having to tell them your password.

My suggestion for that would be to change it, either before or after.

This entire idea of 'sharing a masked password' is completely ridiculous.

I've never heard of this, either. It sounds like something that some notion dreamed up by someone who doesn't know anything about how computers or software. I'm not sure why the article needs to go to such length to prove this bizarre idea insecure; offering a method to do what they want that makes sense is probably the best approach.

Um, OK. Or you could just go to Preferences > Security > Saved Passwords (Firefox), or fire up Keychain Access (for Safari/Mac), or ... ?

Yes. This is a big vulnerability on Mac. If someone knows your password (say, to let them in in case of a screensaver when you're not there...) then they can view any saved passwords in Keychain Access with this same password.

I know a lot of people who don't realize this.

That's a feature, not a bug. I use it all the time. It's a password manager, as the admin I should be able to view its data.

None of my linux keychain passwords are the same as my user password. The keychain password is much more difficult and I never re-enter it to get back into my machine (unlike the screensaver password prompt).

You can change your Keychain's password... "Edit > Change password for Keychain "login"..."

when i said 'my linux keychains' i meant ssh-agent and firefox's password repository. neither can have their passwords changed without putting in the password again; the credentials are merely stored in memory.

(so if you could get past the screensaver you could in theory extract the creds from memory, but i don't know of a tool to do this and doing it by hand could be time consuming)

Sure, but I was speaking of OS X. Your Keychain password doesn't have to be the same as your account password.

Oh, I misunderstood; I thought you meant anyone could change the keychain password once they logged into the box (which would be kind of dangerous)

Security breaks there already: If someone knows your password ...

... that doesn't mean they should automatically get to know all your other passwords.

When I'm making online bank transfers, I get prompted for my password for every transfer, even though I'm already logged in - better to double-check the really sensitive stuff, rather than just protect the entry point.

And under OS X you can change your keychain password (independently of login), though yes, you have to do it manually and it isin't "secure" by default.

You can create additional different keychains with different passwords than the login one.

For most people, having a password manager + random-generated passwords are _much_ better than using one simple password for all.

Even more so on Firefox, whatever the platform -- the password store isn't even password-protected by default.

Passpack is one of the more interesting security applications in the cloud -- they actually do client side encryption properly (I work out of the same office as them and talked with their lead developer a few times).

If a third party is able to run arbitrary JavaScript in your browser / on a login page, isn't it already game over?

You've misunderstood the context. This is passwords that are handed over to a third party (but in a "masked" form). It's not your browser you're worried about...it's the browser of the person you handed the password to, without trusting them to actually know the password. Due to numerous methods of figuring out the password anyway, some of which the author documented, this would be an irreparably insecure feature.

how about we don't install any bookmarklet? i don't have any, and i aggressively hate toolbar extensions, being a refugee from the old IE monopoly time.

or how about browsers letting us know whether a bookmarklet is doing something suspicious?

Reply on news.ycombinator.com