Hacker News Reader

Comment by aargh_aargh | Hacker News Reader

Good point, wondering the same thing. I'm considering starting using a password manager, but my bigest concern is that malware can capture the passwords by listening to clipboard. The model in my head on Windows from programming using WIN32 API two decades ago is that any application can read clipboard contents as often as it wants to. Assuming the malware does that in a tight loop, how can password managers be secure at all? I imagine X Window System is no better in this respect. Has anyone given this any thought? Are my concerns unfounded?

View on HN

Your concerns aren't unfounded, but they're a bit misplaced. Password managers aren't intended to protect you from a local attacker, on your machine, like the malware you described. It is trivial to capture clipboard contents, as you say, but it's also similarly easy to keylog so your passwords would be exposed either way. If you consider your computer compromised or antagonistic like this, don't use it for anything sensitive.

Password managers are mostly intended to help facilitate unique passwords per account, to avoid password re-use which prevents credential stuffing. That is, if an attacker gets a hold of your password from one website they can't use it to log in everywhere.

Back to your concern, there isn't a solution for Windows in this space at the moment. Malware that's alive in your user context (or Satya forbid, SYSTEM) can do quite a bit thanks to Win32 APIs.

I solved this problem by using Qubes OS, with isolated VMs for everything and inter-VM secure text copy. The passwords are stored in plain text in an offline VM, no password manager is necessary (but you still can use it if you like).

This is still a concern. I do malware analysis for a living and most windows malware these days that steal clipboard data simply hook the windows APIs and grab a copy of everything in there.

Thanks. What would be your recommendation regarding password managers? Does using a password manager's browser extension (assuming it has one) help here or does that also use clipboard? I guess I'm damned either way because I'm gradually migrating to using generated passwords which I copy via clipboard anyway.

Wouldn't such malware also have the ability to inject itself into the password manager and read the secrets from its memory?

Reply on news.ycombinator.com