Hacker News Reader

Comment by bombcar | Hacker News Reader

Someday one of these password managers is going to be hacked wide open and it is NOT going to be pretty.

There were rumors a couple years ago that this already happened to one of them.

My layperson's armchair guess is that a successful attacker would probably seek to keep it quiet.

If you were a bad person, and you got access of tons of credentials from one of the major trust-us password managers, would you:

1. Focus on finding and looting big-payout cryptocurrency stashes, as quietly as you can (so you can keep doing it longer, before news gets out of how)?

2. Sell to a state actor to use for probably high-value purposes, while keeping it quiet?

3. Something else, and would that involve keeping it quiet, or making a big noisy mess?

Most hacks, these days, seem to fall into one of three categories:

1. State actors

2. For profit criminals

3. Teens for lulz and street cred

I guess the first group would probably keep it pretty quiet. The second would keep it quiet until they've abused the data as much as they want to, then sell the remainder on the dark web. The third would make a big noisy mess right away.

Most of them are build without having decrypted passwords or keys for them on server, so attacker would need to get to the point where they can craft malicious update to the client (or exploit the client)

1. Get access to build infrastructure (e.g. via supply chain attack)

2. Inject code in build to export user's passwords to remote server after update is installed

This kind of thing has already happened. Chinese hackers got into the Juniper VPN source code and replaced a key pair with their own. They even updated the tests so that it would pass. This went unnoticed for years.

Arguably it wasn't secure in the first place if it had backdoor like that.

It doesn't have to a backdoor. A malicious employee can have access to the keys.

This is a good point, but on the other hand, couldn't any application be hijacked in the same way to include a keylogger/upload plaintext password DBs stored locally by browsers/etc? Somehow this hasn't happened on a mass scale that I'm aware of.

Not exactly, because the JavaScript code can change and be delivered at ANY time. No code signature verification is involved.

An offline password manager is updated a few times a year, and will go through OS repository distribution, with verification of the signature for changes. Or you can download the software from the source website and check the signature.

Extension has the passwords so just need to suck them through a straw. Getting a keylogger on someones machine probably requires getting them to run an executable or a zero-day exploit.

Worth noting that open-source projects where your password store is saved locally are vulnerable to the same attack.

Simple, but not easy.

Dependency exploit would be the way for 1Password etc, which are now basically wrapped web apps.

even with everything, given the norms of lock files for even the most basic of web apps, you're still at "need to roll out a client update".

Now that's not to say that something can't be sneaked into other work! But the bar is a bit higher than "take over a dependency"

that's what happend to solarwinds, it out worked pretty well for the hackers there

Only web apps have dependencies?

Web apps are potentially re-downloaded every time you use them.

I don't use them, but my conclusion is that at least one major cloud password manager has been hacked already without any disclosure. If they disclose it, the company should logically be dead. Thus, the incentive would just be to cover it up.

Can you elaborate more? Which? Why do you think this? I also agree with you and I think it’s one that rhymes with shome paus werd. But I think it happened early in their “cloud” journey

Are you talking about 1Password? What makes you think that?

No idea what they are talking about, or why they feel the need to withhold information, but a quick search turned up this interesting comment:

https://www.reddit.com/r/1Password/comments/lkfg5p/what_happ...

Meh. There's a zillion other ways for someone to get a password other than a major breach. Random speculation on Reddit doesn't mean jack shit.

Totally agree, this is why I don't trust any of them. Massive targets with extremely strong incentives to stay quiet about security issues.

Thanks to the GDPR a coverup is no longer an option.

How do you figure? If a company never reports an incident, how would the government regulator know about it?

They will at some point. A whistleblower, the attackers themselves, the leaked data showing up somewhere on a forum and getting picked up by reporters, etc. etc. At the scale at which any of the popular passwords managers operate, IMO it would be impossible to keep it a secret for long. So taking the risk of jail time only delaying the inevitable... doesn't make sense.

Sure it’ll result in a lot of issues for minor sites, but most critical services mandate 2FA. So just don’t keep your password and 2FA in these services.

The core problem is really that passwords suck and should never be the entirety of authentication. Time for hardware tokens! (admittedly there are some big problems when people lose tokens, but at least that's not a problem of insecurity ;-))

Depends on how you define "insecurity". Availability is one of the pillars of security, so even your joke falls apart.

Several years ago the trendy thing to do for security was to get a USB-A security dongle and lock your important accounts with it. Nowadays, laptops from several major manufacturers no longer ship with a USB-A port, so if you need to log in again and don't have a USB-C dock handy, you're locked out until you can find one.

Isn't availability usually from the service still being accessible in a technical sense? Password lockout policies will also result in people being locked out often until manual review or the use of some (hopefully secure) second factor. With hardware tokens there just needs to be an established - and efficient - process to replace them or allow access on an ad-hoc basis for exceptional cases (a bit iffy perhaps but also possibly necessary given practicalities). There's no dispute that passwords mean you don't have to worry about things like what USB ports your laptop has, but that's mainly because of the fact they're just strings that you type in which is also their entire issue for phishing/hacking etc.

Either way, availability can be compromised by a hack due to passwords being phished and I think I'd prefer dealing with hardware tokens than the fallout of being phished or otherwise suffering credential compromise. That said at this point I probably wouldn't issue hardware tokens en masse until proper processes are in place to manage them (and their loss/breakage/etc) - it's certainly not solved to my satisfaction yet.

And all those people who called us stupid for critiquing the idea of trusting your logins with a third party will pretend they knew it all along.

That's why for anything important one should use separate MFA, not stored in the password manager.

Reply on news.ycombinator.com