Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password doesn't sound like a good idea to me.

However, I've been doing lots of password resets lately. I try to vary my passwords as is recommended but I always forget them. Doing a password reset takes unnecessary time and it is a pain in the butt. So then I thought... why not try a password manager that uses Google's OAuth service instead of a master password? People who gain access to my Gmail account would be able to log into all these accounts anyway, since they can do a password reset.

Of course there are still other risks associated with such a setup. Malware could steal the database and brute force it. Then again typed passwords could be stolen by a keylogger and session cookies could be intercepted as well. A cloud-based password storage solution may introduce even more additional risks. But on the plus side, if I don't have to remember the password I can use much tougher password strings.

What are your thoughts on this idea? Would it be less safe to store my passwords this way in exchange for increased convenience? Are there existing software products out there that authenticate with OAuth instead of a master password? You may want to consider that I already have two-factor authentication turned on for my Google account. I would only use this tool for services that already send password reset e-mails to this Google account.

share|improve this question

4 Answers 4

up vote 2 down vote accepted

It certainly is more convenient. But i doubt it would be more secure.

For one thing, such a setup introduces another point of failure compared to the master password solution. The attack surface would be larger as there would be another target (Google), to compromise instead of just your password manager service. How much more risk this adds depends on how you view Google's security.

Is remembering just ONE highly random password that difficult for you? My online passwords are stored with lastpass. All of them have very random passwords ranging from 18 to 30 characters. I only have to remember ONE 10 character password(which i deem secure enough to withstand bruteforce attacks).

You still have to remember the password of your gmail account, which SHOULD be just as long and random as any password you would consider for your master password. So i don't see any benefits to your scheme at all.

share|improve this answer
    
Benefit: I won't have to remember a master password. Benefit: to gain access to a password reset-enabled account a hacker currently has to compromise my Google account. If I use the password manager and a hacker tries to get into that account by breaking in to the password manager, they still need to compromise my Google account to get that password. Benefit: Google's OAuth servers might have better protection against force attempts than an offline password manager. –  Pieter Aug 22 '12 at 10:45
    
1) The google account password becomes your master password.. 2) Isn't it the same thing if you use a password manager to manage your google account?... 3) If it is an OFFLINE password manager, how does an attacker even start compromising it unless they have access to your computer? If they do.. you have FAR bigger problems. –  Terry Chia Aug 22 '12 at 10:52
    
2) I assume you mean using a regular password manager that holds my Google pass. An offline password manager is more susceptible to bruteforce attacks whereas Google can limit the amount of failed login attempts and notify me of suspicious behavior. Besides, Google's 2-factor auth is more secure than merely having a password. 3) Browser exploits, plugin exploits, malware disguised as a useful piece of software and antivirus oversights may all help them to get access to my computer. –  Pieter Aug 22 '12 at 11:17
    
@Pieter - Lastpass also has the ability to lock an account. There is nothing more secure about using the 2-factor authentication and application specific passwords then simply using a 16-character password for Lastpass. –  Ramhound Aug 22 '12 at 12:31
    
2-factor auth requires that the hacker has physical access to the Google Authenticator application on my smartphone. Why wouldn't that make my account more secure? –  Pieter Aug 22 '12 at 13:51

I think your reasoning is sound. You would get much stronger passwords, and if anything, I believe that is worth more than the added risk of using a password vault.

The alternative – being a human password vault – is neither feasible nor very secure (unless your mind is amazing). With passwords getting cracked faster than you can say "John the Ripper", using strong passwords is only getting more and more important.

An alternative to Google Authenticator or Google's Oauth is getting a Yubikey. It works well with LastPass and local password vaults, and lets you set up two-factor authentication for a lot of other things as well, such as OS login, disk encryption, SSH, etc..

share|improve this answer

It has been proven through a recent compromise by a technology writer that Google, Apple, and Amazon even if they do have better security then a given indivual, there are still ways around even their security controls. This means that even if a criminal did not have your Google's account password they would be able to, access the account and change the password, then be able to access website profile controlled by OAuth. This type of password manager would only be secured if you used the authenticator, even then it would be vulerable to social engineering, because the biggest weakness of a Google account is the fact, Google supoprt personal can actually change the password.

In an instance like LastPass they are unable to change the password, because even if they did, the data which was encrypted with another password would be unable to be read.

In the instance of author's compromise the following happen:

  1. Criminal gained enough information about the user to add a credit card to his Amazon account over the phone.\
  2. Criminal called Amazon back, asking for the password to be reset, and provided the credit card information he just added.
  3. This then allowed the ability to view the last 4-digits of an actual credit card connected to an Apple account.
  4. Criminal called Apple requesting "assistance" and was able to access the iCloud account after providing the last 4-digits from the credit card connected to the account.
  5. Criminal wiped all of the author's devices, and requested a Google Account's password reset, with access to the "backup' email this was sucessful.

I am not really sure the the moral of the story. Its not clear if the Google Authenticator would have stopped the criminal. Google does have Application based passwords that certainly would have stopped the criminal, and an implementation of a password manager that used one of those passwords, would certainly be secure. Of course there wouldn't be really any difference between the current implementation because the old and new password would have to be provided to encrypt the data again.

share|improve this answer
    
You're talking about Mat Honan, right? From what I gathered they got in by compromising the secondary e-mail address (his @me.com account) that he had configured on his Google account. I enabled Google Authenticator as an additional layer of security and I don't have a secondary e-mail address on file. –  Pieter Aug 22 '12 at 13:14

Theoretically for security measures you can use another google account for password management recovery, so when account you are normally using is compromised, it's not a total breach.

share|improve this answer
    
This easily could have been a comment. –  Ramhound Aug 22 '12 at 12:44

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.