Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I use LastPass to store and use my passwords, so I do not have duplicate passwords even if I have to register four to five different accounts a day, and the passwords are long.

How safe are password manager services like LastPass? Don't they create a single point of failure? They are very attractive services for hackers. How can I trust the people behind these services and their security mechanisms? I imagine that a third party (government, company, etc.) would be very easy to 'bribe' and get all of my passwords.

Are there any other solutions that offer similar services with similar ease of use?

share|improve this question
4  
One important point that it may be useful for you to know is that, at least in some cases, the operators of password managers don't have access to your passwords themselves. They use the credentials you provide to create a decryption key for the passwords, so without your password, they can't see them, unless of course, they lied about how they do things. –  Owen Nov 9 '13 at 19:36

9 Answers 9

up vote 38 down vote accepted

We should distinguish between offline password managers (like Password Safe) and online password managers (like Last Pass).

Offline password managers carry relatively little risk. It is true that the saved passwords are a single point of failure. But then, your computer is a single point of failure too. The most likely cause of a breach is getting malware on your computer. Without a password manager, malware can quietly sit and capture all the passwords you use. With a password manager, it's slightly worse, because once the malware has captured the master password, it gets all your passwords. But then, who cares about the ones you never use? It is theoretically possible that the password manager could be trojaned, or have a back door - but this is true with any software. I feel comfortable trusting widely used password managers, like Password Safe.

Online password managers have the significant benefit that your passwords are available on anyone's computer, but they also carry somewhat more risk. Partly that the online database could be breached (whether by hacking, court order, malicious insider, etc.) Also because Last Pass integrates with browsers, it has a larger attack surface, so there could be technical vulnerabilities (which are unlikely with a standalone app like Password Safe).

Now, for most people these risks are acceptable, and I would suggest that the approach of using Last Pass for most of your passwords is better than using the same password everywhere - which seems to be the main alternative. But I wouldn't store every password in there; make an effort to memorise your most important ones, like online banking.

I know someone who won't use Password Safe and instead has a physical notebook with his passwords in obfuscated form. This notebook is obviously much safer against malware... whether it's at greater risk of loss/theft is an interesting question.

share|improve this answer
    
i like your writing and the cohesion of your answer. Obv i dont use last pass for bank passwords. Your answer completely covers my question : how much trust to actually put in these programs –  blended Nov 8 '13 at 17:30
1  
Check out this answer here: security.stackexchange.com/questions/45066/… @tylerl explains an overlooked security advantage of online, cloud-based password managers. –  Cory J Nov 8 '13 at 17:31
2  
The advantage talked about has nothing to do with online, cloud-based password managers. The important feature is a password manager with a browser plugin. –  Stephen Touset Nov 8 '13 at 21:01
5  
I think it is worth mentioning that LastPass (and others?) encrypts and decrypts your password vault on your local machine. The important implications of that are that 1) your master password is never sent over the wire, and 2) the service provider only has access to your encrypted vault. –  HDave Feb 19 at 15:35
1  
Once you have client side malware isn't the game lost anyways? Assuming it isn't intrusive it will eventually capture all data that is of import regardless of using a password manager or not. –  Erick Sep 11 at 15:45

[Disclosure: I work for AgileBits, the makers of 1Password. As it would be inappropriate for me to comment on the security architecture of competitors, I will address things in general, and talk specifically only about 1Password.]

Yes. Password managers create a single point of failure. You are keeping all of your eggs in one basket. I, obviously, think that a well-designed password manager is the right choice. But ultimately it is a choice that each individual needs to make for themselves.

It is extremely important to look at how that basket is protected. With 1Password you can read the details of how the data is stored. Although we make heavy use of PBKDF2, it is very important that people choose a good master password. The only confirmed case of a 1Password data breach that I've seen is when someone used the same master password as she used for her unencrypted POP3/HTTP Road Runner email. The same password was also used for her Dropbox account, which was also taken over and is how we presume the attacker obtained the 1Password data.

As for trusting the people behind a password manager, that is a trickier question. I do think that it is safe to say that anyone who is has been in the password management business for a while wouldn't risk trying to make an extra buck off of banking credentials or credit cards. Even if we were crooks at heart, that would just be bad business, as the mere suspicion of such a scheme would put the vendor out of business. Stolen credit card details sell for little more than one USD each when purchased in bulk on black markets. Banking credentials are about five times as much. The math just doesn't work for anyone whose livelihood comes from selling password management tools.

As as already been mentioned, in some schemes the data never goes to the vendor in any format. This is true of 1Password. We never see how anyone is using 1Password. However, to synchronize data across systems, we do rely on third party synching systems. So your encrypted data may be stolen from Dropbox as well as be stolen from your own computer if you use Dropbox to sync data. You should always assume that there is a non-negligible possibility that your encrypted data will be captured. This then goes back to how well your data is encrypted, which is something to look at carefully.

The other questions about trusting the suppliers of the password management system come down to trusting our competence and trusting that we haven't been coerced/bribed/"persuaded" to allow for a back door into the system. This is a lot more complicated. How do the vendors deal with security bugs as they are discovered? How much of the product's behavior and design is independently verifiable? Do the creators understand the crypto that they are using?

For systems, like 1Password, that don't have any data from users, there is very little reason for us to even be approached by government agencies (and we haven't been.) At the same time, you should assume that governments do have access to your data stored on sync systems. So again, this comes back to the question of how that data is encrypted.

share|improve this answer

Jeffery's answer is particularly insightful - the main risk is all around the economics. One of the biggest threats may be for failing password managers (those not making enough money for their author). A malicious actor can 'rescue' the developer by buying the product, and changing the program to send data to themselves (perhaps in a hard-to-detect fashion). So it's probably important to ensure the password manager you use appears to be financially successful for it's author.

I recently became uneasy about the password manager app which I had been using for a long time (and previously paid for). Development seemed to have largely stopped, the app became free (a big red flag in my opinion) and ownership may have changed hands. I've switched to another app, but it's hard to know if my data was compromised.

share|improve this answer

Some services like this offer cloud "convenience" and others do not. If you're allowing your passwords to be stored to the cloud then you are putting more trust in the application, as there is a single source of attack to retrieving data representing all users' stored passwords. Assuming these passwords are encrypted uniquely for each user then the risk might be mitigated, but regardless of how much mitigation there, is, this remains a single attack point.

Contrast with applications that only store passwords locally (or enable you to migrate your database manually). Here, your effort level might be greater, but the attack point is on a machine you presumably have more control over and it's a much less interesting attack point since it only has your passwords. That doesn't immunize you completely of course; a trojan horse could certainly be written to seek these out and send them elsewhere.

The bottom line is you have to decide where you want to trade off security for convenience, but it's certainly a trade off in most (if not all) cases. My own take on the situation is that if I didn't write the application, I don't know what it's doing and I'm that much less likely to trust it.

share|improve this answer

Here are some papers that you might be interested in:

  • "Password Managers: Risks, Pitfalls, and Improvements" (2014)

Abstract:

We study the security of popular password managers and their policies on automatically filling in passwords in web pages. We examine browser built-in password managers, mobile password managers, and 3rd party managers. We show that there are significant differences in autofill policies among password managers. Many autofill policies can lead to disastrous consequences where a remote network attacker can extract multiple passwords from the user's password manager without any interaction with the user. We experiment with these attacks and with techniques to enhance the security of password managers. We show that our enhancements can be adopted by existing managers.

  • "Vulnerability and Risk Analysis of Two Commercial Browser and Cloud Based Password Managers" (2013)

Abstract:

Web users are confronted with the daunting challenges of managing more and more passwords to protect their valuable assets on different online services. Password manager is one of the most popular solutions designed to address such challenges by saving users' passwords and later auto-filling the login forms on behalf of users. All the major browser vendors have provided password manager as a built-in feature; third-party vendors have also provided many password managers. In this paper, we analyze the security of two very popular commercial password managers: LastPass and RoboForm. Both of them are Browser and Cloud based Password Managers (BCPMs), and both of them have millions of active users worldwide. We investigate the security design and implementation of these two BCPMs with the focus on their underlying cryptographic mechanisms. We identify several critical, high, and medium risk level vulnerabilities that could be exploited by different types of attackers to break the security of these two BCPMs. Moreover, we provide some general suggestions to help improve the security design of these and similar BCPMs. We hope our analysis and suggestions could also be valuable to other cloud-based data security products and research.

Paper download locations and some other related papers are detailed at https://www.wilderssecurity.com/threads/password-manager-security-papers.365724/, a forum thread that I created.

share|improve this answer

I've found the OSX Keychain an ideal place to keep passwords and related info. Even more so with the new IOS & iCloud integration. For me it is an acceptable balance of convenience, availability and safety.

I do wish Apple was more transparent on the inner workings so I wouldn't have to base my evaluations completely on third-party reverse engineering; but then again, I'd feel the same way if the only info available was from Apple as well.

share|improve this answer

I think there are easier methods of hacking your passwords than to try to breach LastPass's encryption. For example keyboard logging. If you really think that your credentials are in danger or being hacked, you should use a clean linux computer. Choose a really hard password (24 characters?).

share|improve this answer
1  
As a Q&A website, we require the answer to be here, where you posted it as such. If it helps reaffirm the point you're making, quoting short excerpts is OK, assuming the source permits that, and you clearly mark extracted materials in blockquote, attribute its authors and provide a link where available, but the main points you're trying to make should be here, preferably written in your own words and explaining how those external materials help answer the question. More is explained in About, Help center and in particular How to Answer. Thanks! –  TildalWave Apr 11 at 11:36
    
I've edited out the “go read this article” part which is basically spam. Your second paragraph is a valid point, which can stay. You may want to edit your answer to explain the points in the article (in your own words, unless you have the author's permission to quote it). If you do that, it's perfectly fine to include the link (which does look relevant to the question) as a reference for further information. –  Gilles Apr 11 at 11:55

The requirement is for an offline access of credentials. For example a small notebook on which you write all your security details for all banks, stores, websites, even combination locks, addresses and all other details you may wish to be able to access from any location in the world.

Online access of credentials is OK but not perfect, since you will need to be near a PC connected to the internet before you can access any of your details.

Online systems also pose the risk for hackers, governments, and individual employees of the gatekeeper companies stealing the data or making it unavailable when you need it. Read on "silk road" for examples of repeated and persistent loss of personal information.

A better solution would be a hardware device that you carry with you, like a tiny USB stick, which has some simple software to store and encrypt your information as well as retrieve it when you plug it in a PC or Mac. Ideally it would have bluetooth to be able to be accessed on your mobile phone. It might need some tiny battery for that. And if you are not near any computer / mobile phone and you still need access to the stored data, then maybe it would come with a small LCD screen, like those RSA security key fobs - a small display that could use to access information. The whole thing need not be larger than a credit card, or a Zippo lighter. And it could also have a removable micro SD card that could contain a backup of all your info (encrypted of course) so that you would not suffer a complete data loss if you lost the physical device.

That is in my opinion the best solution. (1) accessible anywhere with or without PC and Internet access (2) data stored completely locally with no third parties anywhere to pose a security risk and dependence.

Another approach is email. Most of us have yahoo or google emails or some other online email. And we have thousands of emails stored on the yahoo servers which contain tons of personal information, including addresses, phone numbers, account details and even passwords. This right there is a huge repository of personal information, it is online, it is available on anyone's PC through a simple browser, even on your smartphone. And for the most sensitive data you could devise a personal method of encryption so although the email is clear text, the data is encrypted somehow, only known to you.

share|improve this answer

Are your passwords really safe?

I have used Lastpass, and I always wonder how we can be sure that they don't send our master password along with the database to their servers. They could even set the client to poll the server and do this for specific users only, to prevent discovery. This concerns the NSA and Patriot Act of course, or other agencies that can force companies to do something like this and keep it a secret.

Forget about the NSA

For me, keeping everything secure from the agencies is something different than keeping my logins secret. I would like to keep everything secret from them, but they simply have so much and different resources and manpower that I can only make an effort. If they target me specifically, I'm probably lost. They can hack my home router, my phone, my laptop, install key loggers etc and I wouldn't have a clue. Agencies that have legal power (even if we don't agree with them or if they are from other countries) will be difficult to stop.

So simply forget about the NSA and GCHQ etc - because it won't get us normal people anywhere. Well... forget about it in this context.

Lastpass or Keepass or ...?

If Lastpass would upload our passwords by default, and if this was to be discovered, they would be in big trouble. I've used Lastpass for about a year, but stopped because of the way it interacts with the browser. I don't like the intrusive methods to insert dropdown menus into web forms, and it slowed down my browser. When I used Lastpass I used it for all those trivial forums where it didn't matter much if I lost the password or the login. For the more serious passwords I use Keepass.

I use Keepass and have done so for years. Is Keepass safe? It's offline! But do you know for sure that it never sends out data? I use it for logins to websites like Amazon, Apple, ISP, Paypal, big shops - in short: those websites that have my credit card number.

Some passwords I memorize and don't keep anywhere except in my mind.

share|improve this answer
    
It is very important to make it difficult for the NSA to do easy bulk data collection. Of course they can target specific individuals using special hacks, but if you're making it too easy for them by simply forgetting about them, you're not doing enough. Thwarting their bulk efforts goes a long way. –  A-B-B Jun 16 at 3:34

protected by Community Jul 10 at 10:53

Thank you for your interest in this question. Because it has attracted low-quality answers, posting an answer now requires 10 reputation on this site.

Would you like to answer one of these unanswered questions instead?

Not the answer you're looking for? Browse other questions tagged or ask your own question.