Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I understand the utility in having one application remember a bunch of long, randomized passwords, but all you'd need is one well-placed phishing scam or a keylogger and they get all the keys to the kingdom.

Has there been any progress in this area? I want to consider using a password manager but feel incredibly uncomfortable with putting all my eggs in one basket. I could theoretically have multiple managers and only remember 3 long passwords or so (try to diversify the risk), but I feel like that only goes so far.

It is frustrating that the best passwords seem to be exactly the ones that you cannot memorize well. Where do I draw the line?

share|improve this question
8  
If someone has enough access to install a keylogger on your system, you're already hosed. –  Stephen Touset Jun 23 at 19:02
1  
Passphrases are very strong passwords and are not difficult to memorize. –  martinstoeckli Jun 24 at 8:36

7 Answers 7

Password managers introduce different risks, they do not eliminate all risks. It is debatable if a password manager is generally more inherently risky than dozens of memorized passwords. Does the risk of a central password outweigh the risks of having dozens of poorly implemented passwords? It might all depend on the implementation.

Password managers automate the process of creating and 'remembering' unique passwords with maximum complexity, and can automate the renewing of passwords on a regular basis. Not only that, but they can highlight the fact that you are not on the login page for the website you think you are on. All these benefits are difficult to pass up, but you need to ensure that your password manager is properly secured.

You are correct in saying that by putting all your eggs in one basket, you run the risk of wide-spread access. But there are ways to mitigate that risk. For instance, some password managers require 2-factor authentication to access passwords.

"Risky" is always in the eye of the beholder. What is acceptable to one would not be to another. Each person/organization needs to make that determination for themselves.

share|improve this answer
    
Re: automated recreation: Doesn't this also depend on the way the site is built? Sometimes the password-change HTML is different for whatever reason and so the automation would break, would it not? –  user49637 Jun 23 at 18:45
1  
The password manager can alert you when a password has reached a time threshold. They do not change the password for you, but tell you when you need to change it (and then create one for you). You still need to click on the 'change my password' link. –  schroeder Jun 23 at 18:46
    
Do such services cost much? (in general) –  user49637 Jun 23 at 18:47
1  
A risk you always take. But I have never seen a company simply shut its doors one day without any announcement to extract your data. –  schroeder Jun 23 at 18:55
1  
Your concerns seem to revolve around password management as a service provided over the Internet. Most password management applications do not work this way — the software and password database are stored entirely on your own machine (e.g., 1Password, LastPass, KeePass). Combine this with something like Dropbox and you can sync your passwords to any device, without having to worry about a third party going offline and taking your passwords with them. –  Stephen Touset Jun 23 at 19:05

The password manager could be a security hole, but only based on its options and how the end-user uses it. The open source password managers I have used and am familiar with all have options that would foil keyloggers, and definitely would not be phishable. If the options were to be tweaked so that the password DB is auto-opened without two-factor authentication, and also so that auto-logins to everything are on all the time, then merely getting physical access to the workstation would give a hacker the keys (or the ability to copy all keys).

Security is and always has been a team sport. Risks and options must be understood with or without any extra software tools.

share|improve this answer

Are you mistaking a password manager with OpenID? I don't know how you can phish a password manager master password.

Anyways, my password manager is accessed either by app or by browser plugin, and requires MFA from new devices or anywhere outside of the USA.

I guess it depends as always, if your trusted devices aren't secure, then its risky.

Password managers, at least lastpass, is extremely useful against phishing cause even if you don't catch the bogus domain, it will.

share|improve this answer
    
I don't know how all password managers work -- I assume there are managers that hold information online and can be accessed that way, so I figured someone could just send a spoofed email in hopes someone is careless enough to enter in their master pass. –  user49637 Jun 23 at 18:31
    
"Password managers, at least lastpass, is extremely useful against phishing cause even if you don't catch the bogus domain, it will." can you elaborate on this? How does lastpass work here? –  user49637 Jun 23 at 18:32
    
You register your logins to domains like stackexchange.com. When you go to login, the plugin recognizes the domain and provides an easy dropdown control to auto-populate the user/pass. Bogus domains won't have that option. –  Andrew Hoffman Jun 23 at 18:35
1  
And no you'd never access your password vault from an external link, never never. –  Andrew Hoffman Jun 23 at 18:36
    
Just so I understand, let's say I log in to my account on my place-of-employment's website (my corp account), which has its own custom form, etc, whatever. How would I use Lastpass here and how would it be secure? What if I wanted to do it through my Android smartphone? –  user49637 Jun 23 at 18:38

Yes, a password manager is risky but everything you do has risks. Fact is we do need a lot of accounts. So it is wrong to only think what are the risks of doing X. You need to look at your options and choose the option with the risk you like to take.

A typical brain can only remember some passwords. If you don't write your passwords down, you need to use the same password in multiple places or have a easy system to generate passwords for every account. Using the same password again is bad. The systems a human uses to generate are mostly weak because your brain can not do good crypto. In both cases you passwords won't be very secure.

So we are left with the choice to write passwords down or have weak passwords. I would prefer to write them down.

share|improve this answer

You are absolutely right that malware is the most significant threat against password managers.

One option to keep your password manager secure is to put it on your phone. At this point in time, your phone is at somewhat less risk from malware than your laptop.

If you're highly security conscious, you could get a second device (iPod touch?) to use only for password management and nothing else. You don't even turn the wireless on, let alone connect it to the internet. In that case the device is at very low risk from malware.

Many password managers have some anti-malware precautions. For example, with 1password on Windows you can enter your master password at an elevated security prompt. There are also tricks to securely send passwords to applications, such as mixing clipboard and keyboard operations, which can defeat key loggers. These precautions are not watertight, and you should assume that malware on your laptop means a full compromise, but they do defeat a lot of common malware.

Ultimately, as others have pointed out, whatever approach you take to your passwords has some level of risk. I believe that for most people using a password manager is preferable to using the same password everywhere, which seems to be the other common approach.

share|improve this answer

Yes, if someone has access to your computer, he has already installed a keylogger on your computer to stole your passwords. First, set a password to your personal computer, then choose a password to your password manager.

share|improve this answer

[Disclosure: I work for AgileBits, the makers of 1Password]

As has been pointed out nicely by others, password managers are subject to different risks. I obviously feel that using a well designed password manager is a good choice.

I want to address the "eggs in one basket" issue that has been raised. Yes, password managers do put all of your eggs in one basket, and so you should look at how well that basket is protected. But let's look at the same security issue (many eggs in a basket) when not using a password manager.

Password reuse is also putting multiple eggs in a basket

Suppose that Molly (one of my dogs) reuses the the password 1chaseR4bbits for ten different sites and services. (Molly is not a very bright dog.) By doing so each of those ten sites becomes an egg in the same basket. If her password is discovered, all of her accounts on those sites are compromised.

Now let's look at how well that reuse basket is protected. It is vulnerable to her password being captured in transit, it is vulnerable to phishing, it is vulnerable to a breach of any one of the ten sites and services. Indeed, the bigger the basket (the more sites she reuses the password on) the more vulnerable it is.

Quite simply, password reuse is putting multiple eggs in one very poorly protected basket. A good password manager solves the password reuse problem, and gives you a very solid basket.

Miscellany

You listed phishing attacks as a threat to ones Master Password for a password manager. With 1Password, the app runs completely locally, so there is little scope for a phishing attack. There is potentially scope for some locally running program to try to spoof 1Password. We haven't seen anything like that (yet) and so have not enabled counter measures. (Anyone remember site-keys? Yuck!)

You mentioned the difficulty of maintaining even a small number of strong, memorable, type-able passwords. About four years ago, I wrote up advice (see Towards Better Master Passwords) on how to do this for the few passwords you do need to remember. It is advice which still holds today (and was picked up by XKCD) and if followed properly remains strong even if attackers know exactly what system you used.

share|improve this answer

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.