After I unlock my PC the password manager (any type) needs the password again to unlock it's DB containing passwords.

Question: Does the password manager store the passwords/DB in memory when the PC is locked? Or it wipes it from memory?

Regarding https://en.wikipedia.org/wiki/Cold_boot_attack

  • 3
    Depends on the password manager. It's a software specific question. – Matthew Dec 8 '15 at 10:59
  • 1
    And it has nothing to do with cold boot attacks – Stephane Dec 8 '15 at 11:00
  • The attack relies on the data remanence property of DRAM and SRAM to retrieve memory contents that remain readable in the seconds to minutes after power has been removed. -> so why not related to cold boot? – LoukiosValentine79 Dec 8 '15 at 11:05
  • Right. Sorry, I mixed it up. – Stephane Dec 8 '15 at 11:20
  • 1
    Definitely software-specific question as @Matthew says. Some password managers implemented only as a browser extension just remain logged in until you log out, or until a configured timeout (in days) expires. Often these do not make clear what happens between uses. Others like KeePass keep passwords encrypted in memory except for brief periods where they are being used, overwrites them with zeros when not needed at all, and has options to close the database entirely when locking the computer, so it should be less susceptible to this attack. So, which manager(s) are you talking about exactly? – Ben Dec 8 '15 at 16:04

For as long as it is in "unlocked" state, a password manager will need to keep in memory "something" that will grant it access to the secret data.

Depending on the architecture of the password manager, it can be a number of different things:

  • Pure client-side software could keep the whole database (unencrypted) in memory. This is acceptable from a security point of view because the security model of these software is that it will not attempt (too much) to protect against root-level compromise of the computer where they run.
  • Another method for client-side apps is to keep the decryption key in memory and decrypt the relevant data as needed. This is usefull if the secret part of the DB is large: only decrypting the information when needed helps cleaning it up afterward and ensuring it doesn't end up in the swap file (if applicable).
  • An additional approach is to keep the data in memory but encrypted with a session key and decrypted when accessed. This allow for a quick way to "clean" the memory when locking the system (just remove the session key)
  • Distributed apps can keep an access token in memory instead. That access token is then used to retrieve the relevant data from the server. Typically, a second key, which must be kept in memory, is then used for decrypting the result.

In addition, password manager apps can remove all encrypted information from memory under some condition. These conditions can (and usually do as an option) be triggered when you lock your workstation.

In the end, the actual answer depend on what software you use and how you configure it.

  • It seems that anyway the memory will have information that could compromise the secret credentials. If they are encrypted in memory but the password or session_Id is also in memory the result is not safe. Or if you have an access token it seems that an attacker could use it to retrieve data from the server. But without this information you would be forced to retype your password everytime. Not as bad as it seems but less usable. – borjab Jan 8 '16 at 12:00

A password manager that keeps your passwords “in the cloud” gives you the convenience of accessing your passwords from any device, anywhere, at any time – but it means the actual database file isn’t under your direct control. A local store on your laptop or a removable USB drive is less of a target to hackers than a centralised cloud password store.

The risk of using a cloud service isn’t as great as it may seem. Services such as LastPass use SSL for data transfer, in addition to your data being encrypted with 256-bit AES, and have a policy of not receiving private data that isn’t already locked down with your master password . By using local encryption and decryption on your PC, with locally created one-way salted hashes, and making brute-forcing of master passwords all but impossible by utilising a large number of PBKDF2-SHA256 iterations to create them, the number of attack vectors is reduced considerably.

The bigger question is what happens if a cloud service is unavailable – or, worse still, if the provider goes bust? Keeping an off-site backup of your password database, encrypted with an application such as TrueCrypt.

Local clients, with your encrypted database stored on the device(mobiles) from which you’re accessing them, aren’t reliant on third-party balance sheets or network connectivity. Even if the vendor goes out of business, you have the application installed and it still works. So what happens if you lose the phone that stores your local client password manager, or your laptop dies?

so....Many password manager applications combine two features both cloud and stores in personal devices to make for strong protection – namely, the ability to generate random and complex password strings, and the ability to automatically log the user into the service or site using those passwords.

  • 2
    The question isn't cloud vs. local – Stephane Dec 8 '15 at 11:23

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.