25

I'm a Lastpass user and many times I thought about switching to the Credential Manager, for auto sync and a certain comfort with the windows environment. The only thing that I'm worried about is its security. I heard that it's quite easy for someone to access these credentials once they've gained access to your computer, is it so?

Should I stick with Lastpass and maybe check in future for eventual improvements?

Improve this question
4
  • 2
    I can tell you that any elevated process can simply fetch your credentials in the store and get them back in plain text. That's about all I can confidently contribute.
    – user7933
    Commented Apr 7, 2016 at 14:03
  • 2
    @TechnikEmpire wow well.. better stay far far away from it then
    – user106781
    Commented Apr 7, 2016 at 15:19
  • 2
    Indeed. Even still with Windows 10 official universal app documentation, they promote the store as a secure place. It's only "secure" if you trust the users machine and every single process that will ever run on it. In fact there's even a C# library that makes you able to get the plain text values in 10 lines of code or less. The only way I'd use this is if I stored a pre-hashed version of the password instead of the actual password and I only needed to verify the hash locally.
    – user7933
    Commented Apr 7, 2016 at 16:19
  • I put it into an answer, because nobody else did. :)
    – user7933
    Commented Apr 9, 2016 at 18:10

2 Answers 2

Reset to default
25

The Windows Credential Manager is anything but secure. It's "secure" at the user account level, which means that any process that the user ever runs and the user themselves must necessarily be trusted in order to call this system "secure" with a straight face.

The only semi secure way of using the Windows Credential Manager is to store values pre-hashed, then verify those hashes. However, since any elevated process the user runs has full read/write capability on that user's credential store, it simply can't be trusted at all.

Lets think about "secure" in the sense of locking an application locally. Let's take the example of a content filter that locks the settings page to keep the kids from enabling adult content, using the Credential Manager to store custom credentials. The same user, trying to bypass this, can do so easily. A user can visit the Credential Manager in the Control Panel and, though the values show up in asterisks, (*****), they can simply erase the value and replace it. Delete your hash, put in their own they're in.

What's even sillier is that the Control Panel will show asterisks, but if you use code accessing the applicable APIs, you can get the values in plain text. So passwords are not safe, hashes and such you verify to lock something are not safe. It's not safe, it's a piece of garbage and I've struggled for a long time to understand its usefulness, except for Microsoft to apparently have plain text copies of all of your passwords they can sell to the NSA.

Note
I realize there are measures you can take to encrypt contents before storing them, hashing them correctly etc, but my criticism still applies because doing these additional things is creating security, not the Windows Credential Manager. My problem with the Windows Credential Manager is that it advertises that using it through its provided GUI and or API is secure.

Improve this answer
5
  • 8
    You don't need to roll your own protection when using the Credential Manager. Applications should use DPAPI's "additional entropy" parameter when storing secure data such as passwords. This additional entropy is basically a string or master password which should not be stored anywhere. The user must enter this password within the application so that the application can retrieve the decrypted data. Such data in the Credential Manager is secure from rogue processes except key loggers or low level compromise. It's shocking that Internet Explorer doesn't use a master password / additional entropy.
    – Monstieur
    Commented Aug 1, 2016 at 16:34
  • What's even worse is that Outlook is still using Credential Manager under Generic Credentials if the user opts to remember their login.
    – alans
    Commented Jan 19, 2018 at 18:58
  • 3
    your answer is not backed with facts, it is written subjectively (with a straight face, etc). User A can access credentials for user A but not for user B. The content of the vault is encrypted but the master keys are supposedly possible to extract when looking at a better answer for a similar question: security.stackexchange.com/a/177686
    – Yepeekai
    Commented Jul 8, 2019 at 17:34
  • 3
    en.wikipedia.org/wiki/Data_Protection_API Everything is encrypted. The security is as good as your account password.
    – Yepeekai
    Commented Jul 8, 2019 at 17:51
  • 3
    I agree with Yepeekai. If you run an app with elevated privileges it can also install a key logger, malware, erase your entire PC, encrypt your data for ransom, etc. Do not run any app you don't 100% trust as admin. EVER. If you need to run random apps as admin, do it securely inside a VM or container where the app would then have to jump out of the VM to steal your passwords.
    – Brian D.
    Commented Jul 24, 2019 at 15:12
8

I heard that it's quite easy for someone to access these credentials once they've gained access to your computer, is it so?

It is not so.

Passwords stored in your credential vault are (ultimately) encrypted with your Windows password. In order to access the encrypted credentials, they need to know your password.

  • if someone knows your LastPass password, they can access your stored encrypted passwords
  • if someone knows your Windows password, they can access your stored encrypted passwords

But if someone has gained access to your computer:

  • they cannot access your LastPass passwords (because they're encrypted)
  • they cannot access your Vault passwords (because they're encrypted)

How to access someone's Windows or LastPass encrypted passwords

  • Step 1: Decrypt their passwords
  • Step 2: Access their decrypted passwords

Bonus Reading

Technical details inside the Data Protection API 🕗

Improve this answer
7
  • The issue with Windows Credential Manager is that any app you run can access all your secrets. So the trick is making these secrets unusable without extra entropy (like user input). The advantage of a password manager like LastPass is that you only authenticate with Windows once, but you authenticate with a password manager every time you need to get data from it so your information cannot be just "read" by a malicious application.
    – Şafak Gür
    Commented Feb 9 at 16:45
  • LastPass has the same feature: any application is allowed to access the LastPass secrets once the LastPass vault is unlocked. But that is knowlege usually reserved for Stackoverflow (rather than security). But the user enters the the password that can decrypt passwords, the user is then allowed to read the secrets; whether the user does that through LastPass.exe, MyLineOfBusinessApp.exe, or MaliciousBotnetFBI.exe. It's also important to note that this is not a security vulnerability; neither on the part of LastPass, or Chrome, or Edge, or Safari, or FireFox, or Windows.
    – Ian Boyd
    Commented Feb 9 at 22:29
  • It's not a vulnerability of Windows, but I consider secrets in an always-unlocked store (I need to be logged in to use my computer) to be relatively more at risk than secrets in a store that gets unlocked on-demand (I unlock Bitwarden, copy a password, lock it again). This feature gives these password managers a second factor of authentication on top of what the Windows account login provides.
    – Şafak Gür
    Commented Feb 11 at 4:32
  • Just to be clear, I'm not saying this makes Windows Credential Manager insecure for its purpose. I'm just saying that the OPs assumption ("it's quite easy for someone to access these credentials once they've gained access to your computer") is true. If you have access to someone's unlocked computer, or if you can get them to run an app (and it doesn't even have to run as admin), you can read things in Windows Credential Manager, while a third party password manager would have an additional layer of authentication you need to pass.
    – Şafak Gür
    Commented Feb 11 at 4:32
  • The assertion "it's quite easy for someone to access these credentials once they've gained access to your computer" is false. I can hand you my computer, and you cannot recover my encrypted passwords, because they're encrypted. You need my [Windows|LastPass] password to decrypt them. If you hand me your [Windows|LastPass] password, or i get you to run my malicous application and then you unlock your [Windows|LastPass], i can access your passwords. That is the virtue of [Windows|LastPass]. It's also the curse: once my [Windows|LastPass] passwords are unlocked, i can access them.
    – Ian Boyd
    Commented Feb 11 at 16:49

You must log in to answer this question.