5

Genuinely curious. What types of attack is a password manager (such as Keepass) designed to stop? If a hacker gets access to your system, it's game over anyway, so what is the added value of encrypting one's passwords?

  • If they're encrypted, how is the hacker going to decrypt them, assuming you've not saved the password manager password in a text file? Also, they tend to be capable of generating passwords, which humans aren't that good at... – Matthew Sep 1 '16 at 14:52
  • Any idiot with 1 min access to my computer could open passwords.txt. Any idiot with 1 min access to my computer could not install malware to extract my passwords from the encrypted file a password manager store them in. – Anders Sep 1 '16 at 14:57
  • 4
    Story time: A few years ago, my sister decided to install a peer-to-peer file sharing application on her computer. What she didn't realize is, by default, these programs give everyone else on their network access to your entire C: drive. Upon realizing this, and knowing how many ignorant users probably use this program, I searched for "passwords.txt". I found credentials to everything imaginable: EBay, PayPal, bank account, Facebook, etc. Had they been encrypted, I would had to have guessed the master password. Instead, I was granted immediate access to hundreds of sensitive accounts. – Dan Sep 1 '16 at 15:13
  • 1
    If you need more proof that this is still a huge problem and a terrible idea, I just Googled "passwords.txt" and found this in a matter of 30 seconds: classconnection.s3.amazonaws.com/8dcd59a2/3502418/files/… Don't be like Jenny. – Dan Sep 1 '16 at 15:25
9

With a password manager, your passwords are not stored in plaintext on your computer. In other words, even if a malicious actor gains access to your system they will still not have your passwords.

Password managers also do a good job of helping you create long and complex passwords (vs. smashing on the keys in an Excel document), in the event that the site you are logging into becomes compromised. You can also have different passwords for each site, further reducing your risk. Additionally, you can have a USB key that is required to access those passwords, so when you aren't near your computer you take away the access key. Attackers can brute force all day long, chances are they won't get access to the passwords. This beats a password protected file all day long.

Side note: when doing penetration tests, after gaining internal network access, one of the first things I do is search all shares on the Domain for the string: "Password". I get hits every time :( don't let that be you.

  • 2
    Nowadays with everyone being in the cloud you can just store the password database in the cloud directory and it will be synched over all your devices, always having them with you. This defeats the argument of not be able to access them everywhere. – Yorick de Wid Sep 1 '16 at 15:16
  • 3
    If a malicious actor gains access they can capture your master password with a keylogger then get all your passwords. I agree that a password manager is a good thing, but you shouldn't oversell the benefits. – paj28 Sep 7 '16 at 14:46
  • 1
    @paj28 you're assuming they have more than file-level access and that they can bypass UAC (if enabled) to run a keylogger, and potentially local-admin to install the keylogger. And again, if the user sets up the pw manager such that it needs the USB key to decrypt the db, the master pw still doesn't help the malicious actor. Agreed that it's not a silver bullet, nothing to oversell, it's all about layers ;) – HashHazard Sep 7 '16 at 14:56
  • 1
    "gains access" means remote code execution not file access. Key loggers can work without UAC. As for the USB key, I've not looked at them in detail, but I would be highly surprised if it effectively defends against malware. Layers are good - but not if one layer makes promises that cannot be delivered. – paj28 Sep 7 '16 at 15:07
  • 1
    I don't want to be pedantic and debate the meaning of gaining access; as a pentester, I don't always need RCE to get access to something. But that aside, I think we're all on the same page here. Your point is received. Cheers – HashHazard Sep 7 '16 at 15:39
2

There are different ways of getting access to a system. Consider the following two scenarios.

Scenario 1: your apps are sandboxed, an app is compromised

Let's assume you use a system like Apple OS~X with Mac App Store apps. All your apps are sandboxed. Some apps, like text editors, have a legitimate reason to programmatically access your text documents. If one of those apps is compromised by malware, then the attacker will be able to read your password file.

However, assuming you have a password manager implemented as on Linux, where apps can use inter-process-communication to retrieve exclusively the passwords that they stored themselves, then the compromised app will not be able to extract all your passwords. It will only be able to query (and send to the attacker) passwords that relate to the compromised app itself. And the attacker could steal these when you type them inside the app anyway.

Your attacker would need to (1) break out of the sandbox and (2) either break the encryption of the file where the password manager stores your secrets, or get the password manager itself to run an exploit.

In this scenario, the password manager definitely represents an increase in security. Other attack vectors include things such as abusing virtual input interfaces to install keyloggers. Let's leave these aside for now, and just say that when sandboxed, at least you get to mediate and control which apps use such capabilities.

Scenario 2: no sandboxing, any app is compromised

Your text document is obviously vulnerable to every single app you have. More apps can be used as entry points to your system for the purpose of stealing that file.

Your password manager is barely protected at all. Attackers can trivially modify any aspect of your desktop to install keyloggers, cause you to load additional libraries on your whole user session, maybe even replace the password manager's binary. They might be able to inspect the memory of your running password manager, too, depending on the OS and how it is configured.

The attack is still significantly harder to perform than simply stealing a text file, especially if the exploit being used only allows the attacker to target and extract a single file rather than execute arbitrary code. Thus, the password manager reduces risk for more basic attacks, but not for more advanced ones.

Conclusion

Password managers provide some degree of additional security right now, as they encrypt the content of your passwords file and require attackers to compromise the password manager itself.

However, their true benefits will increase once sandboxing becomes more systematic. It will then become much harder to attack the password manager or the user session itself.

1

In addition to the other answers, an encrypted file is only vulnerable to malware while you are using it. Your passwords can only be stolen while you have it unlocked.

This means they can't be stolen via physical theft of a phone, laptop, tablet, or USB storage. It means they can't be stolen from whatever cloud or network storage is used to sync them. They can't be stolen from discarded hard drives, backups, or devices, even if you don't erase them as thoroughly as you should. If you use an online service instead of a locally managed application, encryption means your passwords can't be stolen by a breach of your provider.

It's true a specialized malware app on your device can defeat any password manager while you actively use it. But it's also true the same malware could steal any passwords you type in, anyway. So it doesn't make you less secure to encrypt your passwords, and it does reduce the attack surface you present, or at least enables convenient behaviors that would be reckless without encryption, such as syncing via cloud storage, or carrying around a copy in your pocket on a thumb drive.

1

In addition, a browser-based password manager will help you avoid phishing attacks, since it will not be fooled by the apparent domain name and simply will not auto-fill the password field in the phishing URL you may inadvertently have clicked!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.