3

I sense an overall push towards password safes (cloud/local). Now that people tend to use more and more those technologies I looked for best practices or formal advisories on password safes but did not find anything valuable.

Is there anything published about that? I mean more recommendations than "use a secure master password and do not lose it".

My password safe for instance allows me to use my windows logon as a means of authentication. It also can lock itself after a certain amount of inactivity or when you log-off from your machine, your screen-saver starts, etc. All those features trade security with comfort.

If I have a ~40 char password and decrypting the database takes 2 seconds I might get annoyed by doing this 10 times a day.

KeePass for instance suggest that you encrypt the password file multiple times to increase the work time, but a normal user switching to a password safe won't probably understand the impact of that. Even if such a user would google that he or she would still need to differentiate between hashing something multiple times and encrypting it, etc.

  • 3
    NIST has an expired draft publication, but I'm not aware if there's something which went to final release. See Section 4.3 "Local Password Management" csrc.nist.gov/publications/drafts/800-118/draft-sp800-118.pdf Although you may be looking for something with more specific technical specifications. – mgjk Feb 14 '17 at 17:01
5

Password safes should be used like security vaults, meaning that they should not rely on any other layer for authentication or protection. So using AD to access them is not advised. What if your AD credential is compromised? Other than that, here are my guidelines:

  1. Use a safe that is either known open source or from a reputable, known vendor
  2. Use a pass phrase for authentication that is used nowhere else
  3. Be sure the encryption is applied to the entire safe file, and that it is at least AES 256
  4. Avoid cloud safes if possible (where the safe is provided as a cloud service, even if encrypted with a key they generate for you). There is too much risk with these new services. But it's ok to store your key file in the cloud as long as your client software encrypts/decrypts it (this is why Apple keychain is ok too)
  5. If you're trying to do this for multiple users in an enterprise (for root/admin passwords, for example), use an enterprise vault solution like Cyber Ark, not password safe software; Then also be sure to enable the multi-factor authentication that they all provide (to avoid the AD compromise issue above).

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.