0

Is the Passbolt password manager secure against root access, e.g. if I install Passbolt onto a VPS can it be considered secure or could the VPS host access the passwords stored within it?

2

Full disclosure: I'm one of passbolt developer.

If an attacker has root access to the server they can inject additional javascript to try to perform different type of attack. To our knowledge it is not possible to craft a JavaScript that would allow an attacker to get access to the private key of the end user and/or the passphrase. If you manage to craft this, do get in touch with us at security@passbolt.com.

That being said, it is possible for the attacker to breach the following: - Confidentiality: the attacker can create/edit a user to trick another user into sharing the password with attacker. This could mitigated in the future using key signatures (for example the admin signing all the users keys). - Availability: root access means obviously that all passwords can be deleted / tampered with. - Integrity: idem.

  • 2
    If an attacker has root access, they can do a hell of a lot more than just inject javascript. – forest Dec 18 '17 at 8:04
  • Passbolt is a web based password manager, encryption/decryption is done in the browser extension. (cf. your previous comment mention capturing keystroke on the server, which is not relevant in this case). – Remy Dec 18 '17 at 8:34
  • Oh is it a separate extension, not just client-side encryption? – forest Dec 18 '17 at 8:42
  • OK then, my bad! – forest Dec 18 '17 at 8:46

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.