1

I've resisted the idea of password managers for a long time. Bringing together passwords for all your online accounts in one place that is only protected by difficult-to-remember master password doesn't sound like a good idea to me.

However, I've been doing lots of password resets lately. I try to vary my passwords as is recommended but I always forget them. Doing a password reset takes unnecessary time and it is a pain in the butt. So then I thought... why not try a password manager that uses Google's OAuth service instead of a master password? People who gain access to my Gmail account would be able to log into all these accounts anyway, since they can do a password reset.

Of course there are still other risks associated with such a setup. Malware could steal the database and brute force it. Then again typed passwords could be stolen by a keylogger and session cookies could be intercepted as well. A cloud-based password storage solution may introduce even more additional risks. But on the plus side, if I don't have to remember the password I can use much tougher password strings.

What are your thoughts on this idea? Would it be less safe to store my passwords this way in exchange for increased convenience? Are there existing software products out there that authenticate with OAuth instead of a master password? You may want to consider that I already have two-factor authentication turned on for my Google account. I would only use this tool for services that already send password reset e-mails to this Google account.

Improve this question

4 Answers 4

Reset to default
2

It certainly is more convenient. But i doubt it would be more secure.

For one thing, such a setup introduces another point of failure compared to the master password solution. The attack surface would be larger as there would be another target (Google), to compromise instead of just your password manager service. How much more risk this adds depends on how you view Google's security.

Is remembering just ONE highly random password that difficult for you? My online passwords are stored with lastpass. All of them have very random passwords ranging from 18 to 30 characters. I only have to remember ONE 10 character password(which i deem secure enough to withstand bruteforce attacks).

You still have to remember the password of your gmail account, which SHOULD be just as long and random as any password you would consider for your master password. So i don't see any benefits to your scheme at all.

Improve this answer
5
  • Benefit: I won't have to remember a master password. Benefit: to gain access to a password reset-enabled account a hacker currently has to compromise my Google account. If I use the password manager and a hacker tries to get into that account by breaking in to the password manager, they still need to compromise my Google account to get that password. Benefit: Google's OAuth servers might have better protection against force attempts than an offline password manager.
    – Pieter
    Aug 22, 2012 at 10:45
  • 1) The google account password becomes your master password.. 2) Isn't it the same thing if you use a password manager to manage your google account?... 3) If it is an OFFLINE password manager, how does an attacker even start compromising it unless they have access to your computer? If they do.. you have FAR bigger problems.
    – user10211
    Aug 22, 2012 at 10:52
  • 2) I assume you mean using a regular password manager that holds my Google pass. An offline password manager is more susceptible to bruteforce attacks whereas Google can limit the amount of failed login attempts and notify me of suspicious behavior. Besides, Google's 2-factor auth is more secure than merely having a password. 3) Browser exploits, plugin exploits, malware disguised as a useful piece of software and antivirus oversights may all help them to get access to my computer.
    – Pieter
    Aug 22, 2012 at 11:17
  • @Pieter - Lastpass also has the ability to lock an account. There is nothing more secure about using the 2-factor authentication and application specific passwords then simply using a 16-character password for Lastpass.
    – Ramhound
    Aug 22, 2012 at 12:31
  • 2-factor auth requires that the hacker has physical access to the Google Authenticator application on my smartphone. Why wouldn't that make my account more secure?
    – Pieter
    Aug 22, 2012 at 13:51
1

I think your reasoning is sound. You would get much stronger passwords, and if anything, I believe that is worth more than the added risk of using a password vault.

The alternative – being a human password vault – is neither feasible nor very secure (unless your mind is amazing). With passwords getting cracked faster than you can say "John the Ripper", using strong passwords is only getting more and more important.

An alternative to Google Authenticator or Google's Oauth is getting a Yubikey. It works well with LastPass and local password vaults, and lets you set up two-factor authentication for a lot of other things as well, such as OS login, disk encryption, SSH, etc..

Improve this answer
0

It has been proven through a recent compromise by a technology writer that Google, Apple, and Amazon even if they do have better security then a given indivual, there are still ways around even their security controls. This means that even if a criminal did not have your Google's account password they would be able to, access the account and change the password, then be able to access website profile controlled by OAuth. This type of password manager would only be secured if you used the authenticator, even then it would be vulerable to social engineering, because the biggest weakness of a Google account is the fact, Google supoprt personal can actually change the password.

In an instance like LastPass they are unable to change the password, because even if they did, the data which was encrypted with another password would be unable to be read.

In the instance of author's compromise the following happen:

  1. Criminal gained enough information about the user to add a credit card to his Amazon account over the phone.\
  2. Criminal called Amazon back, asking for the password to be reset, and provided the credit card information he just added.
  3. This then allowed the ability to view the last 4-digits of an actual credit card connected to an Apple account.
  4. Criminal called Apple requesting "assistance" and was able to access the iCloud account after providing the last 4-digits from the credit card connected to the account.
  5. Criminal wiped all of the author's devices, and requested a Google Account's password reset, with access to the "backup' email this was sucessful.

I am not really sure the the moral of the story. Its not clear if the Google Authenticator would have stopped the criminal. Google does have Application based passwords that certainly would have stopped the criminal, and an implementation of a password manager that used one of those passwords, would certainly be secure. Of course there wouldn't be really any difference between the current implementation because the old and new password would have to be provided to encrypt the data again.

Improve this answer
1
  • You're talking about Mat Honan, right? From what I gathered they got in by compromising the secondary e-mail address (his @me.com account) that he had configured on his Google account. I enabled Google Authenticator as an additional layer of security and I don't have a secondary e-mail address on file.
    – Pieter
    Aug 22, 2012 at 13:14
-1

Theoretically for security measures you can use another google account for password management recovery, so when account you are normally using is compromised, it's not a total breach.

Improve this answer
1
  • This easily could have been a comment.
    – Ramhound
    Aug 22, 2012 at 12:44

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .