-2

Are there any examples where something goes wrong. For example, say people misused password managers and got hacked or take some loss? If so how?

Basically, I sort of know the typical vulnerabilities of password management (or more likely their users). In particular I am interested in problems that have actually happened.

I wonder if there is any case where people used 1Password or LastPass and got hacked anyway and lost money or something significant.

The hack doesn't have to be the password managers' fault. It could be the users' own fault, which I want to avoid making.

I want to see examples so I can better understand all the vulnerabilities.

What I mainly look for is case where someone with a bitcoin account lost bitcoin even though he used 1Password, AllPass, for example.

Most likely it's the users' own fault. I want to know what sort of faults I need to worry about when I am using password managers.

I am aware that AllPass got hacked, but nobody lost their money because of that.

This includes any points of failure, such as forgetting master passwords. Anything "undesirable" that's not deliberate and not deliberate.

closed as too broad by Rory Alsop Oct 7 '18 at 15:51

Please edit the question to limit it to a specific problem with enough detail to identify an adequate answer. Avoid asking multiple distinct questions at once. See the How to Ask page for help clarifying this question. If this question can be reworded to fit the rules in the help center, please edit the question.

  • I have removed the irrelevant bit about paper copy of passwords, as it is not a vulnerability with a password manager. – Rory Alsop Oct 1 '18 at 18:33
  • It's not. I am asking with vulnerability of USERS of password managers that I need to be aware off. I don't want to lose my money due to MY FAULT. – user4951 Oct 2 '18 at 15:08
  • Actually I don't want to lose money at all. Who cares whose fault is it? – user4951 Oct 2 '18 at 15:38
  • @schroeder's edit makes that much clearer. The problem is that user3382203's answer is now no longer answering the question. He/She has answered regarding vulnerabilities with the password manager, as your initial question seemed to ask. – Rory Alsop Oct 2 '18 at 16:44
  • 1
    @JChang - that makes the question so broad it's not really useful. User error effectively allows anything to happen, flaw in password manager allows extraction of credentials or pivoting an attack through the password manager itself. After that, the possibilities are only constrained by imagination. – Rory Alsop Oct 7 '18 at 8:42
4

In June 2018, ZDNet reported that the password manager OneLogin was hacked, exposing sensitive customer data. A few months prior to this another popular password manager, LastPass, also suffered from a troublesome security issue as this article from the UK Independent describes (LastPass had previously been hacked two years earlier .)

Bottom line: The potential security you gain from using a password manager outweighs any potential security issues on their end.

My personal favorite is 1Password.

PCMag.com awarded both Dashlane and Keeper their Editor's Choice:

The Best Password Managers of 2018

  • 1
    I agree. It's way easier to any user to get hacked than a password manager. I personally use Enpass, and used KeePass too. So use a manager. – ThoriumBR Oct 1 '18 at 18:34
4

These are the threats that I have identified when dealing with password managers.

  • It's a single point of failure. If you forget the master password or it is ever stolen, everything is going to be compromised. You need backups like everything else, but then you need to make sure the backups are at least as secure as everything else, otherwise that will become the weakest link in the chain and an even worse single point of failure.
  • Password managers, like all applications, can have bugs that lead to security vulnerabilities or can be corrupted to add hidden backdoors.
  • Popular password managers, since they are commonly used by a lot of people, can become a specific target even in generic attacks. For example this means that if PopularManager stores all passwords in ~/popularmanagers/passwords.db, it is more likely that malware will be written to check that path (and probably steal the database, etc.). The same is true of phishing and everything that can target a specific popular password manager.
  • Online password managers can be compromised in even more ways, not only by attacking the user or their client, but also by attacking the server or the people that provide the service.

I can't think of any others at the moment. Whether those threats are worth being considered or not, depends on the "threat model", which in turn depends on a few trade-offs. If you decide not to use a password manager to avoid the above threats, you are going to face other specific threats. Today there are just too many passwords to remember, from at least a dozen to about a hundred on average, I would say. Some people as part of their jobs might have to use even more than a hundred passwords. How do deal with this?

  • Use the same password everywhere, or similar passwords based on a pattern. Then this means that the administrator of StackExchange would be able to access all your accounts (since the passwords will be the same or very similar), and the same is true of any attacker that managed to compromise StackExchange, and the same is true of any other service where you have an account.
  • Write them down somewhere. Which means that you will be using some kind of "password manager" anyway. If you write them down on a piece of paper, then that piece of paper will be your "password manager". If you write them in a file on your computer, then that file will be your "password manager". And these "password manager" will face all the threats discussed above, plus more threats depending on how much they suck. For example, if you write passwords on a piece of paper, then what are you going to do when you need to enter a password? You will take out the piece of paper and type it. But if you are in an office (or at home), everyone around you will see where you keep all your passwords. You would have to lock it somewhere, but then you will have to keep the key with your all the time. Plus while you are typing the passwords, everyone could easily glance at the piece of paper (or take a picture) and see your password. Oh, and don't forget the backup of the piece of paper. These are just some examples, just think of all the scenarios and you will realize there are a lot of threats.

As you can see, in most cases, not using a password manager is going to introduce a lot more threats that are hard to mitigate, so that's why password managers are recommended anyway.

Not the answer you're looking for? Browse other questions tagged or ask your own question.