Finding a future-proof password manager

Question

Currently, I am a Windows 10 user who uses Chrome's default password manager and let it autofill in passwords for me.

Apparently, if I were to accidentally execute malware or give someone momentary access to my computer as a Windows user, they could not only scrape all of my Chrome autofill usernames, e-mails, and respective websites, but also easily decrypt all of my passwords to plaintext using the CryptUnprotectData function since all of the information is stored locally in a .db file. Do all offline password managers have this problem?

I assume an online password manager such as LastPass would help prevent this since all of the passwords are stored on the cloud rather than locally, and even if the malware keylogged my master password, it'd still need to pass 2FA to get to my passwords.

Another concern I have is the integrity of the passwords. I am not practicing good security habits right now and tend to use the same few passwords across 30 websites only because I can remember all of them.

If I were to generate a random long-character password for each website using a password manager such as LastPass, how can I be confident that the application will safely store and remember my passwords for the foreseeable future? What is simply stopping the authors from say, randomly shutting down the app in 5 years and then I will have essentially lost all of the passwords to my accounts, having randomly generated them all? Is this an unlikely scenario? And is there a way to safely and securely export all of my passwords in the unlikely event that this happens?

Answer 1

Offline password managers may store your passwords in an encrypted file that can be only decrypted with a "master password". Hence, a malware would need to do one of the following:

• Perform keylogging in order to spy on your master password, then find the password file, decrypt it and parse it
• Read passwords from memory during runtime, when the passwords are already decrypted

This provides you with more security in the sense that such an attack is less likely to be automated. A malware author would need to study intrinsic details about your password manager in order to perform such an attack. I argue that a widespread Windows malware is more likely to go for CryptUnprotectData, instead of targeting a specific password manager.

Regarding availability: Never ever use a password manager without an (encrypted) offline backup capability.

Answer 2

The short answer to your questions is that there is no way to predict the future actions of a company or a team of developers.

The way that you can combat that is to look for a solution that allows you to export your data or use a solution that is not solely in the cloud. What products do that or which ones do it well, is an exercise in market research.

Answer 3

I have been using an encrypted USB flash drive in combination with a portable password manager for several years now. For me, this is a good compromise between security and convenience. However, I am aware that a computer infected with malware cannot provide protection and all passwords accessible there should be considered compromised. At some point the password has to be entered, smart malware can wait for this moment. 2-factor authentication can provide protection in this case. In targeted attacks, however, 2FA can often be bypassed, e.g. by obtaining a reset code, intercepting mTANs or social engineering.

If you don't feel like generating 30 different passwords in your password manager, you should at least make sure that the login data of unimportant services is never identical or a variation of the login data of important services. The classification into important and unimportant services is not always trivial, so I strongly recommend that you generate it all randomly.

External password management services are a popular target because they store the data of many users. I cannot estimate how likely it is that user data will be stolen there at some point or how long such a service will be around. I would trust an offline, open source and audited password manager more than any service on the Internet.

In case LastPass is shut down, you can read here which options you still have to export your passwords. https://lastpass.com/support.php?cmd=showfaq&id=1376

Answer 4

I assume an online password manager such as LastPass would help prevent this since all of the passwords are stored on the cloud rather than locally, and even if the malware keylogged my master password, it'd still need to pass 2FA to get to my passwords.

The attacker would need to pass 2FA if they were trying to access your passwords from another location. But if your computer is infected, the malware (and the attacker) is on your own machine, so it is actually able to access all the data that you can access. Once you have entered your master password and passed 2FA, can you machine access the passwords? Yes. And if your machine is compromised the attacker can access your passwords too. 2FA is only useful to prevent remote access.

A password manager becomes a single point of failure when local malware is involved. This is a problem that I have mentioned several times, but it sounds like nobody cares too much about this issue, probably because there are no viable alternatives yet. To mitigate this threat, the only solution I have found is to use multiple databases with different master passwords (for example, your personal social media accounts are in a different database than your company's FTP accounts). This will soon become pretty complex to manage though: how many databases? What data should each contain? How do you remember or where do you store all the master passwords? I'm still working on a good solution to this, but it's not easy.

If I were to generate a random long-character password for each website using a password manager such as LastPass, how can I be confident that the application will safely store and remember my passwords for the foreseeable future?

You will need to make sure that you can make backups, and that those backups are in a format that is well supported and easy to access. I don't use LastPass, but I just read that you can export the data in CSV files (which should just be ASCII text, so that's extremely future-proof). If you then encrypt that file (and you definitely should), on Linux for example you might choose something like GNU gpg, which is a de-facto standard tool. The bottom line is: avoid proprietary closed formats that might stop being supported unexpectedly and are likely to cause you trouble.