30

I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home desktop PC. Are there any reasons this is a bad idea security wise?

  • 34
    Well for starters anyone who gets physical access can just press the macro keys and get your passwords. Also if the macros are programmed/readable from the computer then remote attackers can read them out of it. – user Dec 3 at 14:31
  • 40
    Why use keyboard macros when you can just configure KeePass to basically do the same but securely? – Giacomo Alzetta Dec 4 at 7:43
  • 7
    Not to mention that if your keyboard dies or is stolen, you lose all your passwords. Availability is a component of security. – chrylis -on strike- Dec 4 at 8:09
  • 12
    @chrylis-onstrike- Keyboard macros are typically implemented in software. I'm not aware of any keyboards which store such macros in hardware. That would change things considerably. – forest Dec 4 at 8:34
  • 7
    @forest there are some instances where the macro is recorded and stored on the actual keyboard. Not too common, though but they exist. – VLAZ Dec 4 at 14:56
103

This is a bad idea.

As user mentioned in a comment, anyone with physical access can just press the assigned macro key and the password will be revealed.

You also have a high chance of accidentally pressing the macro key, thus typing in your password in places where you didn't mean to.

The macro data also needs to be stored somewhere, and is likely stored in plain text. As such, storing your password in a macro is akin to storing it in a plain text file.

Instead, use a password manager. An offline password manager allows you to store your passwords in an encrypted form, protected by a master password. Many offline password managers also include functionality to write your password for you, just like a macro, except that this is much safer.

  • 3
    While a password manager would be better, I don't see how this is particularly bad. A remote attacker would need to know that you're storing passwords in your macros and how those macros are stored on your machine in addition to compromising your machine in another way to exploit this. Or, they'd need physical access (which is game over anyway). Unless the OP's a specific target, I don't see this raising their risk in any meaningful way. – Carl Kevinson Dec 4 at 14:41
  • 9
    @CarlKevinson I'd argue the risk is losing the macro. Through whatever means - drive failure, or keyboard breaks (assuming it's stored on the keyboard itself), or maybe just somebody mindlessly deleting the file. Now you're locked out of your account(s) which is an inconvenience. So, it's similar to using a password manager (let's disregard the security of storage as a factor) but worse, since the availability goes down. – VLAZ Dec 4 at 14:55
  • 12
    @CarlKevinson "An attacker would have to know" is not in accordance with Kerkhoff's Principle. A system must be secure even under the assumption that the attacker knows everything about it. – MechMK1 Dec 4 at 17:10
  • 10
    The chance of "accidentally pressing the macro key" has happened to me once or twice when focus is on a Skype window instead of my ssh session! – Mark Stewart Dec 4 at 22:25
  • 2
    @MechMK1 Kerkhoff's Principle does not apply - we're not designing a crypto system. – MooseBoys Dec 5 at 5:00

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.