31

I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home desktop PC. Are there any reasons this is a bad idea security wise?

12
  • 34
    Well for starters anyone who gets physical access can just press the macro keys and get your passwords. Also if the macros are programmed/readable from the computer then remote attackers can read them out of it.
    – user
    Dec 3, 2019 at 14:31
  • 40
    Why use keyboard macros when you can just configure KeePass to basically do the same but securely? Dec 4, 2019 at 7:43
  • 7
    Not to mention that if your keyboard dies or is stolen, you lose all your passwords. Availability is a component of security. Dec 4, 2019 at 8:09
  • 12
    @chrylis-onstrike- Keyboard macros are typically implemented in software. I'm not aware of any keyboards which store such macros in hardware. That would change things considerably.
    – forest
    Dec 4, 2019 at 8:34
  • 9
    @forest there are some instances where the macro is recorded and stored on the actual keyboard. Not too common, though but they exist.
    – VLAZ
    Dec 4, 2019 at 14:56

2 Answers 2

106

This is a bad idea.

As user mentioned in a comment, anyone with physical access can just press the assigned macro key and the password will be revealed.

You also have a high chance of accidentally pressing the macro key, thus typing in your password in places where you didn't mean to.

The macro data also needs to be stored somewhere, and is likely stored in plain text. As such, storing your password in a macro is akin to storing it in a plain text file.

Instead, use a password manager. An offline password manager allows you to store your passwords in an encrypted form, protected by a master password. Many offline password managers also include functionality to write your password for you, just like a macro, except that this is much safer.

20
  • 3
    While a password manager would be better, I don't see how this is particularly bad. A remote attacker would need to know that you're storing passwords in your macros and how those macros are stored on your machine in addition to compromising your machine in another way to exploit this. Or, they'd need physical access (which is game over anyway). Unless the OP's a specific target, I don't see this raising their risk in any meaningful way. Dec 4, 2019 at 14:41
  • 9
    @CarlKevinson I'd argue the risk is losing the macro. Through whatever means - drive failure, or keyboard breaks (assuming it's stored on the keyboard itself), or maybe just somebody mindlessly deleting the file. Now you're locked out of your account(s) which is an inconvenience. So, it's similar to using a password manager (let's disregard the security of storage as a factor) but worse, since the availability goes down.
    – VLAZ
    Dec 4, 2019 at 14:55
  • 13
    @CarlKevinson "An attacker would have to know" is not in accordance with Kerkhoff's Principle. A system must be secure even under the assumption that the attacker knows everything about it.
    – MechMK1
    Dec 4, 2019 at 17:10
  • 10
    The chance of "accidentally pressing the macro key" has happened to me once or twice when focus is on a Skype window instead of my ssh session! Dec 4, 2019 at 22:25
  • 3
    @MechMK1 Kerkhoff's Principle does not apply - we're not designing a crypto system.
    – MooseBoys
    Dec 5, 2019 at 5:00
0

@MechMK1's answer needs at least some additions:

anyone with physical access can just press the assigned macro key and the password will be revealed

In lots of cases, this is pure advantage. And even if the environment is dangerous, there is an option to store passwords not in keyboard, but in separate additional mouse which is only plugged/used for storing passwords. This way it gets closer to classic pen and paper storage. You will get separate additional mouse as soon as you brake wheel on the previous one.

And even better - you can take this mouse while moving somewhere and always have up-to-date passwords with very fast access without cloud storage / master password leak risk.

You also have a high chance of accidentally pressing the macro key, thus typing in your password in places where you didn't mean to.

Lots of mice have DPI switch mode, which also switches macros on each button. Put passwords on specifically low DPI mode and problem solved.

The macro data also needs to be stored somewhere, and is likely stored in plain text. As such, storing your password in a macro is akin to storing it in a plain text file.

This is exactly main question, but some mouses support IO only under USB 3.0. So you can plug in 3.0, write passwords, then always use USB 2.0 which guarantees no way to download them from your keyboard\mouse.

So final answer is probably that it

  • was great storage until not widely used/ widely known,
  • nowadays it's a bit unsafe option,
  • when mouse developers realize this is perfect hardware storage and will add special switch to block IO, this again will be safe and promising

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.