I had an idea to assign my keyboard's macro keys to various passwords so I can just hit the key and it will paste in (the passwords are long and random so I won't remember them). This is on a home desktop PC. Are there any reasons this is a bad idea security wise?
-
34Well for starters anyone who gets physical access can just press the macro keys and get your passwords. Also if the macros are programmed/readable from the computer then remote attackers can read them out of it.– userCommented Dec 3, 2019 at 14:31
-
40Why use keyboard macros when you can just configure KeePass to basically do the same but securely?– Giacomo AlzettaCommented Dec 4, 2019 at 7:43
-
7Not to mention that if your keyboard dies or is stolen, you lose all your passwords. Availability is a component of security.– chrylis -cautiouslyoptimistic-Commented Dec 4, 2019 at 8:09
-
12@chrylis-onstrike- Keyboard macros are typically implemented in software. I'm not aware of any keyboards which store such macros in hardware. That would change things considerably.– forestCommented Dec 4, 2019 at 8:34
-
9@forest there are some instances where the macro is recorded and stored on the actual keyboard. Not too common, though but they exist.– VLAZCommented Dec 4, 2019 at 14:56
|
Show 9 more comments
3 Answers
This is a bad idea.
As user mentioned in a comment, anyone with physical access can just press the assigned macro key and the password will be revealed.
You also have a high chance of accidentally pressing the macro key, thus typing in your password in places where you didn't mean to.
The macro data also needs to be stored somewhere, and is likely stored in plain text. As such, storing your password in a macro is akin to storing it in a plain text file.
Instead, use a password manager. An offline password manager allows you to store your passwords in an encrypted form, protected by a master password. Many offline password managers also include functionality to write your password for you, just like a macro, except that this is much safer.
-
4While a password manager would be better, I don't see how this is particularly bad. A remote attacker would need to know that you're storing passwords in your macros and how those macros are stored on your machine in addition to compromising your machine in another way to exploit this. Or, they'd need physical access (which is game over anyway). Unless the OP's a specific target, I don't see this raising their risk in any meaningful way. Commented Dec 4, 2019 at 14:41
-
9@CarlKevinson I'd argue the risk is losing the macro. Through whatever means - drive failure, or keyboard breaks (assuming it's stored on the keyboard itself), or maybe just somebody mindlessly deleting the file. Now you're locked out of your account(s) which is an inconvenience. So, it's similar to using a password manager (let's disregard the security of storage as a factor) but worse, since the availability goes down.– VLAZCommented Dec 4, 2019 at 14:55
-
13@CarlKevinson "An attacker would have to know" is not in accordance with Kerkhoff's Principle. A system must be secure even under the assumption that the attacker knows everything about it.– user163495Commented Dec 4, 2019 at 17:10
-
10The chance of "accidentally pressing the macro key" has happened to me once or twice when focus is on a Skype window instead of my ssh session! Commented Dec 4, 2019 at 22:25
-
3@MechMK1 Kerkhoff's Principle does not apply - we're not designing a crypto system. Commented Dec 5, 2019 at 5:00
It’s a good idea. As far as the fact that “anyone could have access” to your macro keys, and besides the fact that they would you have to know where and how to use the passwords and that they’re even programmed TO the keys, your threat here is largely the same threat any homeowner faces against potential intruders.
-
1Welcome to the community. I don't want to sound rude or mean, but your answer does not add anything valuable to the answers. The danger of misclicking and hence revealing the password (even if you don't know where is belongs to) is a threat. Also there are web apps, which usually (without hacks) need permission to read your QMK or VIA programming which is usually the case so theoretically it can be read out remotely... Commented Feb 16, 2023 at 19:12
-
@SirMuffington - I disagree. A lot of these risks are not applicable to everyone's setup. "Good security" means overdoing what is necessary, and things like this give the user back the authority to decide what consequences they are ok with. Commented Jan 19 at 20:56
-
1While there are a lot of risks associated with the proposed idea, ultimately the answer depends on such thing as a threat model. If the risks have low probability and the benefits outweigh the risks, in a particular use case, then why not? Commented Feb 5 at 23:48
@MechMK1's answer needs at least some additions:
anyone with physical access can just press the assigned macro key and the password will be revealed
In lots of cases, this is pure advantage. And even if the environment is dangerous, there is an option to store passwords not in keyboard, but in separate additional mouse which is only plugged/used for storing passwords. This way it gets closer to classic pen and paper storage. You will get separate additional mouse as soon as you brake wheel on the previous one.
And even better - you can take this mouse while moving somewhere and always have up-to-date passwords with very fast access without cloud storage / master password leak risk.
You also have a high chance of accidentally pressing the macro key, thus typing in your password in places where you didn't mean to.
Lots of mice have DPI switch mode, which also switches macros on each button. Put passwords on specifically low DPI mode and problem solved.
The macro data also needs to be stored somewhere, and is likely stored in plain text. As such, storing your password in a macro is akin to storing it in a plain text file.
This is exactly main question, but some mouses support IO only under USB 3.0. So you can plug in 3.0, write passwords, then always use USB 2.0 which guarantees no way to download them from your keyboard\mouse.
So final answer is probably that it
- was great storage until not widely used/ widely known,
- nowadays it's a bit unsafe option,
- when mouse developers realize this is perfect hardware storage and will add special switch to block IO, this again will be safe and promising
