1

I saw various questions on a similar note but not quite the same as my situation: I entered my password manager's password into the browser URL bar and hit enter. Has this breached the confidentiality of that password?

Improve this question
8
  • No way to be sure, but probably. I suggest you change your password.
    – user10216038
    May 5, 2020 at 0:23
  • Unless you can provide the questions that do not meet your needs (and why) we can only guess. The duplicate above perfectly matches your question, even without hitting enter.
    – schroeder ♦
    May 5, 2020 at 8:38
  • @schroeder: I'd like to reopen this, as it's NOT a duplicate. The difference is whether enter was pressed or not. In the other question, enter wasn't pressed. The answer for this is very different, because hitting the enter starts name resolution.
    – Esa Jokinen
    May 5, 2020 at 8:53
  • 1
    @EsaJokinen but the same treat and impact applies. I added another duplicate which is more on topic in terms of additional impacts.
    – schroeder ♦
    May 5, 2020 at 8:54
  • 1
    The other question is indeed more related. Maybe I should move my answer there.
    – Esa Jokinen
    May 5, 2020 at 9:06

3 Answers 3

Reset to default
1

It depends on the possible consequences. Estimate your risks.

1) For instance, if your password manager keeps passwords for your online banking account and similar important passwords, then the consequences can be very expensive and it makes sense to change the password and to delete any backups with the old password.

2) But if you keep there passwords for accounts like your local pet shop or for your local bowling club, the consequences in the worst case can be acceptable. Then you don't need to warry.

3) If your browser is configured to use URL field for search, then take into account that all major search engines use HTTPS only. That's why nobody except search engine could see your password.

4) Estimate what it costs for somebody to gain access to access to the servers of your search engine (like Google, Bing or DDG), find there requests related to you, then find a particular request that contained password. Then the attacker would need a copy of your password manager database. Only then he can use his knowledge of the password. Now estimate if it makes sense for smb. to do such efforts to get your passwords. If your passwords really cost millions of USD, it definitely makes sense to change password, delete any old copies. If not, don't waste time searching for the backups or copies of your password manager database on all your devices.

Improve this answer
0

I would say it's better to change the password just in case but realistically the risk you're exposed to is pretty small. Your password will likely be stored in the browser's history in plaintext, but your password likely never left your computer as it is not formatted as an external address.

Improve this answer
2
  • 1
    Your stetament "password likely never left your computer" is not quite correct. If browser is configured to use URL field as search field (earlier it needed configuration, now some browsers provide such behaviour by default), then the browser sent such search request to the search engine. Means, at least search engine received the password.
    – mentallurg
    May 5, 2020 at 1:30
  • @mentallurg Wow I don't know how I missed that, you are entirely correct about the search field
    – trallgorm
    May 5, 2020 at 4:16
0

In this scenario, the name resolution is your worst enemy, as it leaks the password in multiple ways. Your password will leak to multiple DNS servers and through the local network – mostly in plain text, even if you are using encrypted connection to your DNS resolver.

  • DNS resolvers will not handle the query just within themselves: they will start asking it from the authoritative name servers, starting from the root servers, or from a forwarder that does it for them.
  • As this is not a real working domain name, it will be also queried using
    • Multicast DNS (mDNS, RFC 6762) and
    • Link-Local Multicast Name Resolution (LLMNR, RFC 4795).
  • Both mDNS and LLMNR are using IP multicasting.
    • By default, ethernet switches will flood these requests to every port, as they won't see the multicast MAC addresses beginning with 01:00:5e as a source address on any ethernet frame.
    • Some switches can limit this using IGMP snooping, but it's still possible for anyone to join these multicast groups to get these IP multicast transmissions.

In addition, the password will leak to your search provider with most modern browsers after the name resolutions fails, as explained by mentallurg. Some browsers may also start sending out contents in the address bar even before you have pressed the enter, as explained in an answer for "Does accidentally pasting password into browser URL field send it over the network?".

TL;DR: Change your password.

In this example, testp4ssw0rd is typed into the address bar of Google Chrome on Windows 10.

Packet capture from Wireshark

  • The computer 192.0.2.100 has local domain (configured through DHCP) example.com and, as a common bad practice, example.local. The 192.0.2.254 is a router that also acts as a DNS resolver.

    • With example.com, the resolver, any MITM and the ns1.example.com will know the testp4ssw0rd.
    • With example.local, the the NXDOMAIN reply comes from a root server.

  • The MDNS (5353/udp) query testp4ssw0rd.local to 224.0.0.251 is an IP multicast query message with MAC address 01:00:5E:00:00:FB. It asks the host having that name to identify itself.

  • Likewise, LLMNR (5355/udp) query testp4ssw0rd to 244.0.0.252 is an IP multicast query message with MAC address 01:00:5E:00:00:FC.

  • As there wasn't devices with these names, you won't see mDNS/LLMNR responses.

Improve this answer

Not the answer you're looking for? Browse other questions tagged .