I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So for our project, we designed a cloud based password manager that works on almost every existing site with the key idea being that the credentials are never sent to/stored on the client computer that is trying to login to a website.

While I'd really appreciate feedback on our project, I have a feeling that's not really what Stack Exchange is for, so instead I wanted to ask about the vulnerabilities existing password managers still have.

While they encrypt data when it is stored, when trying to log in to a website, what are the safeguards in place that would stop a malicious extension from just doing something like: document.getElementById("pass").value right after the extension is used? What about key loggers recording the master password for the password manager? Additionally, I've read a couple of academic papers exploiting bugs in password managers where for example the master password is left in unprotected memory.

The biggest question I have is if these are all really problems that have been exploited in the real world, or if these vulnerabilities take too much finesse to implement/scale up.

  • 3
    Nothing stops a malicious extension from exfiltrating your password, but that's not a threat password managers are trying to mitigate.
    – user163495
    Jul 3, 2020 at 22:45
  • @MechMK1 but are these threats worth mitigating? Are there other safeguards in place other than the password manager itself (i.e. the browser) that help limit these types of attacks? Jul 3, 2020 at 23:24
  • @MechMK1 I guess I'm asking if an alternative to password managers pasting your credential in plain text in fields existed, would it actually be a project worth exploring, or is it such a small issue that even if solved wouldn't be worthwhile Jul 3, 2020 at 23:30
  • I use 1password and I would really like to see what malicious users would be able to do with the above mentioned.
    – LtMuffin
    Jul 4, 2020 at 0:36
  • 4
    You're essentially asking how to safely use a computer infected by malware. You can't.
    – user163495
    Jul 4, 2020 at 8:02


Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.