I'm a senior undergraduate majoring in computer science. I recently took a computer security class where instead of exams we had a final project that could be anything related to computer security. So for our project, we designed a cloud based password manager that works on almost every existing site with the key idea being that the credentials are never sent to/stored on the client computer that is trying to login to a website.

While I'd really appreciate feedback on our project, I have a feeling that's not really what Stack Exchange is for, so instead I wanted to ask about the vulnerabilities existing password managers still have.

While they encrypt data when it is stored, when trying to log in to a website, what are the safeguards in place that would stop a malicious extension from just doing something like: document.getElementById("pass").value right after the extension is used? What about key loggers recording the master password for the password manager? Additionally, I've read a couple of academic papers exploiting bugs in password managers where for example the master password is left in unprotected memory.

The biggest question I have is if these are all really problems that have been exploited in the real world, or if these vulnerabilities take too much finesse to implement/scale up.

  • 3
    Nothing stops a malicious extension from exfiltrating your password, but that's not a threat password managers are trying to mitigate. – MechMK1 Jul 3 '20 at 22:45
  • @MechMK1 but are these threats worth mitigating? Are there other safeguards in place other than the password manager itself (i.e. the browser) that help limit these types of attacks? – martinpetrov1568 Jul 3 '20 at 23:24
  • @MechMK1 I guess I'm asking if an alternative to password managers pasting your credential in plain text in fields existed, would it actually be a project worth exploring, or is it such a small issue that even if solved wouldn't be worthwhile – martinpetrov1568 Jul 3 '20 at 23:30
  • I use 1password and I would really like to see what malicious users would be able to do with the above mentioned. – LtMuffin Jul 4 '20 at 0:36
  • 3
    You're essentially asking how to safely use a computer infected by malware. You can't. – MechMK1 Jul 4 '20 at 8:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Browse other questions tagged or ask your own question.