1

Consider a home user who runs Linux on a laptop with full-disk encryption and uses a cloud-based password manager. Assume the laptop is firewall-protected with no SSH access. It seems reasonable to reuse the same passphrase for the OS user account, FDE, and password manager, based on the following line of reasoning:

  1. The risk of password reuse in general is that if the password is compromised for one account, it is compromised for all accounts where it is used.
  2. In this case, if an attacker discovers the FDE passphrase, then they likely also have physical access to the laptop, and can install a keylogger to intercept the passphrases for the user account and password manager.
  3. If an attacker discovers the user account passphrase, then they likely also have physical access to the laptop while it is running, and can install a keylogger to intercept the passphrases for FDE and password manager.
  4. If an attacker discovers the cloud-based password manager passphrase, then they gain access to all of the user's accounts and can likely do more damage than if they had access to the user's local data.
  5. Thus, if the passphrase for any one of the three is compromised, then all three are compromised. Therefore, there should be no additional risk to reusing the same passphrase in all three places.

The only caveat would be if the user has local data that is more sensitive than the accounts stored in the password manager, then it might make sense to use a separate passphrase for the password manager, so that if the password manager is compromised, the local data is still safe.

Are there flaws in my reasoning? Hidden assumptions? What are the risks associated with reusing the same passphrase in all three places?

3
  • 2
    This all hinges on a keylogger being the main threat. Your flawed reasoning is pinning all your threat assessments based on that alone. You have FDE, so therefore you can install things? No. You have account password and can install things? Only if the account also is root. I see you type in your account password from across the room, and now I have access to your cloud password manager. There are so many ways to slice this threat.
    – schroeder
    May 29, 2023 at 15:37
  • @schroeder These are good points, thanks. To respond: (1) I assume if attacker can decrypt the disk, then they can write to the disk and therefore install things, no? (2) Yes, I'm assuming that the user account has sudo access. (3) Good point about seeing me type in my user password, though in that case there's a pretty good chance I'll unlock my password vault shortly afterward and you'll see that passphrase too.
    – jth
    May 29, 2023 at 18:02
  • Read access does not necessitate write access... And sure, all this might be true in your circumstance but these are hyper-specific details. You're in a place of "counting the angels that can dance on the head of a pin".
    – schroeder
    May 30, 2023 at 7:47

1 Answer 1

4

Suppose you used your laptop in a public place (coffee, airport…) in a way an attacker was able to snoop you entering one of the passwords (any of them, since they are all the same). After you finish working, you fully shutdown the laptop. But the attacker steals your laptop and:

  • decrypts the disk with that single password he knows
  • enters the OS account with that single password he knows
  • opens the password manager with that single password he knows

uses the password manager to abuse further credentials (e.g. drain your bank account)


In comparison, installing a keylogger would require the attacker to steal the laptop, install some malicious program, then let you recover the laptop and wait for you to enter your credentials (let's assume it installed a trojan able to call home automatically, if it was a plain keylogger, he might need to then steal your laptop again!).

If this was a operation organised by the CIA, I expect they would be prepared to compromise in a few minutes (while you are being distracted by another agent, maybe). If the thief is your average Joe, he will be mainly interested in the device, only inspecting it later at a safe place. He's not carrying a Linux trojan around and, anyway, is not going to return the device just in case he can harvest some credentials worth more than the hardware.

Also, if you had "lost", and then recovered, the laptop, you could consider it compromised and reinstall it (or buy a new one), instead of risking running a potentially installed keylogger.

Now let's study the scenario if they were different passwords (with the attacker only learning one of them):

  • Disk encryption key unknown. OS account password known.

As long as if was not running, the attacker will be unable to access the data in the laptop.

  • Disk encryption key known. OS account password unknown.

This is a weaker situation, but the attacker won't be able to access the laptop contents immediately. The attacker would need to disassemble the laptop, take out the disk, connect it to another computer... and then (to get into your password manager) install the trojan, assemble back the laptop and return it to you, in a relatively short timeframe.

Moreover, there are antitampering seals that can be put on a laptop so that it becomes evident that it has been opened (so you would avoid entering any secrets there).

  • Password manager password known

This is a bit different, because we have defined it as a cloud password manager, which probably means it can be accessed with just that password — no laptop access at all. A better approach¹ would be having an offline password manager, so that all the layers are stacked: the attacker would need the FDE password and the OS password and the password manager one. (You might then have it synced between devices using a cloud-based system, which would need an additional password) As you don't specify the password manager, it might already be working in a similar way.


I recommend you do use different keys. Also note they serve different means.

  • FDE: This should protect against attackers with physical access to the device, and (potentially) infinite attempts. Since it may need to be entered infrequently (once-twice a day), we can afford to use a longer passphrase than otherwise.

  • OS account: this one has multiple uses, the most relevant being probably that it is the one used to unlock the screensaver, so you are going to type it frequently. You can configure sudo so that having this password is not equivalent to having root, further restricting it (yes, that would mean another password)

  • Password manager: this is a key to your box of secrets. It varies from opening the front door in the cloud password manager, a key which would only allow access to a cloud provider holding your files, to being just an extra layer for a local one. In fact, there is a school of thought that in the latter case the manager does not need a password (for reasons similar to the ones stated in the question). I contend however that it should have a password, since there are a number of scenarios where it becomes relevant: mere exfiltration of stored files, the attacker with an unlocked laptop / FDE passphrase, the case where you explicitly didn't unlock the password manager since you weren't going to need it…

PS: Don't forget to secure as well the boot process (UEFI and grub passwords).


Update: Detailing the paragraph about the Password managers, it starts talking about the variance between them, mentioning three types of password managers.

It was already discussed above that if the password manager's password was stolen, for a cloud password manager that can be accessed from anywhere, was Bad™ so it's not repeated here.

Instead, it mentions that for a local (offline) password manager, some people consider that a password is not needed (e.g. "someone stealing the encrypted file holding the password manager store could steal its password as well" argument), but I do consider it should have a password, since there are some scenarios where it can be useful.

5
  • Could you clarify your final paragraph about recommendations for password managers? Either the sentences are not making sense to me or I must not be familiar with the type of password managers you're referring to. Also, do you have a best practices link for the UEFI/grub password process? In my experience, this is not supported, either easily or at all, by typical distribution installation wizards. Even FDE beyond the single-huge-partition scenario doesn't seem to have reasonable support.
    – jrw32982
    May 30, 2023 at 17:48
  • The last line is just "remember to place a password into your UEFI" (varies by firmware) "and into grub" (description at askubuntu), so that only the expected OS can be booted [at least without hurdles].
    – Ángel
    Jun 18, 2023 at 23:55
  • @jrw32982 see if you understand it better with this update
    – Ángel
    Jun 19, 2023 at 0:21
  • Thanks for your update. I agree that there are scenarios where you want your local (offline) password manager data files to be password-protected.
    – jrw32982
    Jun 19, 2023 at 21:38
  • Thanks for that reference to password-protecting grub menus. I'm beginning to think that maybe the only scenario this protects against is an evil-maid style attack, which is not so important to me personally.
    – jrw32982
    Jun 19, 2023 at 21:47

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .