4

Friends use password managers like lastpass or dashlane which have plugins for the browser, but not for the email clients (thunderbird or livemail). But surely the email password is the Achilles heel of security because if you have that you can easily perform password resets to get access to any websites used.

If the password manager doesn't protect your email client a trojan can steal your email profile containing the email passwords.

Of course if you don't use an email client you don't have this vulnerability, but many still do. Many people use password managers and email clients so where's the flaw in my logic?

5

Many email clients protect the password in similar ways to a password manager (and some do not). No flaw in your logic, although once you get malware designed to steal password manager passwords, all bets are off anyway.

That's once reason why 2FA is so important. By setting up 2FA, even if malware gets your email password, they cannot use it apart from your system. They would need to control your email client in order to use the "password reset" functionality you mention. Is it possible for attackers to do this, yes, but the level of complexity is much higher than simply grabbing a password from memory/configs.

  • I'm not sure about livemail, but with thunderbird you can bypass the master password (if it's set) so that's virtually no protection at all. But I agree, email services offering 2FA (still in the minority unfortunately) are probably the reason why the commercial password managers don't bother protecting email clients. Thank you. (I'm too newbie to vote this up) – Tom Apr 11 '15 at 20:06
  • @Tom How can you bypass the master password in Thunderbird? If you mean that you can read old mail without providing the master password that's true, but you can't download or send new mail without it. Or do you know about an exploit that lets you download new mail without knowing the master password? – isarandi Apr 11 '15 at 21:07
  • @isarandi I'm wrong. You are right. You can't bypass it. Resetting the master passwords deletes the password store so this is not a threat. – Tom Apr 12 '15 at 6:42

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.