Password managers may have flaws, but they’re a good idea
New research offers ways to reinforce a computer’s defences
A new study has identified security flaws in five of the most popular password managers.
Now for some counterintuitive advice: I still think you should use a password manager. So do the ethical hackers with Independent Security Evaluators (ISE) who came to me with news of the flaws — and other security pros I spoke to about the study, published Tuesday. You wouldn’t stop using a seatbelt because it can’t protect you from every kind of vehicle accident. The same applies to password managers.
But the research, which finds password manager users are vulnerable to targeted malware attacks, does shine a light on ways to bolster our defences. And it speaks to a bigger truth that gets lost in headlines about breaches and bugs: Online safety isn’t about being unhackable; it’s about not being the lowest-hanging fruit.
Password managers are programs that keep all of your login details in an online safe-deposit box. They’re critical tools for staying safe because the No. 1 most annoying thing about the internet — passwords — leads people to make the No. 1 security mistake: reusing passwords.
Hackers know we do this, so they take passwords from one breached site and then try them on lots of others. Using a program to keep track of all your unique passwords takes some adjustment, but they’re getting simpler and can make logging into things faster.
The question that’s haunted these programs is: How is it possibly safe to put all of your passwords in one basket? If someone steals it, you’re hosed.
For accountability’s sake, audits like ISE’s are important. It found the Windows 10 apps for 1Password, Dashlane, KeePass, LastPass and RoboForm left some passwords exposed in a computer’s memory when the apps were in “locked” mode.
To a hacker with access to the PC, passwords that should have been hidden were no more secure than a text file on your computer desktop. (The researchers only studied Windows apps but say it may affect Apple Macs and mobile operating systems, too.)
1Password, LastPass and RoboForm even exposed master passwords, used to unlock all of your other passwords. “The ‘lock’ button on password managers is broken — some more severely than others,” said lead researcher Adrian Bednarek.
The companies had a range of responses. LastPass and RoboForm told me they would issue updates this week. Dashlane said it had documented the issue for some time and been working on fixes, but it has higher-priority security concerns. KeePass and 1Password shrugged it off as a known limitation with Windows and an accepted risk.
Casey Ellis, the founder of Bugcrowd, a site for researchers to report vulnerabilities, told me companies have to weigh the risk of each discovered bug and figure out what to prioritize.
“Password companies have some of the highest standards of security, and folks should be able to sleep pretty well at night knowing that these companies are taking concerns seriously,” he said.
“Vulnerabilities aren’t mysterious — they’re a product of the fact that people aren’t perfect — and finding them is a good thing.”
Why isn’t this a pants-on-fire issue? Because at the moment, we’re ahead of the threat. There’s no evidence hackers are targeting the PCs of individual password manager users. The question is: How long will that last?
Yes, there is risk in storing all of your passwords in one place with a password manager. But it’s helpful to look at the risk like a hacker: There’s no “safe” and “unsafe.” There’s “safer than” or “better than.” Being 100 per cent safe would require disconnecting from the internet and moving to an undisclosed bunker.
Assuming the bunker isn’t an option for you, your choices are reusing passwords or trusting a password manager.
The latter certainly wouldn’t be safer if password manager companies were exposing millions of our passwords at once through breaches of their servers. The companies encrypt our secrets and don’t store our master passwords used to unlock the encryption.
If their servers do get hacked, the data is gobbledygook without the master password only each individual user knows. (So choose a unique master password, never share it with anyone, and definitely don’t forget it.)
The bug found by ISE raises a different kind of risk: passwords exposed on the memory of individual users’ PCs. Any exposure “puts users’ secret records unnecessarily at risk,” Bednarek wrote in his report.
But this discovery is nowhere close to our worst-case scenario. To peer into your PC’s memory, a hacker would likely either need to be at your computer or trick you into installing malware that has control over your computer.
Hackers prefer mass attacks rather than going after individuals, unless it’s an extremely highvalue individual. For mass attacks, there’s much lower hanging fruit — such as all those people still reusing passwords.
The worry for Bednarek: As more people use password managers, malware makers might start targeting their PCs to steal passwords. Multiplied over millions of password manager users, a low risk to the individual could turn in a large number of exposed passwords.
The companies said malware isn’t just a risk to password manager users. A hacker with access to your computer might also make use of code, such as a key logger that slurps up all your activity — at which point, using a password manager is not your only problem.
The companies and the researchers also disagree over how much they can do about the memory leak problem without fundamental changes to operating systems. Dashlane’s CEO Emmanuel Schalit said local memory attacks are still a hypothetical concern.
“It is more important for us to work on strengthening even further core components of our server infrastructure or cryptography, because this has a more material impact on our users’ security,” he said.
Both sides agree on one thing: Your personal devices are the weak link. It’s a lot harder for a password manager — or any software — to protect your valuable data if the computer you’re working on is compromised.
So make yourself not worth hacking by:
• Updating your software religiously. New versions contain very important security patches.
• Checking your computer for malware. I recommend Malwarebytes for Windows and MacOS.
• Being very careful about installing software that comes from places other than Microsoft, Apple and Google-managed app stores. Say no to web browser extensions and pop-up messages.
• Not storing extremely valuable secrets, such as bitcoin private keys in password managers.