What should password managers not do? Leak your passwords? What a great idea, LastPass

Re: Anyone remember Gator?

Gator changed their name several times including Claria and Jelly cloud (more like slime cloud), to try and throw off the stench of malware.

What's more interesting is tracing where the morally bankrupt senior management ended up. eHarmony, facebook, eHow / Livestrong, among others.

How is having all my unknown-to-me passwords exfiltrated from my password manager "way better" than having my known-to-me passwords guessed/hijacked? They both seem about equivalent to me (though they'd have a hard time getting someone to enter all the passwords that they re-use in a single attack, so perhaps it's marginally worse to use LastPass?).

Both of which are worse than just securing your machine (not letting people see you type your passwords), choosing sensible passwords (* long, not complex) and not running third-party software with access to EVERYTHING on your computer, including an explicit list of every password you've ever used, anywhere, ever.

Like antivirus - the only program to run as SYSTEM, begin at startup, run for every user, intercept every possible file access on the entire machine, able to hide anything it does, not let itself get shut down, connect to the Internet, update itself automatically, and even nowadays run your firewall, decide what can get out or see packets, and what can come back in, often with remote-support tools built in. Yeah, that's not a recipe for disaster.

(*) Human-rememberable passwords are WAY outside brute-force limits - just make sure they are LONG, not faff around with fancy characters in your potential alphabets. Starting with just an ordinary alphabet, a character added to password length would make the password 26 times stronger, while including a new character (e.g. an asterisk) into the alphabet itself only makes it 1/26th stronger. STOP IT.

Oops

I really do not believe that you meant to say that. Perhaps LastPass' next venture should be a decent notepad with a corporate pen.

Indeed. I keep each horrendously long and complex password in an encrypted LibreOffice document along with associated information such as username, site URL etc. All the documents are stored inside a TrueCrypt drive which is only temporarily mounted when access to a password is needed. It may be a bit of a faff to login to my bank etc but I prefer this method to trusting some third party on the web.

For starters, local storage is great... if it's 1990 and you use exactly one computer for all the things you do.

For second, local storage is great... if you don't mind losing a small piece of your life to managing yet another application including backing up said local storage.

For third, local storage is great... if it's not 2017 and you don't already have half your life in the cloud anyways, trusting it with tons of other important shit like I don't know, your finances, School curriculum, taxes, email, calendar, photos, relationships, etc.

It's called modern life. The horse and buggy was awesome too, until it wasn't.

Local storage for passwords

Indeed, use keepass and combine it with your favorite method of keeping data synchronized (e.g., Dropbox, OneDrive, OneDrive, USB sticks, ...) across your computers and phones. It adds a copy/paste step when you use it with your browser, but you are in control and you offer a much smaller attack surface.

Also, is there anything wrong about the browser (Chrome) autofill method for low priority passwords (e.g. for the comment section of ElReg)?

Re: WTF is so wrong about local storage ?

Did you read the article?

This vulnerability has little to do with the actual storage location of the passwords and lots to do with the available RFC's used by the (LastPass) browser extension to access the stored information.

Given the nature of the vulnerability and the level of information disclosed, we can expect developers of other password managers that have browser extensions that access the password store to also be reviewing their code. Also given the nature of the vulnerability developers of browser extensions that utilise cloud services should also be reviewing their code...

The fundamental problem with LastPass is that it doesn't seem to have a standalone client, so disabling it in Chrome etc. means you are unable to access your password store. A possible workaround is to have the extension enabled in one web browser (eg. IE) that you don't use for web browsing and use a different browser (eg. Chrome/Firefox) for your normal web browsing.

The cloud storage vs local is a moot point though in this case.

It was the browser extension leaking the data, local storage wouldn't have made any difference.

Re: The perfect Password

Brute force attacks do not care which characters humans use.

Yes, yes they do.

Iamsostupidthatiforgetmypasswords%^£thetime2000 is way - way - stronger than Iamsostupidthatiforgetmypasswordsallthetime2000.

Larger the key space the less feasible the attack. Adding an extra possible character increases the complexity by an order of magnitude. This stuff isn't even complicated.

Re: The perfect Password

Assuming you can remember all those passphrases for all your different accounts - I assume you're not advocating using the same password everywhere?

Re: The perfect Password

That's all well and good, but there are a number of services that still limit the length of passwords to a ridiculously short number of characters. In that type of situation, the string of words method or xkcd method is useless. Password managers allow you to generate random passwords containing a mix of upper/lower case letters, numbers and special symbols of whatever length you like, so you can have much stronger passwords than "Iamsostupidthatiforgetmypasswordsallthetime2000". Also, unless you are recommending reusing the same password across many sites, that method is not practicable for most people. I currently have 116 passwords stored in my password manager. They are all unique and impossible to guess, even by me. I don't have photographic memory, so I simply can't remember that many unique passwords. I use a password manager for everything except banking, email and Amazon. For my banking and Amazon I have 12 character impossible to guess root passwords that I've memorized and never change, and I have an additional 18 character suffix stored on a Yubikey that I can change at regular intervals. I also use 2FA wherever it's allowed. There is no perfect password solution. Whatever solution you choose to use, you have compromised to some degree on usability, convenience or security. To what degree one is willing to compromise in any one of those areas is up to each individual. Saying that one should never use a password manager is a bit like saying to an investor "no one should ever have more than 50% of one's investments in equities as they are too risky".

Re: The perfect Password

"Brute force attacks do not care which characters humans use." Wow you obv have no idea how brute force attacks work!

Re: The perfect Password

Robert, that's nonsense. Of course dictionary attacks can still work. Attackers can combine words just as they can combine letters in brute force searches.

The first password you quoted has 16 characters, taken from a set of upper and lower case letters, digits and punctuation - say a set of 90 characters. Let's leave aside the amount of repetition in it, which is bad, and assume it was supposed to be a random selection of characters. That would give about 104 bits of entropy - a very strong password (if truly random).

"horsefrenchfriesgreengrass" comprises 5 very common words, or maybe only 3 if the attacker has common phrases "french fries" and "green grass" in their dictionary. Likely 60-ish bits of entropy, much weaker than the 16 random character password.

Your 13 word alternative is probably not much better, because it's not 13 randomly-chosen words. Most of it is a syntactically valid English sentence, which really reduces the entropy. "I am so stupid" and "I forget my passwords all the time" both get a ton of hits on google and could easily be in password dictionaries. So your 13 word password might really only be 4 words. A sophisticated dictionary attack will try variations of spacing and capitalisation. And attackers _are_ using such sophisticated attacks.

Your word-based passwords certainly have the benefit of being easier to remember, but I don't think you're right to believe they're safer.