News for hackers. Stuff that matters.

A comment on Recent version of Handbrake download infected with malware. Parent comment

Re:Recent version of Handbrake download infected with malware by kazazes on Saturday May 06, 2017 @04:10PM (#14282004)
Password managers aren't implicated in the compromise of the OS X keychain or your browser... this is FUD.

Your browser's native store is probably unencrypted [1], and the OS X keychain password can be snatched with a clone of the native password prompt. Neither is true for any respected password manager. They keep you safe.

[1] https://news.ycombinator.com/item?id=10884000

[ Parent | on HN ]
Re:Recent version of Handbrake download infected with malware by tjoff on Saturday May 06, 2017 @04:26PM (#14282068)
The OS X keychain is a password manager, right? Just as your browser. Your browsers native store is probably encrypted, see your own source.

How would a respected password manager guard against an infected machine?

Take keepass as an example, they state: The actual problem here is running specialized spyware (as the same user and with the same rights, like KeeFarce assumes). If you are doing this, everything is over. An application cannot protect itself in such a case; all modern PC operating systems (Windows, Linux, ...) http://keepass.info/help/kb/sec_issues.html#keefarce

Also, at the bottom of the page: Neither KeePass nor any other password manager can magically run securely in a spyware-infected, insecure environment. Users still are responsible for the security of their PC.

[ Parent | on HN ]