Re:NIST advises services to not require that passwords be ch...
by dsacco on Saturday May 20, 2017 @06:29PM
(#14384694)
If malware has compromised your device, there is nothing you can meaningfully do to improve the security that is already offered by a password manager. This scenario is right up there with physical access to the machine - you're already screwed.
To comment on this specific example - if you add the same set of characters to every item in a password manager, an attacker can deduce that it's a common obfuscation method.
I like the idea. So what you suggest is to manually type, say, "7&>>", before or after every password entered by the password manager? Or to copy-paste the "7&>>" from somewhere.
A password manager is essential for good security (and I use one) but I'm concerned that it can be devastating point of failure. It can be worse for highly-organized people who keep absolutely everything in there.
It's a single, up-to-date database in a nice standardized format with known filenames and clearly labeled data that lends itself to automated malware that can seek it out when your password manager is open/mounted/decrypted.
As you said, a majority of folks won't be bothered, but a good extra step for someone highly security conscious.