Re:Password Managers: Under the Hood of Secrets Management
by tedunangst on Wednesday February 20, 2019 @01:10PM
(#19210291)
At some point you're going to enter the master password to unlock the next password, at which point it will be stolen, giving up every password.
[ Parent
| on HN ]
Re:Password Managers: Under the Hood of Secrets Management
by Faark on Wednesday February 20, 2019 @04:02PM
(#19211949)
Only with additional work, if the attacker also extracts your password file. That's something I'd like some resistance against anyway, so malware can't simply do that and potentially decrypt it a few years down the line.
This of cause doesn't help against a resourceful and highly targeted attack, but that's less of a concern for me than some malware toolbox adding support for common password managers.
Re:Password Managers: Under the Hood of Secrets Management
by WorldMaker on Thursday February 21, 2019 @04:17PM
(#19220648)
Also, on Windows, KeePass at least offers the option to always ask for the master password only in the same secure desktop that UAC and login/logout use. (I don't know why this isn't the default behavior, other than maybe cross-platform compat, but it is not the default. First thing I turn on for fresh installs.) That at least helps mitigate against most software keyloggers / remote automation hack attempts. (Leading the threat concerns back to rootkits and physical hardware access.)