burner589432

Last I checked hooking key events in Windows requires SYSTEM access.

Stealing session tokens can be as easy as just pulling the entire browser profile, which I doubt requires elevated access.

I imagine black market postexploitation kits would have session data theft as a feature.

Again, if somebody has system access, you're probably completely fucked from a different angle irrespective of your preferred authentication method so now we're talking about semantics of how you're getting fucked because most 'apt's are going to be grepping your disk for words key phrases like 'financial data', not caring about your facebook account.

So... Nothing apart from some convoluted anecdote?

If currently there's no password manager in existence that doesn't let you override the plaintext password extraction / override feature, there's nothing to stop one being made. You could probably hook it in with a system level service which cryptographically signs them, too.

> since the autofill is not 100% reliable, it's not that unusual to go into the password store and manually get the password out of there.

I imagine you can extract passwords out of security keys in some form without being on the correct domain, too.

Do domain check fails that regularly? I'm sure enterprise configuration policies would provide functionality to prevent password extraction should you be inclined to enable it.

If your host is infected with malware but it can't steal your passwords due to hardware boundaries, it still has access to your host at a pretty reasonable permission level.

In most corporate environments that's far more damaging than getting persistence in a handful of webapps.

Also, 2FA solves this exact issue.

If you're trying to prevent credential theft: Educate users on password managers, deploying 2FA, or tokens like this would also make sense. MFA deployments are probably significantly cheaper though (And yes, ActiveDirectory OTP and smartcard based MFA tools exist). Productivity-wise, MFA will work better than USB tokens - I know a bunch of people who regularly forget their work smartcard pass, I don't know many people that forget their mobile phone.

If you're trying to have rock solid audit trails that will stand up in court: This, or 2FA won't have a huge functional difference, but chances are unless you have NSA/Google tier security, your money would be better spent hardening infrastructure - your logs won't be worth jack if a pentest rips your network apart in two hours. I regularly see $1m+ SEIM deployments on MS17-010 vulnerable networks, I feel like security gimmicks like these distract them away from fixing real problems and are, if anything, detrimental to security.

If malware is in a position to steal data from your clipboard or keylog your device, it's very likely to be in a position to hijack your session tokens.

Browser based password managers solve this.

Unpopular opinion: These keys are about selling the idea that physical-based security is somehow magically better.

If you have good password hygene (read: a decent password manager) then I'll need to breach your host to obtain it - if you use a security key, I'll have to breach your host and hijack your session which is slightly more convenient but chances are you're royally screwed once you're breached anyway.

Sure there's some edge cases where this might work (one-way keyloggers, etc) but these aren't realistic threats for a large majority of people.

Somehow a sales team have taken a bullet hole, and attempted to use a square peg to band-aid it.

Stop buying stupid products and just use a damn password manager.