A Periodic Table of password managers

Posted Nov 10, 2011 9:11 UTC (Thu) by danielpf (guest, #4723)
Parent article: A Periodic Table of password managers

I stay skeptical with such tools. Putting all the jewels in the same safe is a sure way to indicate to the possible intruder where to look for getting the whole treasure. Perhaps I would have such a tool just to fool the possible intruder who would waist effort to crack the visible password manager. An effective password manager should look innocuous, and not be popular.

to post comments

A Periodic Table of password managers

Posted Nov 10, 2011 10:03 UTC (Thu) by mpr22 (subscriber, #60784) [Link] (9 responses)

The "not be popular" requirement tends to imply by extension that everyone should write their own from scratch (what, you expect people to keep quiet about effective software?).

A Periodic Table of password managers

Posted Nov 10, 2011 11:22 UTC (Thu) by danielpf (guest, #4723) [Link] (8 responses)

Instead of writing software, one can just combine local crypted or non-crypted information with information stored on distinct devices, including own brain or cell phone. This prevents accessing the full information for intruders of the computer account. With such practices
a password manager doesn't really need to be written.

Say one could use a plain text file, or perhaps use a password manager
to fool an intruder, but each password would be stored only in part,
or in an altered form. Algorithms, or added information from one or
several separate sources would provide the missing information.

In any case methods for storing static passwords do not help against
keyloggers.

A Periodic Table of password managers

Posted Nov 10, 2011 16:37 UTC (Thu) by drag (guest, #31333) [Link] (5 responses)

If you want to take that approach then the best place to keep your passwords is written down on a pad of paper.

That way is completely and 100% totally impervious to all remote attackers.

The brain makes a notorious poor place to store passwords. It has very limited store, high levels of data corruption, and performance/recall limitations. It's a highly optimized storage medium not well suited to arbitrary strings.

A Periodic Table of password managers

Posted Nov 10, 2011 19:30 UTC (Thu) by danielpf (guest, #4723) [Link] (4 responses)

Anyway you must at least assume that your brain is able to remember that you wrote down the passwords on the pad of paper, and where the pad was stored, without forgetting that this brain is going to use a computer.

So a minimally functioning brain can be assumed.

Now what is required to the brain is not much more elaborated than that.
From the list of partial passwords, say written on paper, but not necessarily, you modify the partial passwords with a simple rule, like:
- adding your pet name to the written down partial passwords (not very good actually), better
- replacing the last 3 characters with the next ones in the alphabet, or
- swapping the odd and even positioned characters,
- etc.
Something sufficiently simple but personal your brain will keep with quasi certainty. Something also that doesn't reveal some obvious structure in the password in case someone has access to a full password (thus the pet name addition is not very good on this regard).

A Periodic Table of password managers

Posted Nov 11, 2011 4:17 UTC (Fri) by drag (guest, #31333) [Link] (3 responses)

> So a minimally functioning brain can be assumed.

I doesn't matter how functional your brain is, it sucks at remembering arbitrary strings. Unless you are some sort of idiot savant.

> Now what is required to the brain is not much more elaborated than that.

No what is required for the brain is to do something it's not designed for.

> From the list of partial passwords, say written on paper, but not necessarily, you modify the partial passwords with a simple rule, like:
> - adding your pet name to the written down partial passwords (not very good actually), better
> - replacing the last 3 characters with the next ones in the alphabet, or
> - swapping the odd and even positioned characters,
> - etc.

None of that is very good, actually.

I have 5 sets of passwords I need to memorize for work.
I need a unique password for each website I need account for. That is probably about 10 or 15 different websites.
They include:
My bank
My mortgage company
My house insurance company
My car insurance company
My credit card
Power company
The power company for my rental
The water and sewage company for my house
The water and sewage company for my rental.
this website
gmail
some other websites.

and a few other dozens websites I use for various reasons. A lot of them I very rarely use, but when I need to use them it's somewhat important.

You tell me you can memorize all these and keep them straight by just swapping out pet names or doing random 3 letter word combinations. I have probably about 30 different passwords that need to be kept track of. A average person who uses the internet for bills and social media stuff probably has at least 15 accounts they need to keep track of.

What you are suggesting is all incredibly bad advice that will lead to a forgotten passwords, lots of password recoveries, lots of phone calls to the help desk at work. People will invariably choose to use shorter and simpler passwords and using the same passwords over and over again. Even if they are smart and try to use a good policy it will just end up punishing them and pushing them towards bad password management habits.

This sort of really bad advice that is repeated over and over again is exactly why people get their crap broken into. This contributed to why Debian got hacked. Fedora got hacked. Kernel.org got hacked. This is why people were able to gain access to source code repositories and key signing servers and all sorts of sensitive places like that. 90 times out of a 100 it is not a software vulnerability; it's because some goofball used a password to access a system that was hacked or should not of been trusted and they used the same password, or variation of it, on something that was actually important or their own workstation (and allowed ssh access from the internet).

People _should_
- Use unique passwords, _always_.
- Use very long passwords. Minimal 8 letters. Better of with 16, better off with 32, etc.
- Use random passwords.
- Passwords not based on favorite names or important dates or favorite teams, etc
- Passwords NOT based on words or misspelling of words. Swapping around letters is NOT useful. Substituting special characters for letters is NOT useful. Tacking on numbers to the end of words is NOT useful. These increase the difficulty of accurately remembering passwords massively while at the same time only trivially more difficult for a attacker to brute force or guess.

Trying to keep that straight in your head is very counter productive. It's better to not even try. Once you give up the need to try to memorize passwords then using proper passwords is massively easier.

> """able to remember that you wrote down the passwords on the pad of paper"""

Now compare all that to something that humans are actually very good at like:

"Were did I leave my wallet?"
"Were are my car keys?"
"Which drawer in my desk did I leave my password book in?"

If you don't know these then it's very easy to find out answers relatively quickly with usually minimal work.

Now if you don't use your online bank account but once every 3 or 4 months to check your balance... what are the chances you'll be able to recall a password that is _actually_secure_?

I understand a paper pad is not suitable for all purposes and is vulnerable to theft. Password managers are almost as good.

For Linux users something that is simple would be a LUKS encrypted USB key or something like that to store a text file of passwords or something like that. Real password managers are probably better, as long as you know how they function and keep their 'vaults' backed up to multiple systems. Encrypted files generally can be trusted so even if you back your password vaults up to insecure systems, you will be OK as long as you don't actually try to access their contents on those systems.

Some websites I use crap passwords because I am lazy. This is very hard to avoid.

But when I am doing good I always use passwords like this:

wee4eev1zaej,ah7EiCh
qui0hoh7OHaa<g1aetae
dae\Pae9aengo7OoPia:
wieYooNgoa1aijee[Gie
il2Sie2Jie1aevoh$soo
Xith7iez5ca,uf4eephu
za'es1ki5ooSh1xie1va
Aexu5ji{h1ahdahpo2ti
athae4Cemae9zoh+hiev
aQuia!xie5lef{i0Ooth

That is randomly generated stuff by using the 'pwgen' command, because creating new passwords is irritating and time consuming. In this case it was "pwgen -c1y 20 10" When I feel like being paranoid I won't even trust pwgen output.

For passwords that I need to recall on a continious basis, which is about 2-3 that I absolutely use on a daily basis I can memorize something strings like above. After using a password like that for a few weeks in situations were I must use it over and over and over again I can actually recall it much better using muscle memory then I can with just thinking about it. It's a bit silly feeling to have to sit down and close my eyes and type a password out to gedit to be able to recover it, but it is not atypical.

But lately I've been basing passwords on random strings of english words that end up about 20-30 characters long, for passwords I must use very often. No intentional mispellings or '7331' speak or any of that nonsense. They take a long time to type out, but accuracy increased massively and now I have to make less phone calls to unlock my accounts. For commonly used passwords changing them every month or two is critical.

(by-the-way: password lock-out policies are asinine. It amazes me that they don't understand that a person with simple shell script and a list of usernames can trivially perform a DOS attack on any major corporation that uses a password lock-out policy.. So irritating.)

A Periodic Table of password managers

Posted Nov 12, 2011 3:34 UTC (Sat) by djao (guest, #4263) [Link]

I don't think you properly understood the original proposal.

You have about 30 different passwords to keep track of. That's about average. You seem to be in favor of writing them down, whether on a pad of paper or in a password manager. That's quite understandable.

The problem is that, if someone malicious gets that piece of paper or breaks into your password manager, then they have EVERYTHING. The proposed countermeasure is to apply a single, simple, fixed, easy to remember, and easily reversible transformation to each password in your list. In other words, what you write down in your list is not your "real" password. Instead your real password is some simple (always the same) variation upon what is written down.

You would not write down the details of what this transformation is. You have to remember it in your head. But you only have to remember this one single simple rule. The argument is that remembering this one thing is not much harder than remembering the passphrase to your password manager, or the location of your paper pad. The benefit is that if an adversary succeeds in obtaining your list of passwords, they don't automatically get everything.

Nobody is suggesting that you memorize 30 different passwords or 30 different rules.

A Periodic Table of password managers

Posted Nov 12, 2011 22:00 UTC (Sat) by mgedmin (guest, #34497) [Link] (1 responses)

Diceware is good for generating random but easy to remember passphrases. It's basically a world list with some instructions about picking up a number of words by using physical dice as a random number generator, and some calculations how many words you need for a given password strength.

A Periodic Table of password managers

Posted Nov 17, 2011 15:04 UTC (Thu) by mmendez (subscriber, #81435) [Link]

I have been using a Firefox addon called passwordmaker for a few years. It hashes a 'master password', that you keep in your head, along with some salts (domain name, prefix modifiers ...) and generates passwords using a list of characters.

So the password is never stored in any format. If someone were to grab the password configuration they would still need to know your 'master password', which being a single/often used password should be easy to remember even if it is complex.

A Periodic Table of password managers

Posted Nov 11, 2011 15:46 UTC (Fri) by mjthayer (guest, #39183) [Link] (1 responses)

> Instead of writing software, one can just combine local crypted or non-crypted information with information stored on distinct devices, including own brain or cell phone.

A colleague of mine just suggested a variant on this scheme: a tool which combines a password with an additional word to (deterministically) generate a new password. E.g. you combine your master password with the word "paypal" (using the word "paypal" as salt if you like) and get a unique password based on that.

A Periodic Table of password managers

Posted Nov 14, 2011 13:17 UTC (Mon) by vivi48 (guest, #6412) [Link]

I've been using this technique for years.
see for instance: http://www.venge.net/programs/twonz.html

A Periodic Table of password managers

Posted Nov 10, 2011 10:45 UTC (Thu) by Cato (guest, #7643) [Link] (6 responses)

That's just security by obscurity - finding encrypted files is not that hard by scanning for high entropy data, at which point your unique password manager had better be as good as the well known ones.

If you still want obscurity, how about modifying the source of one of these tools to replace common strings with something random, including filenames used? It won't do much good but you could then have more assurance that this obscure one is still more secure against brute forcing.

Attacks using GPUs and FPGAs for brute forcing are getting very cheap indeed (hundreds to thousands of dollars) so it is worth using proper salting and stretching (iterated hashing) of passwords to protect against brute forcing.

I think the biggest vulnerability for Linux desktop users is (a) any copies of the password manager's encrypted DB file on non-"Linux classic" OSs, particularly Windows or Android, and (b) web app passwords being stolen via SQL injection and other web server attacks. I would protect against the former by mandating two-factor authentication on all platforms (LastPass using Yubikey or Google Authenticator is one example) and against the latter by using a password manager.

A Periodic Table of password managers

Posted Nov 10, 2011 11:36 UTC (Thu) by danielpf (guest, #4723) [Link] (5 responses)

>That's just security by obscurity - finding encrypted files is not that >hard by scanning for high entropy data, at which point your unique password >manager had better be as good as the well known ones.

No, the best protection is not storing the whole information on the same computer. It is not obscurity, it is a physical barrier.
One part of information can stay in the brain (say "add the name of you cat after each stored password"), or on a portable device (a sheet in wallet, a cell phone), and the combination of the distinct pieces of information can follow a simple algorithm easy to remember (all cap letters are actually small, etc.).

But such methods as well as password managers do not hold against keyloggers.

A Periodic Table of password managers

Posted Nov 10, 2011 17:25 UTC (Thu) by drag (guest, #31333) [Link] (4 responses)

>But such methods as well as password managers do not hold against keyloggers.

If a attacker is present on your machine and can access your account there really is no method that is really useful. Any password you use is a password they can get.

A Periodic Table of password managers

Posted Nov 10, 2011 19:40 UTC (Thu) by danielpf (guest, #4723) [Link] (1 responses)

Yes, but there are other cases.

A keylogger can be a device hidden on the keyboard cable and broadcasting every single key.
A keylogger can be a hidden program injected by some mean (say a downloaded package).

Such situations do not need an attacker present on the machine.

A Periodic Table of password managers

Posted Nov 10, 2011 20:44 UTC (Thu) by felixfix (subscriber, #242) [Link]

That's quibbling. In those cases, the attacker is the keylogger, not the person who installed it, and it is on your machine, as was the installer when they installed the keylogger.

Use two-factor

Posted Nov 11, 2011 13:01 UTC (Fri) by Cato (guest, #7643) [Link] (1 responses)

The main defence against simple keyloggers is a second factor - if the authentication process calls your phone (like Google Authenticator or Duo Security), you will know some hacker has got your passwords and is trying them out. Since most keyloggers are installed en masse, this is quite a useful defence.

LastPass is a good password manager (free as in beer for desktop OSs, paid-for on mobiles) which now includes Google Authenticator support and has some other two-factor options (grids, biometrics, and Yubikey). See http://lastpass.com/

Although LastPass has the weakness of a cloud-based point of attack, the two-factor options make it more secure against keyloggers than the password managers listed here. It's still vulnerable to a targetted attack against the LastPass client plugin, but that's true of almost any authentication technique.

Use two-factor

Posted Nov 12, 2011 0:21 UTC (Sat) by drag (guest, #31333) [Link]

Yes. Against simple loggers then 2 factor auth is a good thing.

The main danger then changes from password stealing to session hijacking.