A Periodic Table of password managers

Posted Nov 10, 2011 17:25 UTC (Thu) by drag (guest, #31333)
In reply to: A Periodic Table of password managers by danielpf
Parent article: A Periodic Table of password managers

>But such methods as well as password managers do not hold against keyloggers.

If a attacker is present on your machine and can access your account there really is no method that is really useful. Any password you use is a password they can get.

to post comments

A Periodic Table of password managers

Posted Nov 10, 2011 19:40 UTC (Thu) by danielpf (guest, #4723) [Link] (1 responses)

Yes, but there are other cases.

A keylogger can be a device hidden on the keyboard cable and broadcasting every single key.
A keylogger can be a hidden program injected by some mean (say a downloaded package).

Such situations do not need an attacker present on the machine.

A Periodic Table of password managers

Posted Nov 10, 2011 20:44 UTC (Thu) by felixfix (subscriber, #242) [Link]

That's quibbling. In those cases, the attacker is the keylogger, not the person who installed it, and it is on your machine, as was the installer when they installed the keylogger.

Use two-factor

Posted Nov 11, 2011 13:01 UTC (Fri) by Cato (guest, #7643) [Link] (1 responses)

The main defence against simple keyloggers is a second factor - if the authentication process calls your phone (like Google Authenticator or Duo Security), you will know some hacker has got your passwords and is trying them out. Since most keyloggers are installed en masse, this is quite a useful defence.

LastPass is a good password manager (free as in beer for desktop OSs, paid-for on mobiles) which now includes Google Authenticator support and has some other two-factor options (grids, biometrics, and Yubikey). See http://lastpass.com/

Although LastPass has the weakness of a cloud-based point of attack, the two-factor options make it more secure against keyloggers than the password managers listed here. It's still vulnerable to a targetted attack against the LastPass client plugin, but that's true of almost any authentication technique.

Use two-factor

Posted Nov 12, 2011 0:21 UTC (Sat) by drag (guest, #31333) [Link]

Yes. Against simple loggers then 2 factor auth is a good thing.

The main danger then changes from password stealing to session hijacking.