Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have been wondering about the options available for managing passwords. However, they all seem to fail if the master password is compromised (which isn't a big surprise).

On one hand you have system's like LastPass which store all your passwords using a master password to encrypt them.

In other words, your computer encrypts your passwords with your email and master password and sends that data to Lastpass. When you authenticate with your master password at Lastpass.com, Lastpass.com returns all your encrypted passwords, which are decrypted locally on your computer with your email and master password.

On the other hand you have systems which take a master password and then can generate a unique (but always the same) password by adding the domain or other identifier. This is perhaps more safe in one way since nothing is ever stored or transmitted anywhere. However, it's less safe in another way since you can never change an individual site's password if it is ever compromised.

In both cases it seems that knowing the master password either gives you the other passwords, or allows you to generate them. Are their any other options? Am I missing any other large security problems these password managers create?

share|improve this question
add comment

1 Answer

Let's look at the risks.

Encrypted password database

To steal your passwords, the attacker has to steal the database. Then she has two options: steal the master password or guess/bruteforce it. Once the attacker has the database and master password, she has access to your current accounts until you change stored passwords.

Password generator (from a single master password)

To steal your password, the attacker has to steal your master password, or steal one of the derived passwords and guess/bruteforce the master password. Once she has it, she can generate any current and future passwords, until you stop using the generator with the same master password. Thus, using the password generator scheme (with at least one compromised derived password or the ability to quickly check derived password guesses) is roughly equivalent to the encrypted database scheme where the attacker has permanent read-only access to the encrypted database.

* * *

There are other problems with the second scheme: most password generators I've seen are insecure: they use fast hash/HMAC to generate passwords. Thus, if your master password has low entropy, it's easy to bruteforce it.

The most sensible password generator I've seen is described in this paper: A Convenient Method for Securely Managing Passwords . It uses a very slow hash to generate a secret seed from master password and stores it. It then hashes the master password again with a faster hash function, combines this hash with the stored seed and derives passwords from the result. This considerably slows down bruteforce attacks.

However, it's less safe in another way since you can never change an individual site's password if it is ever compromised.

It's possible to change passwords generated by the second scheme: just add some counter to the domain (e.g. "example.com" -> "example.com:2"), though this isn't convenient, as you have to remember the counter.

In both cases it seems that knowing the master password either gives you the other passwords, or allows you to generate them. Are their any other options? Am I missing any other large security problems these password managers create?

Unless you can remember many random passwords, using open source offline password manager with encrypted database (with correctly implemented encryption and key derivation) is probably the most secure scheme available. However, there are factors other than security to consider, for example, risk of losing the database, convenience, etc.

* * *

The linked password generator is insecure (even if used offline) if the master password has low entropy: it uses a single round of HMAC-SHA256 to derive passwords.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.