Take the 2-minute tour ×
Cryptography Stack Exchange is a question and answer site for software developers, mathematicians and others interested in cryptography. It's 100% free, no registration required.

I have been wondering about the options available for managing passwords. However, they all seem to fail if the master password is compromised (which isn't a big surprise).

On one hand you have system's like LastPass which store all your passwords using a master password to encrypt them.

In other words, your computer encrypts your passwords with your email and master password and sends that data to Lastpass. When you authenticate with your master password at Lastpass.com, Lastpass.com returns all your encrypted passwords, which are decrypted locally on your computer with your email and master password.

On the other hand you have systems which take a master password and then can generate a unique (but always the same) password by adding the domain or other identifier. This is perhaps more safe in one way since nothing is ever stored or transmitted anywhere. However, it's less safe in another way since you can never change an individual site's password if it is ever compromised.

In both cases it seems that knowing the master password either gives you the other passwords, or allows you to generate them. Are their any other options? Am I missing any other large security problems these password managers create?

share|improve this question

1 Answer 1

Let's look at the risks.

Encrypted password database

To steal your passwords, the attacker has to steal the database. Then she has two options: steal the master password or guess/bruteforce it. Once the attacker has the database and master password, she has access to your current accounts until you change stored passwords.

Password generator (from a single master password)

To steal your password, the attacker has to steal your master password, or steal one of the derived passwords and guess/bruteforce the master password. Once she has it, she can generate any current and future passwords, until you stop using the generator with the same master password. Thus, using the password generator scheme (with at least one compromised derived password or the ability to quickly check derived password guesses) is roughly equivalent to the encrypted database scheme where the attacker has permanent read-only access to the encrypted database.

* * *

There are other problems with the second scheme: most password generators I've seen are insecure: they use fast hash/HMAC to generate passwords. Thus, if your master password has low entropy, it's easy to bruteforce it.

The most sensible password generator I've seen is described in this paper: A Convenient Method for Securely Managing Passwords . It uses a very slow hash to generate a secret seed from master password and stores it. It then hashes the master password again with a faster hash function, combines this hash with the stored seed and derives passwords from the result. This considerably slows down bruteforce attacks.

However, it's less safe in another way since you can never change an individual site's password if it is ever compromised.

It's possible to change passwords generated by the second scheme: just add some counter to the domain (e.g. "example.com" -> "example.com:2"), though this isn't convenient, as you have to remember the counter.

In both cases it seems that knowing the master password either gives you the other passwords, or allows you to generate them. Are their any other options? Am I missing any other large security problems these password managers create?

Unless you can remember many random passwords, using open source offline password manager with encrypted database (with correctly implemented encryption and key derivation) is probably the most secure scheme available. However, there are factors other than security to consider, for example, risk of losing the database, convenience, etc.

* * *

The linked password generator is insecure (even if used offline) if the master password has low entropy: it uses a single round of HMAC-SHA256 to derive passwords.

share|improve this answer
    
Would not stealing a generated password be considerably harder than stealing a password database? A generated password would usually be stored on a server as hash right? While password database would be stored as is. So you could immediately use a dictionary attack on the database. While you need an extra step to get hold of the hashed derived password. Or am I missing something here? –  Adam Smith Apr 23 at 18:17
    
@AdamSmith the difference between bruteforcing/running dictionary attack on encrypted password database and a hash of the generated password is only in the cost of the hash operation. E.g. if password database is encrypted with a key derived with PBKDF2-HMAC-SHA256 with 100,000 iterations and the password generator generates passwords by running 100,000 iterations of PBKDF2-HMAC-SHA256, and a website that leaked passwords uses bcrypt to hash passwords, then guessing the master password for password generator (bcrypt(PBKDF2-SHA256(master_password))) is only harder for the cost of bcrypt. –  dchest Apr 29 at 21:59
    
wouldn't it be harder than this? Should we not assume the use of a salt for PBKDF2-HMAC-SHA256. The attacker will only know the salt used for bcrypt. So if the master password is "foobar" for both encrypted database and deterministically generated password. Then my dictionary attack for the database just needs to find "foobar". While the attack on my generated password needs to find "foobar"+salt. Which means for every entry in the dictionary they will have to try every possible salt. Wouldn't that be way more expensive? –  Adam Smith May 1 at 9:46
    
@AdamSmith It is assumed that salt is a public value: usually password generators use site address for it, e.g. PBKDF2("master password", "google.com"). If the salt is secret (let's call it a "secret seed", because salt is reserved for a different term) and has enough entropy (e.g. 128 bits), then it's infeasible to guess the master password. However, this is not the scheme discussed here (deriving many passwords from a single one), as the user has to remember a random value along with the master password for it to work. –  dchest May 2 at 7:33
    
okay that is a good point. I've seen generators though which I believe stores data locally for the salt. Variations of the scheme: plevyak.com/dpg.html. Where a lot of extra data which the user could reproduce more easily than something completely random. A deterministic password generator could also be used with multiple master passwords. E.g. you use different passwords as seed for different categories of websites. I am challenging you in this point, because I want to create a secure deterministic generator, but I want to be aware of weaknesses. Thanks for your great input –  Adam Smith May 2 at 11:55

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.