Vulnerabilities in Password-Manager Apps

A theme of this work is vulnerabilities in the &quot;internal browser&quot; some of the mobile password managers provide. Mobile password managers have internal browsers because it&#x27;s not easy to extend the standard mobile browsers, and password managers want to automate the entry of passwords into form fields.<p>Don&#x27;t use the internal browser of your password manager, no matter which one you use. There&#x27;s too much that can go wrong, and the small convenience just isn&#x27;t worth it.

So, all three of the LastPass issues have been fixed, and within two weeks of being reported, to boot:<p><pre><code> * 2016-08-22 Vulnerability Discovered * 2016-08-24 Vulnerability Reported * 2016-09-06 Vulnerability Fixed</code></pre>

One of the 1Password ones (<a href="https:&#x2F;&#x2F;team-sik.org&#x2F;sik-2016-040&#x2F;" rel="nofollow">https:&#x2F;&#x2F;team-sik.org&#x2F;sik-2016-040&#x2F;</a>) about leaking URLs is marked as fixed, however, that&#x27;s a little misleading. It&#x27;s fixed if you use their newer vault format, which has limitations, and is <i>not</i> selected by default when you create a new vault. I wrote this about it a while back: <a href="https:&#x2F;&#x2F;myers.io&#x2F;2015&#x2F;10&#x2F;22&#x2F;1password-leaks-your-data&#x2F;" rel="nofollow">https:&#x2F;&#x2F;myers.io&#x2F;2015&#x2F;10&#x2F;22&#x2F;1password-leaks-your-data&#x2F;</a>

This is why I still go to the trouble of PGP encrypting a file with my passwords, rather than relying on a password manager. I keep wanting to switch, but damn it, I just can&#x27;t bring myself to have that much trust in them.<p>Edit: Thanks for the informative replies, the links, and the advice. I&#x27;m going to explore all of my options and re-think this.

Some older papers on security vulnerabilities of password managers:<p><a href="https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;09&#x2F;security_of_pas.html" rel="nofollow">https:&#x2F;&#x2F;www.schneier.com&#x2F;blog&#x2F;archives&#x2F;2014&#x2F;09&#x2F;security_of_p...</a><p>Any thoughts on Bruce Schneier&#x27;s PasswordSafe password manager?

What about enpass? That would be very interesting since they also promise to be very secure.

Tangentally related:<p><a href="https:&#x2F;&#x2F;github.com&#x2F;SirCmpwn&#x2F;pass-rotate" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;SirCmpwn&#x2F;pass-rotate</a><p>I posted it on here the other day but it didn&#x27;t go far. It&#x27;s like youtube-dl but instead of downloading videos it changes your password on various online services. If you get your password compromised by vunlerabilities or whatnot it makes it easy to mass-rotate your passwords. Could use some help adding support for more websites if you&#x27;re interested.<p>&lt;&#x2F;shameless promo&gt;

I looked at the LastPass ones (all for Android) and they look relatively minor. The only real wtf is <a href="https:&#x2F;&#x2F;team-sik.org&#x2F;sik-2016-022&#x2F;" rel="nofollow">https:&#x2F;&#x2F;team-sik.org&#x2F;sik-2016-022&#x2F;</a> - hardcoding keys should be a big nope. Still, it happens only if you use a PIN rather than your master password; I hope this does not happen in iOS if you use TouchID...?

Looks like all of the 1Password issues were discovered and fixed last September.

I just use iCloud keychain. The third party ones can never be as secure. For non-safari usage a little less convenient but worth it.

Site&#x27;s down. Text-only cached version at least lets you read some of the content: <a href="http:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:kJ5Zk-7KPswJ:https:&#x2F;&#x2F;team-sik.org&#x2F;trent_portfolio&#x2F;password-manager-apps&#x2F;&amp;num=1&amp;hl=en&amp;gl=us&amp;prmd=ivn&amp;strip=1&amp;vwsrc=0" rel="nofollow">http:&#x2F;&#x2F;webcache.googleusercontent.com&#x2F;search?q=cache:kJ5Zk-7...</a>

We need the same kind of investigation for iOS, this kind of research was so much needed because after all this is where we store all of our entire internet identities, good job!

Just my brief experience of 2-3 hours with LastPass today. Broken javascript errors when trying to import. Searched for customer support, couldn&#x27;t find any! How do I file bugs? Sign up and post to their web forum?<p>I noticed their website is made entirely in php. Not that php is bad, but this is possibly the worst choice for a web platform that holds secrets. At only $12 a year, they probably aren&#x27;t trying very hard.

Anyone seen anything similar on Roboform? Been using them for years but I wonder how much vulnerability testing it has gotten.

I have moved from LastPass to Dashlane and rarely have issues. Its been fairly solid for me the past year or so. Anyone had issues with Dashlane?

Avast are still working on vulnerabilities reported in November 2016. They seem by far the least responsive of the apps mentioned.

<a href="https:&#x2F;&#x2F;ssl.masterpasswordapp.com&#x2F;" rel="nofollow">https:&#x2F;&#x2F;ssl.masterpasswordapp.com&#x2F;</a>

shocked I didn&#x27;t&#x27; see bitwarden in here?<p>I use Bitwarden for some things (lots of testing, nothing serious). Given its OSS nature, i thought it might have had more traction.<p>For reference: <a href="https:&#x2F;&#x2F;github.com&#x2F;bitwarden" rel="nofollow">https:&#x2F;&#x2F;github.com&#x2F;bitwarden</a>

Too bad 1Password doesn&#x27;t encrypt title and URLs.

Password Safe is missing …

Not surprising. Password manager give you convenience at the expense of security.