Let's expand that specifically generic headline. ""You probably can't trust anything if it's been compromised". More extra non-news at eleven.
Uhhhh.... What even is this headline
Ya think?
🤯
If the entire supply chain up to the software you're running to perform actual decryption is compromised, then the decrypted data is vulnerable. I mean, yeah? That's why we use open-source clients and check builds/use builds from separate source, so that the compromission of one actor does not compromise the whole chain. Server (if any) is managed by one entity and only manage access control + encrypted data, client from separate trusted source manage decryption, and the general safety of your whole system remain your responsibility.
Security requires a modicum of awareness and implication from the users, always. The only news here is that people apparently never consider supply chain attacks up until now?
JFC this headline. BREAKING NEWS: Healthy people die off an old age.
Jfc this headline is almost as bad.
Password managers are supposed to be designed to resist a situation where they're compromised, and are only ever supposed to see a mysterious blob of encrypted data without ever having access to any information that would help decrypt it. The headline's more like M1 Abrams Tanks Vulnerable to Small Arms Fire - it'd be totally expected that most things die when shot with bullets, but the point of a tank is that it doesn't, so it's a big deal if it does.
Things you should know: Your car won't drive after it's broken down.
I'll be honest, password managers are like the holy grail of desirable to breech. If you're using one it will be constantly under attack. It being breeched or vulnerable shouldn't be a surprise. There isn't really a secure way to store large amounts of passwords that doesn't have some vulnerability issues.
breech
breach, right?
That's why I liked password store, no servers, just my encrypted password files on my own computer, that I sync over to my other devices.
Apparently it's dying soon through, so I need an alternative.
I use passwordsafe, no issues there
Edit, sorry, misread your comment, my reply was irrelevant.
i use keepassxc for the offline database part, and syncthing to sync it (among other things) between all my devices
I was enjoying 1Password until they went completely subscription, so I switched to Strongbox (based on Keepass) and it's been pretty good. DB stored locally and I use my own tools to sync that vault to my other devices.
You probably can't trust anything if it's compromised
Well the specific point here is that these companies claim that a server hack won't reveal your passwords since they're encrypted and decrypted on your local device so the server only sees the encrypted version. Apparently this isn't completely true.
At the point someone pulls off a valid MIM attack - which is basically a requirement here unless the whole BW/Vaultwarden server gets compromised- that is the least of someones problems. MIMs are incredibily hard these days.
Are you trying to say the front fell off?
That's not very typical
It wasn’t designed for the front to fall off, that’s for sure!
Well, what sort of standards are these tools built to?
For the front to stay on!
Yeah, the title there really doesn't reflect the article text. It should be "you probably can't trust your password manager if the remote servers it uses are compromised".
Additional vendor responses by Bitwarden to put the remediations and threat models into perspective:
No shit?
These password managers claim your passwords are secure, even if their servers get compromised, which is what is expected from a security standpoint. But that is apparently not the case.
What a headline
I just write down password hints on a scrap of paper.
If you don't have to use your passwords from multiple locations, your hints are intelligible only to you, and you don't leave the paper anywhere too obvious, this isn't a bad solution.
Since the summary doesn't say which three popular password managers:
As one of the most popular alternatives to Apple and Google's own password managers, which together dominate the market, the researchers found Bitwarden was most susceptible to attacks, with 12 working against the open-source product. Seven distinct attacks worked against LastPass, and six succeeded in Dashlane.
And glosses over what it claims are the two that dominate market (combined market share of 55%) which negates their headline, since it's likely the reader is using one of those two password managers.
Bitwarden says all issues have already been addressed.
https://bitwarden.com/blog/security-through-transparency-eth-zurich-audits-bitwarden-cryptography/
Bitwarden. Shit.
These attacks are more around the encryption and all require a fully malicious server. It sounds like Bitwarden is taking these seriously and personally I'd still strongly prefer it to any closed source solution where there could be many more unknown but undiscovered security concerns.
Using a local solution is always most secure, but imo you should first ask yourself if you trust your own security practices and whether you have sufficient hardware redundancy to be actually better. I managed to lose the private key to some Bitcoin about a decade ago due to trying to be clever with encryption and local redundant copies.
Further, with the prevalence of 2FA even if their server was somehow fully compromised as long as you use a different authenticator app than Bitwarden you're not at major risk anyways. With how poorly the average person manages their password security this hurdle alone is likely enough to stop all but attacks targeted specifically at you as an individual.
This is a most excellent place for technology news and articles.
