Groups > linux.debian.user > #194399

Re: Chaniging focus: security ouitside a password manager

From	likcoras <likcoras@riseup.net>
Newsgroups	linux.debian.user
Subject	Re: Chaniging focus: security ouitside a password manager
Date	2018-04-02 16:00 +0200
Message-ID	<vA8a6-24B-11@gated-at.bofh.it> (permalink)
References	<vxgdP-5Um-11@gated-at.bofh.it> <vz7pL-2ir-3@gated-at.bofh.it> <vzdOx-6GE-1@gated-at.bofh.it> <vA7nH-1KQ-5@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

On 04/02/2018 10:07 PM, rhkramer@gmail.com wrote:
>    * during copy and paste operations, the plaintext password could remain on 
> the C&P "stack". thus making it vulnurable:  Some notes:

This is a semi-valid concern, depends on your usage patterns. For
example, some browsers may expose a JS API that allows sites to read
your clipboard. Adobe Flash has a similar feature, IIRC.

Also, other applications running on your desktop may be able to read the
clipboard contents as well, but that would require user privileges on
your machine. Take that into account when deciding whether this is
something you need to be worried about.

>       (1) I've read about at least one password manager that, somehow, deletes 
> the plaintext password from the copy and paste "stack" after a time delay--I 
> didn't make a note of which one that was.  

I'm sure this is a relatively common feature in password manages. pass,
for example, has this feature. That's quite something, considering how
minimalistic it is compared to other, more fully-featured password
managers out there. It does just use xclip(1), though.

>From pass(1):

show [ --clip, -c ] pass-name
       Decrypt  and print a password named pass-name. If --clip
       or -c is  specified,  do  not  print  the  password  but
       instead  copy  the  first  line  to  the clipboard using
       xclip(1) and then restore the  clipboard  after  45  (or
       PASSWORD_STORE_CLIP_TIME) seconds.

>       (2) another approach could be that a password manager provides a 
> facility to write the password to a designated textbox without using the copy 
> and paste facility, thus, presumably, never putting the plaintext password on 
> the copy and paste "stack").

pass also has this feature, suggesting it is a common feature to may
password managers. Through a third-party script (available in contrib/
on the git repo, or /usr/share/doc/pass/examples/dmenu/ after
installation on debian), this is possible. It basically just makes a
call to xdotool(1) and passes in the password to be typed. xdotool
handles the actual typing. As a plus, works even when sites decide to
block c&p. Obviously, you could use some other front-end, or write one
yourself.

>    * during hibernation (or maybe suspend and resume): (I use neither at the 
> present time, but, one stores the machine's state (including RAM) to disk, the 
> other stores the (CPU) state to RAM while preserving the other contents of 
> RAM.)  Hibernation could result in the plaintext of passwords being stored on 
> disk while the power is off, making the plaintext passwords vulnurable if the 
> machine is stolen.

As Tomás said, make sure your swap partition is encrypted, if you bother
with disk encryption. Even when not hibernating, if you start swapping,
you may be storing valuable information in there without you knowing.
It's usually a Bad Idea to have a plaintext swap but encrypted data
partitions.

Moreover, proper crypto code would probably make sure to remove keys
from memory as quickly as possible, as soon as they're no longer
necessary. No idea if GPG does this, though. Might be worth looking into.

Thread

Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-25 18:00 +0200
  Re: Password Manager opinions and recommendations likcoras <likcoras@riseup.net> - 2018-03-25 18:40 +0200
    Re: Password Manager opinions and recommendations Ben Finney <bignose@debian.org> - 2018-03-26 00:10 +0200
  Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-25 19:50 +0200
    Re: Password Manager opinions and recommendations Roberto C. Sánchez <roberto@debian.org> - 2018-03-25 20:10 +0200
      Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-25 20:50 +0200
        Re: Password Manager opinions and recommendations Ángel <debian-user@debian.16bits.net> - 2018-03-25 23:20 +0200
          Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-26 21:40 +0200
            Re: Password Manager opinions and recommendations Mark Fletcher <mark27q1@gmail.com> - 2018-03-27 04:50 +0200
  Re: Password Manager opinions and recommendations Richard Hector <richard@walnut.gen.nz> - 2018-03-26 02:40 +0200
    Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-26 04:00 +0200
      Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-26 22:00 +0200
        Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-26 23:40 +0200
          Re: Password Manager opinions and recommendations Joe <joe@jretrading.com> - 2018-03-27 10:10 +0200
            Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 14:50 +0200
              Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 15:00 +0200
        Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 03:10 +0200
          Re: Update: Re: Password Manager opinions and recommendations Abdullah Ramazanoglu <ar018@yahoo.com> - 2018-03-27 03:40 +0200
          Re: Update: Re: Password Manager opinions and recommendations Kushal Kumaran <kushal@locationd.net> - 2018-03-27 07:00 +0200
            Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 14:40 +0200
          Re: Update: Re: Password Manager opinions and recommendations Joe <joe@jretrading.com> - 2018-03-27 10:00 +0200
            Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-27 14:50 +0200
          Re: Update: Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-27 13:20 +0200
            Re: Update: Re: Password Manager opinions and recommendations Richard Hector <richard@walnut.gen.nz> - 2018-03-28 04:30 +0200
              Re: Update: Re: Password Manager opinions and recommendations Brian <ad44@cityscape.co.uk> - 2018-03-28 12:40 +0200
          Re: Update: Re: Password Manager opinions and recommendations Tomaž Šolc <tomaz.solc@tablix.org> - 2018-03-30 14:00 +0200
            Re: Update: Re: Password Manager opinions and recommendations Curt <curty@free.fr> - 2018-03-30 14:50 +0200
              Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-30 16:10 +0200
                Re: Update: Re: Password Manager opinions and recommendations Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-03-31 01:00 +0200
            Storing "real" user data: was: Re: Update: Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-30 16:00 +0200
              Re: Storing "real" user data: was: Re: Update: Re: Password Manager  opinions and recommendations Greg Wooledge <wooledg@eeg.ccf.org> - 2018-03-30 16:20 +0200
              Re: Storing "real" user data: was: Re: Update: Re: Password Manager  opinions and recommendations "der.hans" <deb-user@LuftHans.com> - 2018-03-30 20:20 +0200
    Re: Password Manager opinions and recommendations "der.hans" <deb-user@LuftHans.com> - 2018-03-30 10:50 +0200
      Re: Password Manager opinions and recommendations rhkramer@gmail.com - 2018-03-30 15:20 +0200
        Re: Password Manager opinions and recommendations "der.hans" <deb-user@LuftHans.com> - 2018-03-30 21:00 +0200
          Re: Password Manager opinions and recommendations Andrew McGlashan <andrew.mcglashan@affinityvision.com.au> - 2018-03-31 03:50 +0200
            Chaniging focus: security ouitside a password manager (was: Re: Password Manager opinions and recommendations) rhkramer@gmail.com - 2018-04-02 15:10 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) <tomas@tuxteam.de> - 2018-04-02 15:20 +0200
                Re: Chaniging focus: security ouitside a password manager (was: Re: Password Manager opinions and recommendations) rhkramer@gmail.com - 2018-04-02 20:30 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) Roberto C. Sánchez <roberto@debian.org> - 2018-04-02 15:30 +0200
              Re: Chaniging focus: security ouitside a password manager likcoras <likcoras@riseup.net> - 2018-04-02 16:00 +0200
              Re: Chaniging focus: security ouitside a password manager Ben Finney <bignose@debian.org> - 2018-04-03 01:30 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) "der.hans" <deb-user@LuftHans.com> - 2018-04-03 02:10 +0200
              Re: Chaniging focus: security ouitside a password manager Richard Hector <richard@walnut.gen.nz> - 2018-04-03 08:00 +0200
                Re: Chaniging focus: security ouitside a password manager rhkramer@gmail.com - 2018-04-03 13:50 +0200
                Re: Chaniging focus: security ouitside a password manager Cindy-Sue Causey <butterflybytes@gmail.com> - 2018-04-03 18:30 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) Brian <ad44@cityscape.co.uk> - 2018-04-03 11:40 +0200
              Re: Chaniging focus: security ouitside a password manager (was: Re:  Password Manager opinions and recommendations) Brian <ad44@cityscape.co.uk> - 2018-04-03 21:10 +0200
  Re: Password Manager opinions and recommendations Abdullah Ramazanoglu <ar018@yahoo.com> - 2018-03-26 03:40 +0200
    Re: Password Manager opinions and recommendations Abdullah Ramazanoglu <ar018@yahoo.com> - 2018-03-26 04:20 +0200
      Re: Password Manager opinions and recommendations Ben Caradoc-Davies <ben@transient.nz> - 2018-03-26 05:10 +0200
  Re: Password Manager opinions and recommendations Ben Caradoc-Davies <ben@transient.nz> - 2018-03-26 04:00 +0200

csiph-web