Comment by Aachen
2 days ago
Isn't this a fundamental issue with all popular password managers? Your setup where each decrypt requires a physical action is superior of course (even if an attacker is still likely to get 2-3 of the most important secrets before you start to investigate why a login isn't working), I just mean that most people don't have this and it's not a particular flaw with OP's implementation right?
It is a negligent and blatant design flaw in all popular implementations, yes. Mooltipass and Password Store are the only two password managers to do the bare minimum. That is ridiculous.
Anyone who corrects this, with a good UX solution, will win the password manager wars. It is so so so easy to do, so it is unthinkable only the CLI password manager written in bash bothers to do it.
Ask an LLM to implement it for you if you must, but no one has any excuse to skip the most basic security function of a password manager: do anything at all to protect it from malware.
The bar for password managers is in hell.
> Anyone who corrects this, with a good UX solution, will win the password manager wars.
In some technical sense, not necessarily in popularity.
You can’t have a good UX with this setup, which is why none of the major password mangers do it.
Of course you can.
Random non technical executive goes to a login page, and a popup happens on an external device like a phone or keychain dongle, watch, or any secondary display that asks "Allow aws.amazon.com root access to open browser tab on laptop xyz?" and if the page you are on right now says "doordash.com" and you did not ask to decrypt aws root credentials, then you say "nope, that does not seem right" and the attack is stopped cold.
The first mistake was letting non technical executive have aws root access in the first place, but the password manager only releasing a single credential at a time with a physical button press on a trusted screen can still be a last line of defense for our most sensitive credentials.
Being user friendly and being able to have any defense at all against malware are not mutually exclusive.
2 replies →