Hot Take Password Managers Auto-filled Credentials on Untrusted sites

[enaph]

Security shortcomings mean that multiple password managers could be tricked into auto-filling credentials on untrusted pages, security researchers at Google warn.

The team from Google went public with their findings on Tuesday (17 January), 90 days after notifying the applications – Dashlane, Bitwarden, and the built-in password manager bundled with Apple’s Safari browser – of the vulnerabilities.

Both Dashlane and Bitwarden have updated their software although Dashlane, at least, remains unconvinced that the bug represents any kind of security threat. The status of any fix for Apple’s Safari built-in password manager remains unconfirmed at the time of writing. The Daily Swig has asked Apple to comment and we’ll update this story as and when more information comes to hand.

Popular password managers auto-filled credentials on untrusted websites

Dashlane, Bitwarden, and Safari all cited by Google researchers

portswigger.net

 

[Divine_Barakah]

Here we go again. I disabled autofill altogether

 

[blackice]

Here we go again. I disabled autofill altogether

Then you get to worry about clipboard stealers.

 

[Divine_Barakah]

The you get to worry about clipboard stealers.

No I do not copy and paste. I just stopped autofilling. Enpass does suggest credential and I ask it to fill them for me after I make sure the website I landed to is legit.

 

[piquiteco]

Bitwarden never fills logins automatically unless you enable it in settings. 1password also never fills logins automatically, you select the credentials manually before logging in and Sticky Password I disabled since I started using it. Dashlane I can't tell you because I don't use it.

 

[Digmor Crusher]

Not sure what you mean by automatically. With Bitwarden if your logged in you just go to any site you have saved and click on the login button, BW pops up for that site, you click on it and your logged in.

 

[piquiteco]

Not sure what you mean by automatically. With Bitwarden if your logged in you just go to any site you have saved and click on the login button, BW pops up for that site, you click on it and your logged in.

By default in Bitwarden this option is unchecked "If a login form is detected, automatically perform an auto-fill when the web page loads." And then just below the checkbox comes this warning

Spoiler

 

[Digmor Crusher]

By default in Bitwarden this option is unchecked "If a login form is detected, automatically perform an auto-fill when the web page loads." And then just below the checkbox comes this warning

Spoiler

View attachment 272327

Thanks, I forgot about that setting.

 

[piquiteco]

Thanks, I forgot about that setting.

You are welcome.

 

[HarborFront]

Regarding the topic. Since BW has updated their software so it means it's safe to use autofill

 

[piquiteco]

Regarding the topic. Since BW has updated their software so it means it's safe to use autofill

Yes, it is secure, but I wouldn't use auto-complete if I were you, tomorrow or the day after, a vulnerability arises, suddenly when you least expect it, Bitwarden starts dumping your credentials on any website, then you can have a headache. Remember security and technology and convenience go hand in hand, but it comes at a price. Don't forget that. He who warns is a friend.

 

[HarborFront]

Yes, it is secure, but I wouldn't use auto-complete if I were you, tomorrow or the day after, a vulnerability arises, suddenly when you least expect it, Bitwarden starts dumping your credentials on any website, then you can have a headache. Remember security and technology and convenience go hand in hand, but it comes at a price. Don't forget that. He who warns is a friend.

You can lock/unlock the vault in the extension

 

[piquiteco]

You can lock/unlock the vault in the extension

Yes, it's true, I had forgotten that detail.

 

[n8chavez]

If you really want to be safe you'd use keepass, where your database is store on space you control (encrypted cloud or local), use a keyfile (disguised as a random docx or jpg, stored somewhere different than your database), and your 15+ character password. Don't use any browser extension that tie into it. They are not needed, if you learn the features of Keepass. Using any addons only potentially weakens its security.

At this point is it really worth it to use a cloud-based service where you cannot control the storage? I wouldn't trust any of them anymore.

 

[Digmor Crusher]

Trying Enpass now, I really like it, nice gui, simple to set up, local storage, not a lot of bells and whistles but it signs me into my sites quite easily, what more do I need? Tried Keepass as well, it was a total mess trying to figure it out. The only possible negative with Enpass in the free version is that it only allows 25 items for mobile vaults, but that's probably 20 more than I need anyways as I never sign into anything on my phone except maybe for Ticketmaster for concert or hockey tickets or email.

 

[HarborFront]

Trying Enpass now, I really like it, nice gui, simple to set up, local storage, not a lot of bells and whistles but it signs me into my sites quite easily, what more do I need? Tried Keepass as well, it was a total mess trying to figure it out. The only possible negative with Enpass in the free version is that it only allows 25 items for mobile vaults, but that's probably 20 more than I need anyways as I never sign into anything on my phone except maybe for Ticketmaster for concert or hockey tickets or email.

Enpass don't support non-code signed browsers like Ungoogled Chromium and LibreWolf. Also, its android app has trackers

A detailed review here

Enpass Review 2024: Is It a Good Password Manager?

Is Enpass the best password manager for you? Is it safe and secure? How well will it protect your computer? Does it work well on mobile or just desktops? Find out all of this and more in this in-depth review of Enpass.

www.safetydetectives.com

 

[Gandalf_The_Grey]

If you really want to be safe you'd use keepass, where your database is store on space you control (encrypted cloud or local), use a keyfile (disguised as a random docx or jpg, stored somewhere different than your database), and your 15+ character password. Don't use any browser extension that tie into it. They are not needed, if you learn the features of Keepass. Using any addons only potentially weakens its security.

At this point is it really worth it to use a cloud-based service where you cannot control the storage? I wouldn't trust any of them anymore.

Even Keepass is not totally safe, however the creator doesn't agree:

** DISPUTED ** KeePass through 2.53 (in a default installation) allows an attacker, who has write access to the XML configuration file, to obtain the cleartext passwords by adding an export trigger. NOTE: the vendor's position is that the password database is not intended to be secure against an attacker who has that level of access to the local PC.

NVD - CVE-2023-24055

nvd.nist.gov

 

[HarborFront]

If you really want to be safe you'd use keepass, where your database is store on space you control (encrypted cloud or local), use a keyfile (disguised as a random docx or jpg, stored somewhere different than your database), and your 15+ character password. Don't use any browser extension that tie into it. They are not needed, if you learn the features of Keepass. Using any addons only potentially weakens its security.

At this point is it really worth it to use a cloud-based service where you cannot control the storage? I wouldn't trust any of them anymore.

Correct me if I'm wrong

Does KeePass copy&paste passwords? If yes, then any keylogger can capture what's on the clipboard, right? Does KeePass come with a time setting to clear the clipboard?

BW autofills using copy&paste passwords and it comes with a time setting to clear the clipboard. The time set to clear the clipboard can be chosen from the extension

 

[Arequire]

Correct me if I'm wrong

Does KeePass copy&paste passwords? If yes, then any keylogger can capture what's on the clipboard, right? Does KeePass come with a time setting to clear the clipboard?

It does copy passwords and auto-clears the clipboard after a set amount of time (which can be changed in the settings).

 

[JustInTime]

It does copy passwords and auto-clears the clipboard after a set amount of time (which can be changed in the settings).

Does clipboard have access to auto-type entry feature as well?