stealing master passwords is just not that big a deal

by now a lot of people have heard the news that a new version of the citadel trojan steals the master password for password management software. a LOT of electrons have gone into reporting this new development over and over and over again, but it really doesn't seem like it's a big enough deal to warrant all this attention.

while it may be novel to use keylogging to steal specific passwords for password management software, password stealers and keyloggers are anything but new, and the biggest difference between having this new version of citadel on your system or a traditional keylogger is basically that citadel will be able to collect (and therefore compromise) all your passwords faster than a normal keylogger (all at once vs. piecemeal).

that's really all there is to it. from the perspective of a potential victim, citadel isn't doing anything really new, it's just doing it more efficiently. password stealing malware has been out there for a long time and password managers were never meant to combat that particular threat to password security. password managers are meant to facilitate the use of strong, unique passwords which in turn serves to mitigate the risk of compromises to remote systems - compromising the local system is an entirely different problem.

at the end of the day, you can't operate securely with a compromised computer. even if you were to use 2 factor authentication (which could conceivably render password stealing moot) everything else you enter or access would be exposed to potential theft or manipulation if you're using a compromised computer.

i realize it may seem awkward that a class of software security pros have been promoting for years in order to improve security is now being targeted by malware, but it's only awkward because such a needlessly big deal is being made out of it. password management software still mitigates the same risks associated with remote compromises that it always did,  and you're as hosed as you ever were in the event of a local compromise. nothing has actually changed for the people trying to keep their things secure so stop acting like this development changes anything - it doesn't.

on the strength of authentication factors

i ran across a story on friday about barclays bank rolling out biometric authentication for online banking and wound up starting a debate on twitter that i didn't have time for and couldn't easily fit into a series of tweets even if i did have time. essentially what it came down to was that i don't believe all authentication factors are equally strong and the statement that the barclays system was a "password replacement" raised a red flag for me.

the reason it raised a red flag for me is because single factor biometric authentication is something i've come across before, and not just in an article on the web or even as a user but as a builder. my first job out of university was with a biometric security company, and one of the biggest projects i had while working there was developing an authentication enhancement for windows logon. one of the requests made (and the one i fought the hardest against) was to allow logon with just the biometric. 

here's the problem with this idea - since windows didn't have biometric capabilities built in, the only way to add single factor biometric authentication in was to store more traditional authentication data that windows could accept (such as a password) and then pass that along to windows when the subject's biometric sample matched the registered biometric template. i should note that the article about barclays makes it clear they'll be doing the same thing since they say that barclays won't be storing customer biometric data on their servers. there will have to be a local biometric client that stores more traditional authentication data and passes it on when a biometric match is achieved. storing credentials is not exactly the safest thing in the world. it's not like you can just store a hash of the authentication data in this scenario because you have to be able to present the original, unmodified credentials to the authentication system.

i balked at the idea of making windows less instead of more secure, but i acquiesced when the decision was made to keep the more secure 2 factor mode of operation (without traditional credential storage) in there as well, along with informing the users that biometric-only logon was less secure. 

it's not just less secure because of the credential storage, though, and this is where the twitter debate on friday ventured into. in the course of that job i had the opportunity to examine multiple biometric systems, such as face, voice, iris, etc. and i came away with 2 realizations: 1) the only biometrics that users will ever accept are non-invasive ones (no one wants sensors stuck into them), and 2) that lack of invasiveness makes it relatively easy to steal biometric samples from users, often without them even knowing. fingerprints can be lifted from anything you touch. recordings of your voice can be made without your knowledge. photographs of faces are ubiquitous and a high enough resolution image will capture your iris pattern. 

other authentication factors like passwords and tokens generally rely on restricting access to the authentication data, often through secrecy. when that secrecy is lost, such as when someone takes a photograph of a door key (which is a kind of token) it becomes relatively easy to reproduce the authenticator and gain access to what was being protected. biometrics, especially non-invasive ones, forgo this secrecy under the mistaken belief that reproducing the authenticator is difficult for biometrics. the reality, though, is that you don't have to reproduce a biometric sample, you only have to create an approximation that is good enough to fool the biometric sensor, which often isn't particularly difficult. optical sensors can be fooled with images, audio sensors can be fooled with recordings, the mythbusters once fooled a capacitance sensor by licking a photocopy of a fingerprint.

now hold on, i hear you say, isn't it also really easy to steal passwords? and isn't reproducing that authenticator the easiest of all? it's certainly true that in practice all kinds of things can affect how easy it is for an attacker to become illegitimately authenticated. for that reason i try to look at the upper bound of the strength of the various authentication factors. how strong is a system under ideal conditions, that is where everything goes right and legitimate parties don't make any mistakes.

for passwords, that ideal situation means that the user doesn't accidentally click on anything that would steal his/her password, doesn't get fooled by phishing sites, etc. in short, the attacker can't get the password from the user. it also means the attacker can't get passwords in transit (because that's been properly secured) or a password database from service provider because no vulnerability is found in their system and their employees are likewise careful to avoid making mistakes. under this ideal situation the attacker's only way to succeed in gaining illegitimate entry is to perform an online brute force attack (no, not a dictionary attack, because the user didn't make the mistake of using something from a dictionary) and they'd have to go slow because the ideal provider would have rate-limited failed logon attempts. now you might say this is unrealistic, people make mistakes, and that's true in practice in the aggregate, but it is possible for an individual to do everything right, and it is also possible for attackers to not be able to find any way to attack the provider in order to get the password database. this isn't how strong password protection always is, but rather the ideal we hope to achieve by making our systems secure and avoiding making mistakes, and sometimes in limited cases this is achieved.

for tokens, let's consider the ideal situation to be comparable to that for passwords but on top of that let's consider the strongest token possible (ie. not a door key). let's consider a token that produces one-time-passwords (without any vulnerabilities that would make those passwords easy to predict) so that even brute force attacks become much harder. on the surface this seems even stronger than passwords, but there's a chink in the armour and apple's recent icloud problems are a good example. tokens can be lost or stolen so there needs to be a way to recover from that problem. while our "ideal situation" precludes our user from losing their token, it does not preclude our service provider from providing users with a way to cope with the loss of their tokens. the strongest way to do this is to provide the user with pre-generated one-time-passwords ahead of time. this can work for an individual user who is careful and doesn't make any mistakes but as we've previously seen our "ideal situation" does not extend to the point of saying all users make no mistakes, so the pre-generated one-time-pads are going to fail for reasons such as never being printed out and put in a safe place, or not being able to get to that safe place because the user is traveling, etc. what's a service provider to do then? so far, their best option might be to use traditional passwords as a fall back, and if they do then the token system becomes only as strong as passwords, because although our ideal user didn't lose their token, the provider can't really know that the user didn't lose it (or worse that it was stolen) and has to accept attempts to use the password fall back. while there is room for tokens to be stronger than passwords, the price is that only ideal users will be able to recover in the event of a lost token, and that price may be more than service providers are willing to accept.

for biometrics, we once again consider an ideal user who does nothing wrong, and an ideal service provider who likewise makes no mistakes. in spite of doing nothing wrong the user's voice can still be recorded, their face can still be photographed (in most cultures since facial covering is relatively rare), etc. simply interacting with the world cannot qualify as doing something wrong or making a mistake. acquiring the information necessary to construct a counterfeit authenticator is easy compared to passwords and tokens because no effort is taken to conceal that information and the cultural adjustments needed to change that are beyond what i think would be reasonable to expect. the difficulty in attacking a biometric authentication system boils down to the difficulty in fooling a sensor (or sometimes 2 sensors as people have tried to strengthen fingerprint biometrics with so-called "liveliness tests"), and that difficulty has been consistently overestimated in the past.

this is why i consider biometrics weaker than passwords - because even when everyone does everything right it's still fairly easy to fool the system. as such, when someone (especially a bank) provides people with an authentication system that replaces passwords with biometrics, i think that should raise an alarm. even at that prior job of mine it was conceded that that mode of operation was more about convenience than it was about security. convenience is a double-edged sword, it can make things easier for legitimate users and attackers alike if you aren't careful. using biometrics in a 2 factor authentication system may provide more security than any single factor authentication system can, but biometrics on it's own? there's a reason some people have started saying that your biometric is your username, not your password. don't replace passwords with it (at least not without having someone present to guard against funny business - which isn't an option for online banking).

if google gives you security advice, get a second opinion

originally posted on secmeme

remember back when google's chrome browser was shiny and new and their vaunted sandboxing technology didn't actually place plug-ins in a sandbox even though the plug-ins, with their existing body of vulnerabilities and research, would have been the most likely vector of attack for a brand new browser? seems like kind of a glaring oversight, right?

and who could forget google's chris dibona ranting about android not needing anti-malware and sellers of such products being scammers and charlatans? of course now google themselves are hard at work trying to stem the tide of android malware with things like bouncer, but that's far from perfect.

heck, even google's infamous tavis ormandy had to take a second stab at executing his sophail vendetta* because his first attempt was so laughably bad.
[* i refer to it as a vendetta because a) it followed then sophos representative graham cluley publicly chewing tavis ormandy out for what has since become official google policy (disclosing vulnerabilities after a ridiculously short period of time), and b) the entire sophail effort from start to finish spanned years.]

now comes news that google's chrome browser doesn't require the user to enter a master password before displaying saved passwords? and not only that but it also comes with a condescending head of chrome security, justin schuh, defending the design by claiming that master passwords breed a false sense of security by making people think it's safe to share their computer with others or leave them unlocked and unsupervised. he repeatedly falls back on the trope of "once the bad guy got access to your account the game was lost". nevermind the fact that most people will assume it's protected regardless of what chrome does because that's how most browsers have behaved for years (so not protecting the passwords is even worse than protecting them partially), nor the fact that attackers are also capable of bypassing the user account protection chrome is abdicating password security responsibility to. no protection is perfect, but that doesn't mean we throw out the imperfect ones or we'll eventually be left with none at all.

it's almost enough to make you think google never gets anything in security right the first time. but wait - it's not like password storage is an innovative new concept. there's been an established pattern around for years that they could have simply followed. it's not even like they could claim to not be aware of it when other browsers follow that pattern. frankly, if the folks at google really think they know password storage security better than everyone that came before them, from a UK software developer to mozilla engineers to bruce freaking schneier, then i respectfully suggest that they pull their heads out of their asses and get with the program. if they were really concerned about a false sense of security then maybe they shouldn't be storing passwords in the first place, after all it's not unheard of for a browser to be tricked into revealing the contents of it's password store to a remote attacker when visiting a specially crafted malicious webpage.

on the efficacy of passphrases

so now that we've all had a good think about whether masking passwords is really the right way to go, let's question another bit of wisdom - let's question whether passphrases are really as secure as we think they are.

you see with all the thinking out loud recently about the password authentication system one of the topics that got discussed in various sectors was the passphrase. the passphrase idea is that instead of using a relatively short string of bytes (which we'll all hope for the sake of argument isn't a dictionary word) as the shared secret you use to authenticate yourself with some system, you use an actual complete sentence which, although made up of dictionary words is quite a bit longer and thus theoretically harder to guess or attack by brute force.

the theory goes that the more characters are in your shared secret (be it a password or passphrase or whatever) the more possible combinations a program would have to go through before it eventually found the one that matched. additionally, since a passphrase is a proper sentence made out of proper words the consensus seems to be that it would be easier to remember.

but are those things true? let's look at the length issue. one of the things you'll often encounter when selecting a password is the need to make it complex. complex in this context means that it draws characters from as wide an array of the printable ascii character set as possible and that it doesn't contain dictionary words - basically the closer it looks like a random string of characters the better. the reason for this is 2-fold: the wide array of characters is to maximize the number of possible values for each character in the password so that the total number of possible passwords a brute force attack would have to go through would be maximized, and random non-dictionary-word property is to remove any constraints on what the various characters might be that would ultimately lower the total number of possible passwords (example. in english the letter Q is almost always followed by the letter U). natural language introduces considerable constraints - although it takes 7 bits per character to represent the entire set of printable characters, the english language is generally known to contain a little over 3 bits of information per character because of all those constraints. that means that an english passphrase of 20 characters is about as strong as a random password about half that length. at least if that were the only issue involved.

now how is your memory? a while back when i discussed choosing good passwords that you should have a different password for each account you make so that if one gets compromised the rest remain secure. nothing about using passphrases obviates the need to have a distinct and different one for each account so can you remember 20, 50, 100 different sentences? can you remember them all perfectly? can you remember which one goes with which site? perhaps not.

how could an average user make that easier (besides reusing passphrases)? the most obvious tactic would be to use culturally significant phrases. things like:

"The rain in Spain falls mainly in the plains"
"Are you smarter than a fifth grader"
"Rudolph the red-nosed reindeer had a very shiny nose"
...

i say this is the most obvious tactic because we've already seen it in the media - if you'll recall way back there was a television program called millenium starring lance hendriksen. hendriksen's character was recruited by a clandestine organization who supplied their recruits with passphrase protected computers, and in hendriksen's case the passphrase was "Soylent Green is people" (a quote from the movie soylent green).

this adds another layer of constraints on the set of probable values and my gut instinct is that this constraint is so significant that rather than mounting a full brute force attack it would be feasible to simply mount a dictionary attack. i will concede that there are a very large number of culturally significant phrases that people might choose from, but i doubt the cardinality of that set differs significantly from that of the set of words in an actual dictionary. furthermore, it wouldn't be too difficult for an attacker to trick people at large into generating a dictionary of passphrases for him/her simply by setting up a free website that requires an account logon in order to access porn.

as such, i question both the idea that passphrases will be easier to remember when used properly and that a passphrase is more computationally expensive to attack. i think the strength gained by increasing the length is a phantom improvement, that the added strength is thrown away due to the various additional constrains on the set of possible values. i think there will be no ease of use benefit as the sheer number of passphrases will still require them to be recorded somehow (and since they're so much longer than normal passwords, recording them all will be more onerous). i like the idea of expanding password fields to accept more characters, but i see no reason to use that extra space for anything other than longer strong passwords.

choosing a good password

recently i've seen two separate videos talking about the problem of choosing a good password - one with michael santarchangelo and one with graham cluley... what bothers me, though, is that they're both repeating relatively old ideas with their pass-phrase method...

here's a different approach to the password choosing dilemma:

don't

you heard me, don't... don't choose a password... the primary reason for people choosing passwords is so that they can have a password that they can remember... this is an obsolete requirement - not because people's memories are that much better (they aren't, if anything the opposite is probably true) but because we now use so many things that need passwords that there's no way we can remember different passwords for all of them and have had to adapt... the poor way most people have adapted is to re-use passwords so that there's less to remember, but the smarter way is to store them so that you don't have to remember them at all...

let the computer generate a password for you using a program like password safe, it will be superior to anything you could choose manually... then store the password in password safe because computer memory is also superior to yours... if it's a password you need when the computer isn't on or a password you need in order to get into the computer in the first place, write it down and stick it in your wallet... if it's a password you need at many computers, you can carry the encrypted password database password safe creates around on a USB flash drive (in fact, password safe itself runs quite nicely from a flash drive without needing to be installed everywhere you need your passwords)...

stop following old password advice that hasn't kept up with the times, adapt to the realities of the today and start using technology (even low-tech technology like a pencil and paper) to make dealing with the password problem easier...