{"id":69300,"date":"2014-07-14T23:45:09","date_gmt":"2014-07-14T21:45:09","guid":{"rendered":"http:\/\/onsoftware.en.softonic.com\/?p=69300"},"modified":"2025-07-02T00:36:03","modified_gmt":"2025-07-02T07:36:03","slug":"security-researchers-find-critical-flaws-in-web-based-password-managers","status":"publish","type":"post","link":"https:\/\/cms-articles.softonic.io\/en\/security-researchers-find-critical-flaws-in-web-based-password-managers\/","title":{"rendered":"Security researchers find critical flaws in web-based password managers"},"content":{"rendered":"

After news of the Heartbleed<\/a> security flaw broke, I stressed the importance of using password managers<\/a> to create unique passwords for each site. While password managers help create and store unique passwords, they also offer a single point-of-failure<\/strong>. If someone cracks your password manager, they will have access to all your information across the web.<\/p>\n

Late last week, security researchers<\/a> from the University of California Berkeley released a report of serious vulnerabilities<\/strong> found in web-based password managers. Their research found that five popular web-based password managers could be exploited to reveal user credentials.<\/p>\n

LastPass<\/a>, a massively popular password manager, fell victim to the attack. The most critical bug allowed attackers to steal user passwords out of the password locker without detection<\/strong>.<\/p>\n

LastPass’ bookmarklet feature<\/strong> which allowed users to quickly fill in usernames and passwords proved to be insecure. Malicious code implanted on a website could steal credentials from LastPass for other sites.<\/p>\n

\"Bookmarklet<\/p>\n

Diagram of the LastPass bookmarklet vulnerability<\/em><\/p>\n

Other web-based password managers didn’t fare any better. PasswordBox<\/a>, RoboForm<\/a>, my1login<\/a>, and NeedMyPassword<\/a> were all exploited by similar means. However, every company except NeedMyPassword has patched these vulnerability, making them safe to use again<\/strong>.<\/p>\n

“Widespread adoption of insecure password managers could make things worse… After all, a vulnerability in a password manager could allow an attacker to steal all<\/em> passwords for a user in a single swoop. Given the increasing popular of password managers, the possibility of vulnerable password managers is disconcerting and motivates our work,” writes the UCB security researchers.<\/p>\n

Non-web-based password managers like 1Password<\/a> are unaffected by these vulnerabilities. 1Password developer AgileBits predicted the vulnerability<\/strong> of bookmarklets in 2011, discontinuing<\/a> the feature.<\/p>\n

\"1Password<\/p>\n

“In 1Password 4, our browser extension does not store (encrypted or otherwise) user credentials. Nor does our extension handle people\u2019s 1Password Master Passwords. This way, user data and secrets are kept at a further distance from the hostile environment of a third party web page,” said 1Password’s Defender Against the Dark Arts Jeffrey Goldberg<\/a>. Yes, that’s actually his title.<\/p>\n

Does this research mean you should give up on web-based password managers altogether? No, not at all but you should watch to see how each company is reacting<\/strong>. Like I wrote earlier, four out of the five exposed password managers have already patched the exploits<\/strong>.<\/p>\n

LastPass recommends users who used the bookmarklet feature\u00a0before September 2013<\/strong> to change their master passwords. Users who want to be absolutely sure their data is safe can generate all new passwords for every site they use, but LastPass says they don’t think that’s necessary.<\/p>\n

“It\u2019s true that many of the flaws were enormous, but it is also true that vendors (well, all but one) responded appropriately and got those fixed before any damage was done. Both the vendors and the researchers should be commended for how they handled that,” said Goldberg.<\/p>\n

Web security is constantly evolving and companies will have to stay diligent to prevent future attacks. It’s extremely difficult to predict and protect against these types of exploits. Developers of password managers will need to work closely with security researchers to maintain the security of their products.<\/p>\n

Source: devd.me [PDF]<\/a> | LastPass<\/a><\/em><\/p>\n

Header image credit: David Goehring [Flickr]<\/a><\/em><\/p>\n

Follow Lewis on Twitter: @lewisleong<\/a><\/div>\n

RELATED STORIES<\/p>\n