Monthly Archives: April 2015

You Are Managing Passwords Wrong: LastPass and Friends

In an uncharacterstic move, I type now not to my future self but to the entire world. The importance of my announcement justifies this decision: If you use LastPass, your conception of security is wrong. Expert knowledge is not necessary to understand why, and the only postulate to which you must agree is that of chains only being as strong as their weakest links.

I do not use LastPass, though I consider its accessibility and ease of use a boon to the security ecosystem. I even recommend LastPass to others (family and friends with little inclination toward computers, for example). In recommending LastPass, I do not reveal that its foundation is flawed. Such knowledge is irrelevant to the people to which I recommend LastPass, as these people are not able to customize their window managers. If you are not able to customize your window manager to the point of emulating keypress events from menu items, the remainder of this article will be of little use to you. If, on the other hand, you are, we will be using the following tools:

The end result looks like this (using Openbox):

Qutebrowser is great.
More secure and more versatile than any password service.

The window manager’s main menu is opened, and the password menu (P) is selected. A category is chosen (A), followed by the actual item for which a password is retrieved (A). The final item is an encrypted password file that is decrypted by GNU Privacy Guard, with the resulting password output by xdotool to whatever program currently accepts input. Already, we have uncovered three advantages over LastPass and friends…

  • Works with any program, not just with forms displayed in web browsers with password plugins installed.
  • Fewer entry points. Fewer links in the chain lower the chances of one being weak (the unknown unknowns).
  • Customizable and extendable.

… and one quality that LastPass would like to claim a disadvantage:

  • Limited to terminals with access to encrypted password files.

I claim this an advantage, because once again, I know that chains are only as strong as their weakest links. Today, it is raining outside. I look outside, and I see clouds overhead. My neighbor sees the same clouds. My neighbor might think those clouds can hold critical documents, but I keep mine locked in a file cabinet in the basement. This is not an issue of trust so much as one of common sense and convenience–because the file cabinet is closer, and tomorrow could very well be a sunny day.

Then again, the whole point of having clouds hold documents is for people to be able to go one town over and still see those documents hanging in the sky. I have had enough of this analogy. If you require access to a critical document on a terminal to which you cannot trust to store an encrypted password file, you are managing passwords wrong. Use “12345” for those. They are not secure, and no quantity of helmets will protect you from sharks while diving. I am an analogy machine.

Critical documents should only be accessed from terminals you are able to claim as your own. You might think you need your online banking password available on any computer with Internet access, but I bet you could count on one hand the number of computers you actually use. Send money, record secrets, and store nude photographs on your own computers, not on some cloud on a cloudy day.

Then when you have separated cruciality from “12345,” make some noise:

uLength="24"
uCount="50"
for (( u = 0 ; u < uCount ; u++ )) ; do
# Output is concatenated to maintain continuity of demonstration.
# For the real deal, use gpg's --output option and forego looping.
gpg --armor --gen-random 2 "$uLength" >> /mnt/hdd_not_ssd/entropy.txt
done

Look at the randomness. These are your passwords. Break them into variable-length chunks, and store them in files. Don’t let your editor back them up, and remember that extra caution during the setup procedure lasts forever:

echo "set nobackup" >> ~/.vimrc
echo "set nowritebackup" >> ~/.vimrc
vim /mnt/hdd_not_ssd/entropy.txt
# Saved to these:
/mnt/hdd_not_ssd/gmail.txt
/mnt/hdd_not_ssd/japan_net_bank.txt
/mnt/hdd_not_ssd/freenode.txt

Gnome-keyring, python-keyring, and libsecret would only be redundant links in your chain. Do not bother assessing their strengths, because they are superfluous. Instead, concoct a good master passphrase and generate a key from GNU Privacy Guard:

gpg --full-gen-key

Encrypt your password files as soon as possible:

gpg --list-keys
> /home/nosuck/.gnupg/pubring.gpg
> ------------------------------
> pub rsa2048/DEADBEEF 2015-04-01 [有効期限: 2016-04-01]
> uid XXX
> sub rsa2048/LIVEBEEF 2015-04-01 [有効期限: 2016-04-01]
sKeyId="DEADBEEF"
gpg -ear "$sKeyId" /mnt/hdd_not_ssd/gmail.txt
gpg -ear "$sKeyId" /mnt/hdd_not_ssd/japan_net_bank.txt
gpg -ear "$sKeyId" /mnt/hdd_not_ssd/freenode.txt
shred /mnt/hdd_not_ssd/gmail.txt
rm /mnt/hdd_not_ssd/gmail.txt
# ... and so on.

Finally, output passwords through your window manager, using xdotool. Though this link is arguably stronger than even physically typing a password on a keyboard, it is still the weakest in our short and sturdy chain:

pGmail="/mnt/no_longer_matters/gmail.asc"
xdotool type --clearmodifiers --delay 5 "$( gpg -qd "$pGmail" )"

You can also use passwords with programs clever enough to take input from places other than GUI toolkits:

cat ~/.muttrc
> set smtp_pass = `gpg -qd /mnt/no_longer_matters/gmail.asc`
cat ~/.offlineimaprc
> remotepasseval = Password ( "/mnt/no_longer_matters/gmail.asc" )

When you’ve memorized your master passphrase, adjust time-to-live settings for its prompting. The following settings will make gpg-agent require master passphrase input only once per day–not as often as it should, but I have little faith in you. Specify in seconds:

echo "default-cache-ttl 43200" >> ~/.gnupg/gpg-agent.conf
echo "max-cache-ttl 86400" >> ~/.gnupg/gpg-agent.conf

You can also force re-prompts for any subsequent password accesses. This is good to do before leaving your computer unattended. Make this command accessible. Mine is never more than four keystrokes away (the “R” item in the animated demonstration). It is a good idea to force a reprompt on system idle and sleep events, as well:

echo RELOADAGENT | gpg-connect-agent -v

… and that is the optimal convenience you can get out of a truly secure password management system. Passwords entropy level is high; password retrieval is convenient, with the master passphrase only required as often as configured; lastly, the chain of software from password request to password retrieval is as short as feasibly possible.

.. and I didn’t even mention LastPass being closed-source as a deal-breaker from the get-go.

Advertisements