Report: Most Password Managers Not Secure

Security researchers say some major password manager tools could be flawed. But they also say it's still sensible to use them, just with a degree of caution.

It's a fact that using the same password for multiple sites is a massive security risk. That's because if one site gets hacked, it could mean that hackers can use the same password on another website to gain access to potentially sensitive information, resulting in identity theft or financial loss.

Password manager tools (such as Roboform and Dashlane) aim to overcome two big dilemmas with online passwords - which is keeping passwords unique, and trying to remember them. Remembering unique passwords becomes incredibly difficult, especially considering most users use around 20 or more websites requiring credentials on a regular basis.

The most common setup for a password manager is to act like a vault that holds all the passwords. The vault is then password protected with a master password, which can be entered by the user or unlocked using biometrics (such as a finger print sensor). Typically, the software company that develops the password manager does not have access to the passwords themselves, and the passwords are usually stored in an encrypted form.

Windows Programs At Risk

An organization known as the Independent Security Evaluators examined several major password manager services to see they followed sensible security practices. They looked at standalone Windows apps, rather than the type of password manager that requires you to login to a website (such as Dashlane).

One thing they looked at was how the computer handled password data when the apps were locked: in other words, when the user wasn't actively retrieving a password to use on a site. They discovered that with four major password managers (including: 1Password, Dashlane, KeePass, and Last Pass), passwords were sometimes left in the computer's memory.

In two cases (including: 1Password and Last Pass), researchers discovered that the master password could be exposed. (Source: securityevaluators.com)

Each of the password manager companies have given a mixed response to the report, with some saying they will continue to look for ways to tighten up potential security issues. Other claim that the potential security breaches are simply a limitation due to the way that Windows works.

Password Managers Still Worth Using

It's not necessarily a major security disaster. For a hacker to take advantage of this flaw, they'd first need either remote or physical access to a computer.

Tech experts note it's an example of security being about degrees rather than absolutes. The Washington Post uses the analogy of a seatbelt not preventing all damage in auto accidents, but is still worth using. (Source: washingtonpost.com)

It does mean users of password managers should take three steps to boost their protection and mitigate against risks:

• Close down password manager apps completely rather than leave them running, even in "locked" mode.
   
• Continue to use adequate security software to protect a computer against remote hacking.
   
• Consider not using the password manager for the most critical login details such as email accounts and online banking.
   
• If in doubt, hire a professional to do a security audit of your system and/or setup your password management program properly. Dennis Faas can provide you with these services - contact link here.

What's Your Opinion?

Do you use a password manager? Does this news put you off using them? Does the public have a good understanding of levels of risk in computer security?