We're browsing away, maybe checking our bank account balance and up pops the requirement to type in the password to unlock the password manager. Ah, we think, another indication that we're safe - it required me to type the password AND I was so careful to make sure it was the right site, etc.
Unfortunately, that's a false sense of security - which is worse than no security at all.
Click through the link above to read the gory detail if you like; even if you don't understand it all, at least some will make sense.
Even better, try the test yourself - watching it pull passwords out of YOUR very own password manager will really drive the point home.
I know of no actual exploits yet, and they do seem to require a compromise of the site from which the attacker wants to steal your password - however, as we've seen, such compromises are not at all uncommon.
One other item of note: For Safari in particular, I note that the default, when creating a new entry, is to give Safari blanket permission (via Access Control). While convenient, it is far less safe - and it seems that the problems detailed in the CIS article, might well be avoided if Safari did not do this; at least the user would be required to type in the keychain password each time and thus get some warning.
No comments:
Post a Comment