From f57415a08bf65e8db56216bcf0dde53ffb0582e5 Mon Sep 17 00:00:00 2001 From: Maarten Billemont Date: Sun, 9 Feb 2014 17:57:20 -0500 Subject: [PATCH] Security page improvements. [ADDED] Table of contents. [FIXED] Inline header style fixes. [ADDED] Trade-offs. --- Site/2013-05/css/main.css | 13 +++- Site/2013-05/security.html | 123 ++++++++++++++++++++++++++++++------- 2 files changed, 112 insertions(+), 24 deletions(-) diff --git a/Site/2013-05/css/main.css b/Site/2013-05/css/main.css index ba1820d1..fe9c98e2 100644 --- a/Site/2013-05/css/main.css +++ b/Site/2013-05/css/main.css @@ -18,6 +18,17 @@ nav { h1, h2, h3, h4 { margin-top: 1em; } +/* +*[id]::before { +position: relative; + content: ""; + display: block; + height: 60px; +width: 5px; +background: red; + margin-top: -60px; +} +*/ section { padding: 1ex 0; @@ -46,7 +57,7 @@ section { margin-left: -2em; padding-left: 3em; } -h3.inline { +h2.inline, h3.inline, h4.inline { display: inline-block; line-height: inherit; } diff --git a/Site/2013-05/security.html b/Site/2013-05/security.html index c40df242..ed549279 100644 --- a/Site/2013-05/security.html +++ b/Site/2013-05/security.html @@ -72,6 +72,33 @@

The following is an overview of the security properties of the Master Password solution. It aims to answer all questions related to the strengths and weaknesses of the algorithm behind Master Password. If you have any unanswered questions after reading this page, don't hesitate to get in touch.

+
    +
  1. How do I keep my accounts secure? +
      +
    1. Well Placed Trust
      2. +
    2. Adequate Protection
      3. +
    3. Secure Channels
      4. +
    +
    2. +
  2. What Does Master Password Give Me? +
      +
    1. STRENGTH: Why Is Master Password Strong?
      2. +
    2. TRUST: Why Should I Trust Master Password?
      3. +
    3. LOSS: Can I Lose Everything?
      4. +
    4. USABILITY: I Don't Really Need A Secure Facebook...
      5. +
    +
    3. +
  3. How Does It Manage To Do All That? +
      +
    1. To Be Stateless
      2. +
    2. To Be Strong
      3. +
    +
    4. +
  4. What Are Master Password's Trade-Offs?
    5. +
  5. Conclusion
    6. +
  6. A Final Note On Security
    7. +
+

We'll begin with a prelude to account security. If you are interested specifically about Master Password, you can skip right ahead to the next section.

@@ -138,8 +165,8 @@ How hard is it for an attacker to get to all my passwords by attacking my password app? -

Master Password solves the strong passwords problem

- by generating passwords for you with extremely high entropy. We've found that humans are exceedingly bad at coming up with good passwords, especially when they need a new one every week for a new site they sign up with. Master Password therefore takes the guesswork out of it and generates high-entropy, memorable passwords. High entropy means that when a hacker obtains all of Master Password solves the strong passwords problem +

by generating passwords for you with extremely high entropy. We've found that humans are exceedingly bad at coming up with good passwords, especially when they need a new one every week for a new site they sign up with. Master Password therefore takes the guesswork out of it and generates high-entropy, memorable passwords. High entropy means that when a hacker obtains all of LinkedIn's password hashes again, they won't be able to brute-force your real LinkedIn password from it.

If you used an evenly distributed custom 8-character alphanumeric password (p4sSw0rD doesn't count), it would only take a powerful attacker 1.7 days to brute-force your password from a leaked hash. If you used Master Password's default Long Password instead, it would take that same attacker 1.4 years of non-stop focus on your password, assuming they already know you used Master Password. If they don't, @@ -147,8 +174,8 @@

-

Master Password solves the strong cryptography problem

- through careful selection of strong cryptographic algorithms to counter all known attack vectors. It took quite a bit of research and tweaking to get a solid algorithm that adequately deals with any attack vectors known to specialists. Getting cryptography right isn't a simple matter of doing some encryption of your hashing. Algorithms should be as simple as possible, because each aspect of complexity introduces new attack vectors, and simple algorithms are +

Master Password solves the strong cryptography problem

+

through careful selection of strong cryptographic algorithms to counter all known attack vectors. It took quite a bit of research and tweaking to get a solid algorithm that adequately deals with any attack vectors known to specialists. Getting cryptography right isn't a simple matter of doing some encryption of your hashing. Algorithms should be as simple as possible, because each aspect of complexity introduces new attack vectors, and simple algorithms are easier to evaluate and trust.

A solution like Master Password needs to strengthen itself against a few different types of attacks, many of which are not immediately obvious. Master Password has been hardened to defeat:

    @@ -159,17 +186,17 @@
  1. Future-proofing by considering more powerful computers and as yet unknown weaknesses in hashing algorithms.
-

Brute-force attacks against the master key

- are defeated by deriving a very long (64-byte) master key from the user's master password. As a result, brute-force attacks that aim to guess the master key used to compute a site's password would take up to 137983530581000001620252739433368710545408 years to find the right master key.

-

Brute-force attacks against the user's master password

- are defeated through the use of resource-intensive scrypt-based key derivation which makes this attack a few million times harder to execute than an ordinary brute-force attack. Thanks to this defence, it would take 560 years to discover a 6-character alphanumeric master password.

-

Length extension attacks against the hash functions

- are mitigated by selecting hashing functions that have no known length extension attack vectors, concatenating their inputs in careful ordering and delimiting them with field-length prefixes.

-

Rainbow table attacks against the master password

- are mitigated through the introduction of a unique salt to each person's master key derivation process. Since we need a solution that remains stateless, we can't use a blob of secure random data as the salt. We've instead opted to use the user's full name to seed the key derivation. Even though there are some people with the exact same full name, the fact that there's so many possible full name combinations makes the effort to construct an expensive rainbow +

Brute-force attacks against the master key

+

are defeated by deriving a very long (64-byte) master key from the user's master password. As a result, brute-force attacks that aim to guess the master key used to compute a site's password would take up to 137983530581000001620252739433368710545408 years to find the right master key.

+

Brute-force attacks against the user's master password

+

are defeated through the use of resource-intensive scrypt-based key derivation which makes this attack a few million times harder to execute than an ordinary brute-force attack. Thanks to this defence, it would take 560 years to discover a 6-character alphanumeric master password.

+

Length extension attacks against the hash functions

+

are mitigated by selecting hashing functions that have no known length extension attack vectors, concatenating their inputs in careful ordering and delimiting them with field-length prefixes.

+

Rainbow table attacks against the master password

+

are mitigated through the introduction of a unique salt to each person's master key derivation process. Since we need a solution that remains stateless, we can't use a blob of secure random data as the salt. We've instead opted to use the user's full name to seed the key derivation. Even though there are some people with the exact same full name, the fact that there's so many possible full name combinations makes the effort to construct an expensive rainbow table for each name entirely invaluable.

-

Future-proofing by considering more powerful computers and as yet unknown weaknesses in hashing algorithms

- is especially important in the world of cryptography. Computers are getting ever more powerful and new attack vectors are found. To protect the algorithm against factors we don't yet know about, we've ensured that the security guarantees are sufficiently excessive such that if they're weakened in the future, there'll likely remain sufficiently strong to not be broken. We've employed defensive algorithms that perform operations in moderate excess of the +

Future-proofing by considering more powerful computers and as yet unknown weaknesses in hashing algorithms

+

is especially important in the world of cryptography. Computers are getting ever more powerful and new attack vectors are found. To protect the algorithm against factors we don't yet know about, we've ensured that the security guarantees are sufficiently excessive such that if they're weakened in the future, there'll likely remain sufficiently strong to not be broken. We've employed defensive algorithms that perform operations in moderate excess of the bare minimum we'd need but are known to provide extra mitigation facilities against possible weaknesses in, for example, the hash functions in use. For example, we've chosen to use HMAC-SHA-256 as opposed to simply SHA-256, even though the latter has no known attack vectors today. If in the future a length extension attack or similar is found against this algorithm that might weaken our use of it, it is likely that the HMAC component will defeat such an attack.

@@ -182,11 +209,11 @@

TRUST: Why Should I Trust Master Password?

Regardless of how strong a solution is, all that strength can be easily defeated by misplaced or violated trust. If you're looking for a security product, you will need to trust something but it is important that you carefully consider and minimize that trust. Some prefer to put their trust in large organizations with a track record. Some prefer to put it in secret algorithms they aren't even allowed to evaluate themselves.

-

At Master Password we've decided that real trust

- is the result of transparency. Which is why we've made our algorithm open, published it on our website, described it in full and exposed it to cryptographic experts. We've also made our applications that implement it open-source so that you can see how they work and even bypass our binary distributions and instead install them from source.

+

At Master Password we've decided that real trust

+

is the result of transparency. Which is why we've made our algorithm open, published it on our website, described it in full and exposed it to cryptographic experts. We've also made our applications that implement it open-source so that you can see how they work and even bypass our binary distributions and instead install them from source.

-

Master Password minimizes the parties

- you need to trust by implementing a completely stateless solution that requires no storage (you don't need to trust your hard disk or hardware), requires no backups or syncing (you don't need to trust that all your passwords are safely backed up and synced across your devices so they're actually available to you), requires no cloud services (you don't need to trust that your Internet connection is safe, or a cloud provider won't lose your +

Master Password minimizes the parties

+

you need to trust by implementing a completely stateless solution that requires no storage (you don't need to trust your hard disk or hardware), requires no backups or syncing (you don't need to trust that all your passwords are safely backed up and synced across your devices so they're actually available to you), requires no cloud services (you don't need to trust that your Internet connection is safe, or a cloud provider won't lose your data or secretly send it to your or a foreign government).

Trust is the most common failure point.

@@ -199,8 +226,8 @@

Loss is another one of those points that are very often overlooked. It's as though the implicit assumptions are that everybody backs all of their stuff up to at least two different devices and backups in the cloud in at least two separate countries. Well, people don't always have perfect backups. In fact, they usually don't have any.

So what happens when you drop your phone in the toilet, spill your coffee on your laptop, or worse, your kid drops a candle into the arts and crafts box and sets the house alight? You lose everything. You lose your own identity.

-

Master Password is engineered to be immune

- to data loss. And what better a way to fight data loss than by using no data at all? Master Password is a stateless solution, which means that its passwords are a result of only the things you can remember. Additionally, it minimizes the things you need to remember to little more than your own name, the site you want to use and one password (to rule them all).

+

Master Password is engineered to be immune

+

to data loss. And what better a way to fight data loss than by using no data at all? Master Password is a stateless solution, which means that its passwords are a result of only the things you can remember. Additionally, it minimizes the things you need to remember to little more than your own name, the site you want to use and one password (to rule them all).

When all is lost, you just need to open up Master Password, be it on a brand new computer, or a friend's iPhone, and you can just add your name and site back to it. Your passwords will re-appear "out of thin air".

@@ -217,11 +244,10 @@

All your sites should be equally well protected, each of them with unique passwords and you need to remain ever encouraged to keep it that way.

-

Master Password makes it easier on you

- in various ways. It tries to minimize the time it takes to get to the password you need. It generates easily memorable and typeable passwords to facilitate their usage. It removes the need for you to take the time to think of strong passwords by doing it for you. You can copy-paste the password to avoid having to type it in manually. And we're constantly thinking of more ways to speed things up.

+

Master Password makes it easier on you

+

in various ways. It tries to minimize the time it takes to get to the password you need. It generates easily memorable and typeable passwords to facilitate their usage. It removes the need for you to take the time to think of strong passwords by doing it for you. You can copy-paste the password to avoid having to type it in manually. And we're constantly thinking of more ways to speed things up.

-
@@ -307,6 +333,57 @@
+
+

What Are Master Password's Trade-Offs?

+

Whenever choices are made, they come with trade-offs. We'll highlight the trade-offs involved with using Master Password, why we feel the benefits outweigh them and how.

+

So what are the trade-offs with the Master Password solution?

+
+
    +
  1. You cannot change your master password without also changing all your site passwords.
    2. +
  2. You cannot "generate" your own custom passwords.
    3. +
  3. You cannot freely build your password template.
    4. +
  4. This is only a one-factor solution (something you know).
    5. +
+ +
+

Changing your master password

+ results in all your site passwords to change, since they are the mathematical result of your master key, which in turn is a mathematical result of your master password. That means, if somebody learns your master password, you'll need to reset all your site passwords to new ones. It also means the solution is incompatible with "password recovery". It is your responsibility to think of a good and memorable master password, and more importantly, + ensure that nobody learns your master password. If you chose to share it anyway (say, with your spouse), you should do so in full expectation that you'll need to change all your sites' passwords if your trust relationship with them degrades.

+

This trade-off is a direct result of the desire to create a stateless solution which is immune to data loss. The solution relies entirely on the master password you can remember, which means that the only point of failure is now entirely under your control.

+
+ +
+

Custom passwords

+ are sometimes still a necessity. You may want to store a password you've been using for a long time in your manager, or your boss may have set an unchangable password on your computer for you to use. Since Master Password's passwords are a mathematical result of your unchanging master password, it is impossible for it to be used with passwords that are created via another way.

+

The Master Password application however functions as a hybrid password manager, implementing both the Master Password algorithm and a vault-like password solution. In the second mode, Master Password uses your master key to encrypt custom passwords and store the encrypted result in a vault. Since we use the master key for this process, the result is a vault that is much harder to break into than that used by many other vault-based password solutions (specifically + because the encryption key is a 64-byte key derived from your master pasword using scrypt key derivation). As a result, this trade-off has been mitigated.

+
+ +
+

Password templates

+ are the presets that tell Master Password what your final password should look like. They specify where to put the letters, numbers or other characters. We've made the decision to only provide a set of template presets rather than allowing users to determine their own templates to use for a site. As a result, you cannot chose to design your own custom template, such as, "a 6-digit password that starts with a lower-case letter".

+

This decision has been made in the interest of password recovery after a total loss scenario. Recovering the correct password for sites that use such custom templates would be extra difficult, since now you're forced to recall the specific custom template you drafted for this site. This problem becomes more difficult the more sites you've made custom templates for.

+

As a partial mitigation of this trade-off, we've created a set of password templates designed to cover nearly all use cases. The default template should work on nearly all websites. When this template fails, it's usually because the site imposes a low maximum-password-length restriction. This type of restriction is a serious red flag which almost always indicates a sloppy security implementation on their end. When you encounter it, you should + contact the website administrator and demand an explanation (it's your security!). Usually, the explanation involves database-imposed limitations which mean they're storing your password in clear text, and you should be extremely wary about your continued use of this website.

+
+ +
+

A one-factor solution

+ is an authentication solution that requires only one factor of security. Master Password is a one-factor solution since its security relies solely on "something you know". That means, if somebody steals your master password, that's all they need to gain access to your sites. The alternative is usually a two-factor solution which relies on two distinct security factors, such as "something you know" and "something you have". Now, when somebody's obtained + the "something you know", they'll still need to obtain the "something you have" before they can break in. The most popular example of a two-factor solution is a bank card: Your PIN number is the secret you know, but with the PIN alone a thief can't get to your money. They'll need to first steal your card as well.

+

A vault-based password manager is often considered two-factor, since it relies on your vault password as well as access to your vault file. Most security experts disagree, however. To be truly multi-factor, the security factors should come from separate categories:

+
    +
  • Knowledge factors: passwords, keyfiles, other secret data or information
    • +
  • Possession factors: physical tokens, smart cards
    • +
  • Inherence factors: biometrics
    • +
+

When two factors are derived from the same category, they don't really add a significant extra hurdle for the attacker to overcome. An attacker could steal your master password by installing a key-logger on your computer. But at that point he's probably also already copied your vault file.

+

Additionally, the weaker link with using a password-based authentication method is the password itself. Irrespective of how many truly distinct security factors you've used to obtain your password, your actual act of authentication involves sending a single password to the remote party, which means your actual authentication remains only one-factor secure.

+

So while Master Password is indeed a one-factor authentication solution, we don't aim or pretend to be anything more than that since the reality is that it's not truly possible when you're just doing password authentication.

+
+
+
+

Conclusion

We've explained all the important factors in which password managers can and should protect the security of your private information. We've also clarified in which ways Master Password deals with each of these factors and backed these clarifications with numbers and reasoning.