skylab/MasterPassword
2
0
Fork 0
Code Releases Activity

Security page improvements.

Browse Source 
[UPDATED]   Linguistic improvements to security page.
[ADDED]     Explanation why MP is cryptographically secure.
[ADDED]     Paragraph about Silent Circle and Lavabit to trust section.
[ADDED]     Summary of MP's security features.
[ADDED]     Brief prelude about account security.
This commit is contained in:
Maarten Billemont 2014-02-09 15:44:12 -05:00
parent 39c9f8c5a0
commit f9da568bfd
1 changed files with 84 additions and 22 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

106
Site/2013-05/security.html
View File

@ -73,8 +73,43 @@
<p>The following is an overview of the security properties of the Master Password solution. It aims to answer all questions related to the strengths and weaknesses of the algorithm behind Master Password. If you have any unanswered questions after reading this page, don't hesitate to <a href="support.html">get in touch</a>.</p>
<div class="thumb clearfix">
<h1>What Does Master Password Give Me?</h1>
<p>What do you need from passwords? You need security. <em>Security is an extremely vague term</em>, and excessively over-used in marketting material. Terms such as encryption, military-strength, and so on are used freely without context. As a customer, <em>it is now your responsibility to put these terms into context</em> and <strong>evaluate how well a solution really helps with the safety of your private data</strong>.</p>
<p>We'll begin with a prelude to account security. If you are interested specifically about Master Password, you can <a href="#about">skip right ahead to the next section</a>.</p>
<h1 id="prelude">How do I keep my accounts secure?</h1>
<p>Security is a tough subject, and yet we all need it. Knowledge about good security practices should not be limited to professionals: <b>we all have to protect our privacy and keep our identities from getting abused</b>.</p>
<p>Security doesn't need to be tough. It can just be common sense. We all know to lock our houses at night or cars in the parking lot. We all teach our children to buckle up in the car and not to blindly trust strangers. It's time to learn some common sense on digital security.</p>
<p>Let's dive in. What do you really need to keep your accounts and information secure?</p>
<div class="hlvl">
<ol>
<li>Well placed trust: every website you put information on can willfully or accidentally betray that trust.</li>
<li>Adequate protection: websites assume that only you know your password. You need to ensure that remains true.</li>
<li>Secure channels: contrary to how it appears, on the Internet you are never alone unless you are on a secure channel.</li>
</ol>
<div class="hlvl">
<h2>Well Placed Trust</h2>
<p>The security of your account with a website is mostly in the hands of that website's care takers. Regardless of how strong your passwords are, sloppy administration on their end means attackers might be able to bypass your password or simply copy it from of their database. Websites <em>should store passwords as uniquely salted hashes</em> and you should insist that they do, for your protection.</p>
<p>It is also imperative that you <strong>use unique passwords for each site</strong>. It will prevent hackers or a rogue site administrator from secretly trying to steal your identity by using your password of one site to get into your other sites. <em>Unique passwords are your only weapon against mistakes made by website owners</em>.</p>
<p>Also be careful with what information you share and whether you truly feel that information is safe in the hands of a person or company you may not know as well as you think you do, or may not be as trustworthy as you feel they should be.</p>
</div>
<div class="hlvl">
<h2>Adequate Protection</h2>
<p>Passwords are a very sub-par protection measure, but they're the most convenient and wide-spread authentication method in use. A password is a secret "word" shared between you and the other end which is meant to convince them that you are who you say you are. <em>They only work</em> if you and they are the only ones who know that "word". Which means, <strong>passwords should be unguessable and they should not be shared with any person or any other site</strong>.</p>
</div>
<div class="hlvl">
<h2>Secure Channels</h2>
<p>The Internet is a very alien place to most of us. We are used to the real world where we know what's around us and we know who can hear us when we speak. These assumptions do not hold true on the Internet. Most of what you'll do on the Internet may feel like an interaction between you and a website, while in reality everything you say and do is recorded on hundreds of computers and possibly listened in on by many individuals hidden to you.</p>
<p>It is therefore essential that <em>while on the Internet, you behave like you would in a public space</em>, say a market square or cafe. Only when you are on a secure channel, such as an HTTPS website, should you feel safe to share private information. Before you type anything in on a website that you don't want to shout out in a market square (that includes passwords!), <em>check whether your channel is secure</em> and whether you trust the website to
keep it private.</p>
</div>
</div>
</div>
<div class="thumb clearfix">
<h1 id="about">What Does Master Password Give Me?</h1>
<p>What do you need from passwords? You need security. <em>Security is an extremely vague term</em>, and excessively over-used in marketing material. Terms such as encryption, military-strength, and so on are used freely without context. As a customer, <em>it is now your responsibility to put these terms into context</em> and <strong>evaluate how well a solution really helps with the safety of your private data</strong>.</p>
<p>How do you properly evaluate the security of a product? Investigate what kind of security the product really gives you. There are a few key points on which you should evaluate security:</p>
<div class="hlvl">
@ -89,31 +124,58 @@
How easy is it to use this product? How likely are you to bypass it for convenience?</li>
</ol>
<p><strong>In summary</strong>: Master Password aims to solve each of these security problems rather than just focussing on one. It gives you <strong>unique strong passwords for each site</strong> that are also easy to use, generated in a way that makes them <strong>immune to data loss</strong>, completely independant from any third parties using an algorithm <strong>hardened against any known attack vector</strong>.</p>
<div class="hlvl">
<h2 id="strength">STRENGTH: Why Is Master Password Strong?</h2>
<p>The first point is pretty obvious, we want to keep malicious people out. Unfortunately, these people are getting increasingly more creative and are targetting as many people as they possibly can. In the next few years, <strong>you WILL become the target of somebody's attack</strong>, most likely more than once. News reports of millions of people's accounts having been put at risk are becoming ever more frequent.</p>
<p>The first point is pretty obvious, we want to keep malicious people out. Unfortunately, these people are getting increasingly more creative and are targeting as many people as they possibly can. In the next few years, <strong>you <em>will</em> become the target of somebody's attack</strong>, most likely more than once. News reports of millions of people's accounts having been put at risk are becoming ever more frequent.</p>
<p>When we evaluate the strength of a password solution, there are two important aspects that we need to consider:</p>
<div class="hlvl">
<ol>
<li><strong>STRONG PASSWORDS</strong>:
How hard is it for an attacker to get into one of my web accounts protected by these passwords?</li>
<li><strong>STRONG CRYPTOGRAPHY</strong>:
How hard is it for an attacker to get to all my passwords by attacking my app itself?</li>
How hard is it for an attacker to get to all my passwords by attacking my password app?</li>
</ol>
<p><h3 class="inline">Master Password solves the <em>strong passwords</em> problem</h3>
by generating passwords for you with extremely high entropy. We've found that humans are exceedingly bad at coming up with good passwords, especially when they need a new one every week for a new site they sign up with. Master Password therefore takes the guesswork out of it and generates high-entropy, memorable passwords. Thanks to the high entropy, when a hacker obtains all of <a
by generating passwords for you with extremely high entropy. We've found that humans are exceedingly bad at coming up with good passwords, especially when they need a new one every week for a new site they sign up with. Master Password therefore takes the guesswork out of it and generates high-entropy, memorable passwords. High entropy means that when a hacker obtains all of <a
href="http://www.washingtonpost.com/business/technology/linkedin-eharmony-deal-with-breach-aftermath/2012/06/07/gJQAwqs5KV_story.html">LinkedIn's password hashes</a>
again, they likely still won't be able to brute-force your real LinkedIn password out of it.</p>
<p>If you used an evenly distributed custom 6-character alphanumeric password (<code>0wn3dZ</code> doesn't count), it might take an insistant attacker <em>3 months</em> to brute-force your password from a leaked hash. If you used Master Password's default <em>Long Password</em> instead, it would take that same attacker <em>more than a year</em> of non-stop focus on your password. If you used Master Password's <em>Maximum Security</em> type, it would take him up to <strong>312409704477000007680
years</strong>.</p>
again, they won't be able to brute-force your real LinkedIn password from it.</p>
<p>If you used an evenly distributed custom 8-character alphanumeric password (<code>p4sSw0rD</code> doesn't count), it would only take a powerful attacker <em>1.7 days</em> to brute-force your password from a leaked hash. If you used Master Password's default <em>Long Password</em> instead, it would take that same attacker <em>1.4 years</em> of non-stop focus on your password, assuming they already know you used Master Password. If they don't,
that time goes up to <em>26 billion years</em>. If you used Master Password's <em>Maximum Security</em> type, it would take up to <strong>422460722753999994880 years</strong>.</p>
</div>
<div class="hlvl">
<p><h3 class="inline">Master Password solves the <em>strong cryptography</em> problem</h3>
by using key derivation.</p>
through careful selection of strong cryptographic algorithms to counter all known attack vectors. It took quite a bit of research and tweaking to get a solid algorithm that adequately deals with any attack vectors known to specialists. Getting cryptography right isn't a simple matter of doing some encryption of your hashing. Algorithms should be as simple as possible, because each aspect of complexity introduces new attack vectors, and simple algorithms are
easier to evaluate and trust.</p>
<p>A solution like Master Password needs to strengthen itself against a few different types of attacks, many of which are not immediately obvious. Master Password has been hardened to defeat:</p>
<ol>
<li>Brute-force attacks against the master key.</li>
<li>Brute-force attacks against the user's master password.</li>
<li>Length extension attacks against the hash functions.</li>
<li>Rainbow table attacks against the master password.</li>
<li>Future-proofing by considering more powerful computers and as yet unknown weaknesses in hashing algorithms.</li>
</ol>
<p><h4>Brute-force attacks against the master key</h4>
are defeated by deriving a very long (64-byte) master key from the user's master password. As a result, brute-force attacks that aim to guess the master key used to compute a site's password would take up to <em>137983530581000001620252739433368710545408 years</em> to find the right master key.</p>
<p><h4>Brute-force attacks against the user's master password</h4>
are defeated through the use of resource-intensive <em>scrypt</em>-based key derivation which makes this attack a few million times harder to execute than an ordinary brute-force attack. Thanks to this defence, it would take <em>560 years</em> to discover a 6-character alphanumeric master password.</p>
<p><h4>Length extension attacks against the hash functions</h4>
are mitigated by selecting hashing functions that have no known length extension attack vectors, concatenating their inputs in careful ordering and delimiting them with field-length prefixes.</p>
<p><h4>Rainbow table attacks against the master password</h4>
are mitigated through the introduction of a unique salt to each person's master key derivation process. Since we need a solution that remains stateless, we can't use a blob of secure random data as the salt. We've instead opted to use the user's full name to seed the key derivation. Even though there are some people with the exact same full name, the fact that there's so many possible full name combinations makes the effort to construct an expensive rainbow
table for each name entirely invaluable.</p>
<p><h4>Future-proofing by considering more powerful computers and as yet unknown weaknesses in hashing algorithms</h4>
is especially important in the world of cryptography. Computers are getting ever more powerful and new attack vectors are found. To protect the algorithm against factors we don't yet know about, we've ensured that the security guarantees are sufficiently excessive such that if they're weakened in the future, there'll likely remain sufficiently strong to not be broken. We've employed defensive algorithms that perform operations in moderate excess of the
bare minimum we'd need but are known to provide extra mitigation facilities against possible weaknesses in, for example, the hash functions in use. For example, we've chosen to use <em>HMAC-SHA-256</em> as opposed to simply <em>SHA-256</em>, even though the latter has no known attack vectors today. If in the future a length extension attack or similar is found against this algorithm that might weaken our use of it, it is likely that the HMAC component
will defeat such an attack.</p>
</div>
<h3>These things are hard to get right.</h3>
<p>Security is hard to get right. Applying some "military strength" encryption, doing some "hashing" and topping it off with some "proprietory" encoding doesn't suffice. There are many ways in which you can unintentionally open the door for attackers to weaken your solution or make it trivial to get in. When you evaluate a product consider <em>proprietary algorithms and missing details</em> on why it is "secure" as <strong>glaring red flags</strong>.
<p>Security is hard to get right. Applying some "military strength" encryption, doing some "hashing" and topping it off with some "proprietary" encoding doesn't suffice. There are many ways in which you can unintentionally open the door for attackers to weaken your solution or make it trivial to get in. When you evaluate a product consider <em>proprietary algorithms and missing details</em> on why it is "secure" as <strong>glaring red flags</strong>.
</div>
<div class="hlvl">
@ -121,7 +183,7 @@
<p>Regardless of how strong a solution is, all that strength can be easily defeated by misplaced or violated trust. If you're looking for a security product, you <strong>will need to trust something</strong> but it is important that you carefully consider and minimize that trust. Some prefer to put their trust in large organizations with a track record. Some prefer to put it in secret algorithms they aren't even allowed to evaluate themselves.</p>
<p><h3 class="inline">At Master Password we've decided that real trust</h3>
is the result of <strong>transparancy</strong>. Which is why we've made our algorithm open, published it on our website, described it in full and exposed it to cryptographic experts. We've also made our applications that implement it open-source so that you can see how they work and even bypass our binary distributions and instead install them from source.</p>
is the result of <strong>transparency</strong>. Which is why we've made our algorithm open, published it on our website, described it in full and exposed it to cryptographic experts. We've also made our applications that implement it open-source so that you can see how they work and even bypass our binary distributions and instead install them from source.</p>
<p><h3 class="inline">Master Password minimizes the parties</h3>
you need to trust by implementing a completely stateless solution that requires <em>no storage</em> (you don't need to trust your hard disk or hardware), requires <em>no backups or syncing</em> (you don't need to trust that all your passwords are safely backed up and synced across your devices so they're actually available to you), requires <em>no cloud services</em> (you don't need to trust that your Internet connection is safe, or a cloud provider won't lose your
@ -129,6 +191,7 @@
<h3>Trust is the most common failure point.</h3>
<p>Most other solutions that get strength right don't care so much about the trust front. They figure, if you're going to pay them for their app, you might as well trust them with all your passwords too. This really shouldn't be an implicit assumption. They're <strong>your passwords</strong>, and nobody else should have a say.</p>
<p>Knowing what happened to <a href="http://www.pcworld.com/article/2046264/after-lavabit-silent-circle-also-shuts-down-email-service.html">Silent Circle and Lavabit</a>, knowing how extremely powerful and persuasive governments and share-holders can be, you would be well advised to consider very carefully giving the keys to your digital identity to a separate entity.</p>
</div>
<div class="hlvl">
@ -136,14 +199,13 @@
<p>Loss is another one of those points that are very often overlooked. It's as though the implicit assumptions are that everybody backs all of their stuff up to at least two different devices and backups in the cloud in at least two separate countries. Well, <strong>people don't always have perfect backups</strong>. In fact, they usually don't have <em>any</em>.</p>
<p>So what happens when you drop your phone in the toilet, spill your coffee on your laptop, or worse, your kid drops a candle into the arts and crafts box and sets the house alight? You lose everything. <strong>You lose your own identity</strong>.</p>
<p><h3 class="inline">Master Password is engineered to immune</h3>
to data loss. And what better a way to fight data loss than by using <em>no data at all</em>? Master Password is a stateless solution, which means that its passwords are a result of only the things you can remember. Additionally, it minimizes the things you need to remember to little more than your own name, the site you want to use and a sentence as long as three or four words in a song's lyrics (don't use an actual song's lyrics for your master password! The
point is small sentences are very memorable).</p>
<p><h3 class="inline">Master Password is engineered to be immune</h3>
to data loss. And what better a way to fight data loss than by using <em>no data at all</em>? Master Password is a stateless solution, which means that its passwords are a result of only the things you can remember. Additionally, it minimizes the things you need to remember to little more than your own name, the site you want to use and one password (to rule them all).</p>
<p>When all is lost, you just need to open up Master Password, be it on a brand new computer, or a friend's iPhone, and you can just add your name and site back to it. Your passwords will re-appear "out of thin air".</p>
<h3>Most password solutions rely on "vaults".</h3>
<p>Vaults make the password problem really easy: passwords can be encrypted and stored on your hard disk for when you need the password again. You only notice the trouble vaults inflict when disaster strikes and you either lose the vault, it falls in the wrong hands, or a foreign government confiscates it. Be extremely wary of all vault-based password solutions and <em>make sure you understand the down sides well</em>.</p>
<p>Vaults make the password problem really easy: passwords can be encrypted and stored on your hard disk for when you need the password again. You only notice the trouble vaults inflict when disaster strikes and you either lose the vault, it falls in the wrong hands, or a foreign government confiscates it. Be extremely wary of all vault-based password solutions and <em>make sure you understand the trade-offs well</em>.</p>
</div>
<div class="hlvl">
@ -156,14 +218,14 @@
<p>All your sites should be <strong>equally well protected</strong>, each of them with <strong>unique passwords</strong> and you need to remain ever encouraged to keep it that way.</p>
<p><h3 class="inline">Master Password makes it easier on you</h3>
in various ways. It tries to minimize the time it takes to get to the password you need. It uses copy/paste functionality and generates easily memorable and typeable passwords to facilitate their usage. It removes the need for you to take the time to think of strong passwords by doing it for you. And we're constantly thinking of more ways to speed things up.</p>
in various ways. It tries to minimize the time it takes to get to the password you need. It generates easily memorable and typeable passwords to facilitate their usage. It removes the need for you to take the time to think of strong passwords by doing it for you. You can copy-paste the password to avoid having to type it in manually. And we're constantly thinking of more ways to speed things up.</p>
</div>
</div>
</div>
<div class="thumb clearfix">
<h1>How Does It Manage To Do All That?</h1>
<h1 id="how">How Does It Manage To Do All That?</h1>
<p>For the more technical details, please see the <a href="algorithm.html">Algorithm</a> page instead. I will give a more down-to-earth overview here.</p>
<div class="hlvl">
@ -218,9 +280,9 @@
<p>These are two different types of brute-force attacks and we need to make sure to defeat both of them.</p>
<p>To defeat a brute-force attack against your master key, we make sure the master key is sufficiently high in entropy. Since the master key is a 256-bit key, an attacker would now have to make up to <code>2<sup>256</sup></code> guesses, or try <code>115792089237316195423570985008687907853269984665640564039457584007913129639936</code> master keys before finding the right one. Even at an ambitious rate of 2 billion tries per second, it would take several times the age of the universe to try all of them.
<p>A brute-force attack against your master password is more feasible, since your master password will be tiny compared to such a huge master key.</p>
<p>Even if you used a 6-character evenly distributed random alphanumeric password (such as <code>yIp6X1</code>), an attacker with an decent GPU could brute-force such a password in less than <em>3 years</em>. With a powerful setup (eg. a cluster of <em>10 Nvidia 8800GT</em> GPUs which can try about <em>2 billion passwords a second</em>), that time could conceivibly go down to <em>3 or 4 months</em>.</p>
<p>Even if you used an 8-character evenly distributed random alphanumeric password (such as <code>yIp6X2qd</code>), a smart attacker could brute-force such a password in less than <em>1.7 days</em>.</p>
<p>To solve this problem, we introduce an expensive <q>scrypt</q>-based <em>key derivation</em> step. <em>scrypt</em> specifically improves on standard key derivation techniques by not only wasting a lot of <em>CPU time</em>, but also consuming huge amounts of <em>RAM</em>. We need to be careful to choose the right parameters so that logging into Master Password doesn't take too long on weaker mobile devices while the possibility of guessing at passwords is sufficiently
cippled for attackers. The theory is, the longer it takes for an attacker to try out one guess of your master password, the longer it'll take him to find the right one. We pull this theory into the extreme so that guessing your password now takes <strong>19477911.1969 years</strong> instead of <em>3 months</em> while logging into Master Password on an iPhone 4S takes less than 3 seconds.</p>
crippled for attackers. The theory is, the longer it takes for an attacker to try out one guess of your master password, the longer it'll take him to find the right one. We pull this theory into the extreme so that guessing your password now takes <strong>2151076 years</strong> instead of <em>1.7 days</em> while logging into Master Password on an iPhone 4S takes no more than 3 seconds.</p>
<p>It bears note that <em>scrypt</em>'s approach is specifically interesting because it costs both a lot of CPU and a lot of RAM to derive a master key. That means that the more computers an attacker buys, the more his $ cost goes up. CPU and RAM are expensive, and forcing the derivation to use a lot instead of minuscule amounts causes the $ cost of a brute-force attack to become phenomenal.</p>
<p>Given these solutions, we feel confident Master Password is adequately protected against attacks on your private master key.</p>
</div>
@ -237,8 +299,8 @@
<p>While we're encoding a password, we have one final problem to solve: password policies. Most websites nowadays have taken it upon themselves to restrict the kinds of passwords you can use. The point is usually to keep you from using passwords that are too weak, but these policies unfortunately often include rules that are detrimental for the strength of passwords (such as <q>your password MUST contain a number, it MUST start with a letter, and it MUST
NOT be longer than 6 characters. Oh yeah, and it MUST NOT contain quotes or anything fancy because we strip that since we don't know how else to sanitize data against SQL injection while we store your passwords in plain text.</q> (did you detect a little rant there?).</p>
<p>Master Password comes with a set of templates which are carefully crafted to give you passwords which strike an optimal balance between security and usability while dodging the rules of the most common password policies.</p>
<p>Master Password's default <em>Long Password</em> template produces memorable passwords such as <code>XikuFuzzFosu9[</code> which have just under 56 bits of entropy. It would take an Nvidia 8800GT about <strong>10 years</strong> at <em>200 million passwords per second</em>. That same machine would crack a perfectly random 6-character alphanumeric password in <em>3 years</em>.</p>
<p>Master Password's <em>Secure Password</em> template uses a lot of bits from the password seed to give you a password that's 20 characters long, looks something like <code>A2/IczT2BKx^(bVa18Kp</code> and would take that same machine up to <strong>3124097044769999945728 years</strong> to crack.</p>
<p>Master Password's default <em>Long Password</em> template produces memorable passwords such as <code>XikuFuzzFosu9[</code> which have just under 56 bits of entropy. An attacker that knows you use Master Password would still need to dedicate <em>1.4 years</em> of powerful computer time to crack that password's hash. If he doesn't know you, that time goes up to <em>26 billion years</em>.</p>
<p>Master Password's <em>Secure Password</em> template uses encodes many more bits from the password seed resulting in a password that's 20 characters long, looks something like <code>A2/IczT2BKx^(bVa18Kp</code> and would take that same machine up to <strong>422460722753999994880 years</strong> to crack.</p>
<p>Given these numbers we feel confident that Master Password's output passwords offer you the maximum amount of confidence in the strength of your external accounts.</p>
</div>
</div>
@ -246,7 +308,7 @@
</div>
<div class="thumb clearfix">
<h1>Conclusion</h1>
<h1 id="conclusion">Conclusion</h1>
<p>We've explained all the important factors in which password managers can and should protect the security of your private information. We've also clarified in which ways Master Password deals with each of these factors and backed these clarifications with numbers and reasoning.</p>
<p>Hopefully this information has given you sufficient confidence in the Master Password algorithm and has taught you important ways to evaluate other competing security products so that you can make an informed decision.</p>