Security slip-ups in 1Password and other password managers 'extremely worrying'

Everything's fine now. Patch. Keep using them. Move along

By Thomas Claburn in San Francisco


Password management applications, recommended by many security experts as the only viable way to deal with large sets of passwords that are unique and sufficiently complex, introduce their own set of problems – namely the general fallibility of software.

A group of security researchers called TeamSIK from the Fraunhofer Institute for Secure Information Technology (SIT) in Darmstadt, Germany, on Tuesday published its security assessment of nine popular password management applications on Android devices and found them all wanting.

"The overall results were extremely worrying and revealed that password manager applications, despite their claims, do not provide enough protection mechanisms for the stored passwords and credentials," the group said. "Instead, they abuse the users' confidence and expose them to high risks."

TeamSIK looked at My Passwords, Informaticore Password Manager, LastPass, Keeper, F-Secure KEY, Dashlane, Hide Pictures Keep Safe Vault, Avast Passwords, and 1Password.

In each application, the group identified one or more security vulnerabilities, all of which were reported to app makers and were fixed prior to the publication of the group's findings. Among the better-known password managers, fix times are respectable – a week to a month in most cases. In other words, the bugs disclosed today have been fixed. Make sure you're patched, because now hackers have all the information they need to exploit vulnerable versions of the software.

The flaws identified were sometimes serious, such as storing the master password entered by the user in plaintext or using hard-coded crypto-keys in application code. In other cases, design flaws allowed the researchers to extract supposedly secure credentials using a third-party app.

The researchers observe that many of the apps fail to account for the possibility of clipboard sniffing, which may be done to capture credentials that have been copied into memory in order to paste them into a password entry interface.

Complicating the vulnerability picture, many of these apps implement convenience features that affect app security. For example, some of the apps include a built-in web browser, which expands the scope of possible flaws. Also, the researchers found auto-fill functions in applications could be used to capture stored secrets through "hidden phishing" attacks.

Here's a rundown of the problems found and disclosed today by the team:


Informaticore Password Manager

LastPass Password Manager

Keeper Passwort-Manager

F-Secure KEY Password Manager

Dashlane Password Manager

Hide Pictures Keep Safe Vault

Avast Passwords

1Password – Password Manager

This is not to say that password management applications add more risk than they remove; rather, those using these apps must make maintaining them a priority in order to keep them secure. And if you do that, you're sorted.

"Since all vendors fixed their security issues, our advice to the customers is to always update their apps," said Siegfried Rasthofer, a malware researcher at Fraunhofer SIT, in an email to The Register. ®

Sign up to our NewsletterGet IT in your inbox daily


More from The Register

Google’s Android Emulator gains AMD and Hyper-V support

But Intel’s HAXM is still ‘Droid’s preferred hypervisor

Did you know that iOS ad clicks cost more than Android? These scammers did

Malware hides cheap Android clicks as high-end Apple traffic

New Android P beta is 'very close', 'near-final' but also just 'early'

How excited to be? Cautiously, unless you need to get cracking with testing for P's big changes

Security bods: Android system broadcasts enable user tracking

Bypassing permission protection on network info

EU Android latest: Critics diss Google's money-spinning 'cure'

You shouldn't profit from punishment

Google shaves half a gig off Android Poundland Edition

Always believe in Go ...

Microsoft: OK, we have no phones, but look how much we love Android

Mirroring, Timeline come to Google mobes

Google freezes Android P: Get your shoes on, tire-kicking devs

Final 'droid P APIs, latest system images

Android fans get fat November security patch bundle – if the networks or mobe makers are kind enough to let 'em have it

And Apple fixes Watch-killing security patch of its own

Can't unlock an Android phone? No problem, just take a Skype call: App allows passcode bypass

Neat trick for spying spouses, bad bosses, other miscreants with hands on your mobe. A fix is available