This new research proves just that. According to new information published by Independent Security Evaluators (ISE), at least five popular password managers, including 1Password, Dashlane, KeePass and LastPass, could potentially leak unencrypted credentials and passwords while they’re running in the background. How severe are these issues? Or are they nothing to worry about? Let’s break them down.
It’s like leaving your keys under your PC’s doormat
The researchers from ISE (read: white hats aka the good hackers) said that the password managers they examined don’t always encrypt and clear the password from a computer’s memory while transitioning from an unlocked (password manager is running) to a locked (user is logged out) state. 1Password, in particular, keeps the master password in memory while unlocked and fails to clear it out when it goes back to its locked state. In some cases, the master password can even be viewed in clear text while the software is locked. Yep, in a way, it’s like leaving your keys under your doormat. Surprisingly, 1Password’s newer version, 1Password7, is even worse since it decrypted all individual passwords in ISEs test, cached them all in the computer’s memory and failed to clear them out while transitioning from its unlocked state. In Dashlane’s case, only the last active password is exposed in memory while it’s running, but once a user updates any information on an entry, it exposes its entire database in plaintext in a computer’s memory. Worse, this information then remains there even after a user logs out of Dashlane. Similarly, KeePass and LastPass also showed vulnerabilities by keeping some of their unencrypted entries in a computer’s memory even after they return to their locked states. In most cases, closing out of a password manager completely (not just logging out of it) is the only way to clear the cached passwords from your computer’s memory.
They’re only as strong as your computer’s defenses
Is it time to panic? Not exactly. Here’s an important thing to keep in mind regarding these flaws — these are only exploitable if a hacker has already managed to install malware on your computer. Your computer’s operating system has built-in defenses against these type of memory access attacks, anyway. If someone can already peer into your password manager’s cached data, then your entire system is already compromised and your computer has bigger problems than that. Spoiler alert: Keyloggers, spyware, remote access software and ransomware can do much worse damage, and your password for CuteShoes.com may just be the icing on the cake. In fact, these security issues on password managers are nothing new and they’re all inherent to how they work within, say, an operating system like Windows 10. Thankfully, developers are still coming up with new mechanisms to protect password managers against cleartext password exposures in memory and malware attacks in general. The bottom line is this – if you are not employing good security measures on your computer, then nothing, not even your password manager, can keep you safe. Keeping your software updated by patching regularly, using reliable security software, strong passwords and enabling two-factor authentication are just some of the best practices you can do to keep your gadgets safe. Click here for more. Oh, and before I forget, using a password manager is still highly recommended. Please — don’t stop using yours.
