Is It Possible to Hack a Password Manager?

The ugly truth is that the question ‘Is this secure?’ cannot be answered with a definitive yes or no because security isn’t just black or white. All the same, it’s important to know what makes a password management service vulnerable based on whether the service is cloud-based, provided via an application, or open source.

Accessing the whole password database

Take LastPass, 1Password or Dashlane, for example, which are among the most popular password managers. LastPass managed to grab the headlines in the past and not in a good way: in mid-2015 cyber criminals copied its main password database, a year later a security researcher discovered a user-interface flaw, and in 2017 browser-based extension vulnerabilities were found.

Getting access to local files

A group of German researchers also discovered various security flaws in 1Password’s Android app. Due to a design flaw, the password managers’ built-in web browser allowed files from the app’s private data directory to be extracted, opening the door to the database file and therefore user passwords and other sensitive data.

What does this mean for users?

Such security flaws represent a solid reason for users to remain skeptical about password management services. It’s an understandable point, but in the meantime the lack of proper tools to secure online accounts with strong passwords, users provide an attack surface to cyber criminals. Just consider the low security measures that people tend to use, such as using the same password with multiple accounts.

Expecting 100% security from a piece of software isn’t feasible, so user should be aware of the risks and consider the methods that password manager developers have taken to mitigate them. If their efforts are enough, then the benefits of using a password manager will ultimately outweigh the risks.

How password managers protect user data

Thanks to smart password storage design, the LastPass database leak didn’t expose any user data; hackers could only see gibberish. Other security flaws found in password managers by white hat hackers are usually fixed, with better services ensuring these issues are resolved quickly and communicated well.

The theory states that every internet-accessible database represents an attack opportunity for hackers, while locally stored files don’t. That’s only partly true, since there are ways to mitigate cyber attacks.

Each service uses its own approach to security, but the basis of each of them is encryption. Password hashing and salting further increases the level of protection but not all password managers use this. Before making use of a password management service, check the security measures that it takes to protect user data.