0

I'm shopping around for a good password manager (yes, I'm picky) and today I ran into an interesting issue:

  1. I have my passwords stored in Google Password manager.
  2. For couple of sites I use LastPass to get the feel of it.
  3. For a new site I'm entering with saved-loaded credentials from GooglePass LastPass is offering to save entries to my vault. If I do, they are readable, decrypted and in plain sight.
  4. Since GooglePass saved credentials are supposed to be encrypted with my Google/Microsoft user/passwords HOW LastPass is able to read them? They are 'hidden' on the screen, and LastPass does not 'know' them. If I want to access them in GooglePass I need to provide my PC account credentials. How is it possible, that LastPass is doing (reading) it without any issues? Is it able to decrypt anything? Is it able to read ASC characters sent to the password box before they are 'hidden' on the screen as dots or stars? What about protection of my passwords I don't want to store in the vault

Since I act on the premise of 'limited trust' I'm slightly confused. Am I missing something obvious here?

Thanks!

Improve this question

1 Answer 1

Reset to default
0

The data entered into a password field on a website is in plain text and readable. On screen it shows as dots so a person can't read it over your shoulder but in memory it's not encoded or encrypted at all. The browser needs to send this plain text version to the server so you can log in. If it tried to send an encrypted value the website wouldn't be able to process the login request.

A password manager then can grab the username and password from either the browsers memory or by inspecting the HTTP request made to login. The password manager will probably install a browser extension to accomplish this.

Improve this answer
6
  • I agree - with one exception: The password is not typed - Google retrieves it from my password manager. Since at some point it it is readable by LastPass I consider it security hole, since anybody or anything can do it the same way. If it would be implemented in such a way: Google reads, decrypts it and sends to the target website in some 'private' mode - I would be ok with it. In this case I'm seeing the door open - password exposed to the third party, even after clicking the option on the extension 'I don't want to use it'.
    – Furatus
    Mar 22, 2019 at 11:33
  • What I'm trying to say: Unintentionally(?) Google exposes my passwords.
    – Furatus
    Mar 22, 2019 at 11:34
  • That's just how it works. Once the password manager populates the password field any extension or javascript capable of accessing that field will be able to read the password in plain text. Sometimes if I forget a password I have saved I'll inspect the field in dev tools and type $0.value in the console to print it.
    – kicken
    Mar 22, 2019 at 12:10
  • Thanks for your clarification. This confirms my worst suspicions I had for a while. I think the so called 'PC security' is just a way to talk people into buying services without providing strong protection. What difference does it make if I'm accessing 'https' site if the data sits in a plain view on my PC? I'm not paranoid, but my trust to the programs/vendors/pages is close to zero - and is not guaranteed by anything.
    – Furatus
    Mar 22, 2019 at 21:36
  • I bet all 'Terms and Conditions' addresses that. As a entry-level programmer I can easily write a script, which is not detected by any of reputable antivirus programs and read passwords of anybody in my family (that's for starters)? I will explore this a little more, I don't know anything about security. But the sample we are talking about tells me, that there is none. If a new Lenovo tablet asks me for crazy-excessive permissions when changing wallpaper or installing weather app the red light goes on. WHY? Do you think "That's just how it works" is a satisfactory reasoning?
    – Furatus
    Mar 22, 2019 at 21:37

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .