Right, I get that. If you use them as a password manager you've definitely increased your attack surface. I would consider something like 1Password less attackable since the password database is kept local. However, this LinkedIn check utility isn't giving them your password—it's just doing the SHA-1 compute on it and then comparing that hash to a list of hashes that are already out there. I mean, I guess someone could theoretically compromise the server hosting that utility and replace the code with something that captures your password in plaintext and sends it off to some nefarious third party, but with no account name (or way to capture such) I'm having trouble seeing how that's useful information. ---- Jack Kramer Manager of Information Technology Communications and Brand Strategy Michigan State University w: 517-884-1231 / c: 248-635-4955 From: STeve Andre' <[log in to unmask]<mailto:[log in to unmask]>> Reply-To: STeve Andre' <[log in to unmask]<mailto:[log in to unmask]>> Date: Wednesday, June 13, 2012 5:11 PM To: "[log in to unmask]<mailto:[log in to unmask]>" <[log in to unmask]<mailto:[log in to unmask]>> Subject: Re: [MSUNAG] LinkedIn Password hacked. My distrust stems from having some other entity get your password. A single point of failure, and you are trusting them to do it right, and not be compromised. So yes, there *is* an increased attack surface here: you are adding to the complexity of things and trusting that they are secure. To me, that's increasing the attack surface. I don't know what else to call it. --STeve Andre' On 06/13/12 17:05, Kramer, Jack wrote: Are you objecting to the concept of a password manager utility or the check site that Matt posted? I agree that password managers represent a single point of failure, though that single point is at least easier to protect than the many points of weak password we seem to end up without any sort of manager; however, the LinkedIn check page they have just compares the SHA-1 hash of any text you enter with the known leak of SHA-1 hashes and tells you if there's a match. There really isn't an attack surface there considering you're perfectly welcome to download that hash leak yourself and run all the comparisons your heart desires on it. ---- Jack Kramer Manager of Information Technology Communications and Brand Strategy Michigan State University w: 517-884-1231 / c: 248-635-4955 From: STeve Andre' <[log in to unmask]<mailto:[log in to unmask]>> Reply-To: STeve Andre' <[log in to unmask]<mailto:[log in to unmask]>> Date: Wednesday, June 13, 2012 4:51 PM To: "[log in to unmask]<mailto:[log in to unmask]>" <[log in to unmask]<mailto:[log in to unmask]>> Subject: Re: [MSUNAG] LinkedIn Password hacked. On 06/13/12 16:30, Carl Bussema III wrote: Actually LastPass is a well-known and respected security tool, so I would actually trust them not to compromise the password. I actually tried to decipher the HTTPS session with Fiddler, but Chrome + LastPass detected a man-in-the-middle and wouldn't proceed. And because apparently some people need to be put out of their paranoia, I went ahead and just used my regular developer tools and found exactly what I suspected: I posted the password "asdf" to their form. I then watched the AJAX request (which because it happens client side is unencrypted before transmission) ... and you know what they are sending to their servers? THE HASHED PASSWORD. It's not like it's hard to SHA1 a string in JavaScript. So the send the hash to the server, check the list of "known bad hashes" (which is what the hackers have published) and tell you if your password hash matches a known compromised hash. It's really about as safe as you can possibly imagine and a great tool. Yes, we should be careful about inputting passwords onto strange sites, but you should also do your due diligence and check if the site might actually be legit. /rant Passwords are about as fragile a thing as there is today: users pick and display idiot pw's, and system (often) have bad security measures in place which don't really work. LastPass is likely an up-front honest entity, but that isn't the reason why they shouldn't be used. Trusting another entity with your pw increases the attack surface of the product you are testing. As good as LastPass is, your are now trusting them to be really secure. That they throw away the string you enter is good, but that means that vandals know just where to look if they were trying to break that system. This is a philosophical thing. Minimizing the places on the net that have pw's is a good thing. --STeve Andre'