How Safe Are Password Managers?

In today's digital age, maintaining secure passwords across numerous online platforms is crucial for businesses to safeguard personal and sensitive information. With the proliferation of cyber threats that businesses face, password managers have become a popular solution for managing and securing multiple passwords efficiently. However, as with any technology, concerns about their safety and reliability persist. So, how safe are password managers, and should users trust them with their most sensitive credentials?

Understanding Password Managers - Are They Safe?

Password managers are software tools designed to securely store and manage passwords for various online accounts. They typically operate by storing passwords in an encrypted database, accessible only to the user via a “master password” or authentication method. This single master password is the key to unlocking the “password vault”, allowing users to access and manage their stored credentials across different devices and platforms.

Fortunately, nowadays, there are a number of trusted password managers that exist for businesses. They can either be available free of charge, which offers more basic services, or with paid subscriptions, which offer a wider range of services to provide an extra layer of security and more application support. Popular, trusted password managers include the following:

• 1Password - “more than a password manager”
• LastPass - “fewer passwords, less friction”
• NordPass - “your digital life manager”
• RoboForm - “next generation password manager”
• Dashlane - “the security-first password manager”
• Bitwarden - “the password manager trusted by millions”
• iCloud Keychain (Apple only)

Security Mechanisms - Safety First

When using password managers, several key security mechanisms assist in keeping your passwords secure. Each one is responsible for an extra layer of security; in short, the more security measures your password manager has, the safer your passwords will be. Let’s take a deeper look at how each mechanism works…

Encryption

One of the primary security features of password managers is encryption. Most reputable password managers use strong encryption algorithms to protect user data, such as end-to-end encryption (where data is encrypted on the user's device before being transmitted to the password manager's servers). This means that even if a hacker were to gain access to the stored passwords, they would appear as unintelligible strings of characters without the decryption key.

Two-Factor Authentication (2FA) and Multi-Factor Authentication

Many of the strongest password managers offer two-factor authentication (2FA) or multi-factor authentication (MFA), adding an extra layer of security. With 2FA or MFA, enabled users must provide a second form of verification, such as a code sent to their mobile device, before gaining access to their password vault. This significantly reduces the risk of unauthorised access, even if the master password is compromised. 2FA and MFA features are recognisable across many websites when you attempt to log in, so they may be something you’re already familiar with. 

Zero-Knowledge

Password managers often employ zero-knowledge security models. In this model, the service provider does not know the user's master password or decrypted data. This means that even if the password manager company were breached, hackers would be unable to access users' passwords or sensitive information.

What Are the Potential Risks and Concerns Associated With Password Managers?

Despite robust security measures involved there are still some risks to consider, as there are with most technology-based activities. Some of these risks are things which you can mitigate yourself, whilst others may be down to the security features implemented in the password manager systems. All this just reasserts the importance of choosing a safe, reputable password manager, as well as adhering to your own safety measures online.

Weak Master Password

Your master password should be incredibly strong and unique since it is responsible for the security of all your stored passwords in the online vault. If your master password is weak and potentially easy to guess, your sensitive data is at risk. Despite all the strong security features that a password manager provides, this is something of which you are in control, so ensure your master password is a good one! It should be the only one you ever need to remember!

Compromised Browser

The security of your web browser is another external factor that could affect the security of your password manager. If the device or browser is compromised by malware or keyloggers, it could intercept the master password or other sensitive information entered by the user. In order to mitigate this risk, users should ensure that their devices are regularly updated with security patches and use reputable antivirus software, as well as adhere to other general safety online advice (such as avoiding suspicious links). 

Bugs and Vulnerabilities

Even though password managers are generally very secure, no system is completely immune to exploits and vulnerabilities. Like any other software, password managers can unfortunately contain bugs and other vulnerabilities that could be exploited by hackers. However, reputable password manager companies typically have robust security protocols in place to promptly address and patch any vulnerabilities that are discovered, before anyone’s data has a chance of being compromised.

Case Study: “AutoSpill” Password Manager Breach, 2023

Last year, a type of credential-stealing threat was identified which did not involve any type of malicious code. This threat, known as an “AutoSpill” attack, involved legitimate autofill services provided by Android devices, which in turn could steal credentials from users when the credentials were “spilt” into Android WebView, a pre-installed component that allows Android apps to display web content. The autofill function vulnerability allowed hackers to essentially bypass any security mechanisms protecting the autofill function for Android devices, exposing any credentials to the host application which had called for them. The autofill function from password managers should only autofill credentials into the Google or Facebook page that has loaded, for example, but instead, it was loading important credentials outside of WebView which was easier for hackers to access. 

However, it is important to note that this exploit could only happen if a pre-existing malicious app had been installed on a user’s device, and since the vulnerabilities were discovered, many of the top password managers that had been compromised (such as Dashlane, Google Smart Lock, Keeper and LastPass) have brought out important security updates to prevent this threat from exposing further credentials.

What Are the Best Practices for Using Password Managers?

There are several ways in which you can maximise your credential safety when using password managers. It is important to be vigilant to the more common online threats that can occur, such as the legitimacy of online applications that are downloaded, since these are what were able to target vulnerabilities in the “AutoSpill” incident. 

Some of the best tips we recommend include the following:

• Choose a reputable password manager system by doing thorough research online, through industry-related news websites and by reading reviews.
• Use a strong and unique master password that wouldn’t be possible to guess, in order to keep your other passwords safe on the password manager system.
• Ensure that the password manager software is regularly updated, as well as your individual devices, to patch any bugs or vulnerabilities.
• Be extra cautious of any phishing attempts and suspicious pages by only entering passwords on legitimate websites.
• Enable two-factor authentication (2FA) or multi-factor authentication (MFA) for an added layer of security.
• If possible, consider using additional security measures such as biometric authentication where available, since these are unique to you.

Summary

In summary, password managers offer a convenient and secure solution for managing passwords across multiple online accounts. These can be especially beneficial for your business, and, while they are not immune to risks and vulnerabilities, reputable password managers employ robust security measures to protect user data. By following our best tips and by staying vigilant, you can confidently leverage password managers to enhance your online security and protect your sensitive information from cyber threats.

Are You Looking for Enhanced Cybersecurity Solutions?

At ReformIT, we believe that having a holistic approach to cyber security is needed for the best protection online. We offer a range of IT security solutions for businesses looking to give themselves the best defence against cybercrime, from security monitoring to incident responses. Please get in touch with us to discuss how we can support your business.

Contact us