Password manager

Some applications store passwords as an unencrypted file, leaving the passwords easily accesible to malware or people attempted to steal personal information.

Some password managers require a user-selected master password or passphrase to form the key used to encrypt passwords stored for the application to read. The security of this approach depends on the strength of the chosen password (which may be guessed through malware), and also that the passphrase itself is never stored locally where a malicious program or individual could read it. A compromised master password renders all of the protected passwords vulnerable, meaning that a single point of entry can comprimise the confidentiality of sensitive information.

As with password authentication techniques, key logging or acoustic cryptanalysis may be used to guess or copy the "master password". Some password managers attempt to use virtual keyboards to reduce this risk – though this is still vulnerable to key loggers that take the keystrokes and send what key was pressed to the person/people trying to access confidential information.

Some password managers may include a password generator. Generated passwords may be guessable if the password manager uses a weak method of randomly generating a "seed" that all passwords generated by this program. Or, as in the case of LastPass[11], the methods used to generate passwords may become comprimised, leading to passwords generated by the application being easier to guess.

Furthermore, password managers have the disadvantage that any potential malicious individual or malware would just need to know one password to gain access to all of a user's passwords and that such managers have standardized locations and ways of storing passwords which can be exploited by malware.[12] This is known as a single point of failure.

Various high-profile websites have attempted to block password managers, often backing down when publicly challenged.[13][14][15] Reasons cited have included protecting against automated attacks, protecting against phishing, blocking malware, or simply denying compatibility. The Trusteer client security software from IBM features explicit options to block password managers.[16][17]

Such blocking has been criticized by information security professionals as making users less secure.[15][17] The typical blocking implementation involves setting autocomplete='off' on the relevant password web form. Consequently, this option is now ignored from Internet Explorer 11[14] on encrypted sites,[18] Firefox 38,[19] Chrome 34,[20] and in Safari from about 7.0.2.[21]

A 2014 paper from researcher at the Carnegie Mellon University found that whilst browsers refuse to autofill if the protocol on the current login page is different from the protocol at the time the password was saved, some password managers would insecurely fill in passwords for the unsecured (HTTP) version of encrypted (HTTPS) site passwords. Most managers did not protect against iframe and redirection based attacks and exposed additional passwords where password synchronization had been used between multiple devices.[18]