Software In News

Password managers on mobile devices – fail

23.05.12

The Russian software company is best known for its password auditing and recovery technology. The best way to audit the strength of a password is to see how easily it can be recovered or broken. Elcomsoft has turned these skills towards an evaluation of password management apps on mobile devices.

Password management on mobile devices is increasingly popular. No longer just a a voice device, mobile systems such as the iPhone and Blackberry are miniature computers and used for standard business computing purposes. Users are faced with the same problem on mobiles as they are on desktops: too many passwords to manage without help. Password management apps store users’ multiple passwords – but Elcomsoft wanted to find out if they store them securely. It tested 17 separate iOS and Blackberry apps, and has published the results in the detailed paper being presented at BlackHat Europe. 

Those results are disturbing. “Only one password management app for the iOS platform, DataVault Password Manager,” notes Elcomsoft, “stores passwords in secure iOS-encrypted keychain.” Overall, the content of the 10 of the seventeen password keepers can be recovered in less than a day, which is “guaranteed if user-selectable master password is 10 to 14 digits long.” But these are the ‘good’ ones. For the other seven, “Passwords stored in them can be recovered instantly because passwords are either stored unencrypted, are encrypted with a fixed password, or are simply misusing cryptography.”

Source: Infosecurity Magazine