I made a video comparing a couple of open source password managers, and after that
video Passbolt got in touch to say "Hey, have you seen ours?"
My initial reaction was: "Wait a minute... aren't you the guys who put multi-factor authentication
behind a paywall?
I'm not okay with that."
So I checked and no, it's included in the free tier.
So I Googled it and found a video by John Hammond, and the comments... oof, there it is
again!
Something doesn't add up here; so I checked the internet archive, went back in time to
January, and found a smoking gun.
No MFA in the community tier.
So I didn't make this up.
This is why people were upset.
But they've fixed it now, right?
Well, actually... all of this is wrong!
This person was wrong!
This website was wrong!
Everyone seems to have gotten this wrong, so let's find out what actually happened.
Welcome back to the Pro Tech Show.
You might not think it from that intro, but this video is sponsored by Passbolt.
They paid to be featured, but I didn't want to make yet another video showing you how
to use a password manager.
Instead, I want to take a closer look at their security; because this is something that differentiates
Passbolt from a lot of the competition,
and after the LastPass breach I think it's something that deserves closer scrutiny.
I'm sure Passbolt would like me to clarify that the free community tier does now include
multi-factor authentication.
So I'll get that out of the way before I start declaring it all nonsense anyway.
In case you're wondering why someone might get worked up about this in the first place,
MFA is not something I consider to be optional.
It's a basic security necessity, and Passbolt is a security product; so it really needs
to have it in place.
Hiding MFA behind a paid upgrade is not acceptable.
I'm not saying it needs to be free.
You can have a commercial product with no free tier.
That's OK, but whatever your bottom tier is: free or paid, MFA needs to be included.
You cannot have a product edition that puts your customers at risk.
So given I feel this way, and given Passbolt as recently as this year didn't include
it... why am I even talking to them?
Well here's the thing.
Passbolt's own website, in my opinion, was wrong.
Let's have another look.
It clearly says multi-factor authentication was a paid upgrade, but it wasn't.
Here's what I think the website should have looked like.
Free tier, MFA, (two-step verification).
Business tier, additional MFA, (three-step verification).
This I feel would have been more accurate; and now all tiers have the full multiple multi-factor
option anyway.
To understand why I disagree with Passbolt about their own website, and why I think their
security is worth a dedicated video, you need to understand how most password managers
protect your data.
With LastPass or Bitwarden, and many others, it's all about your master password.
This doesn't just log you in, it is also used to encrypt your vault.
There's some good reasoning behind this.
They use a zero-knowledge model where the provider doesn't store your password.
The idea is that even if the provider gets hacked and your password vault gets stolen
the bad guys can't do anything with it unless they also have your master password to decrypt
it;
and the provider doesn't have that.
This means in theory all the people whose vaults were stolen when LastPass got hacked
should be safe.
That's the theory.
In practice, it all depends on that master password.
If the password was strong, yes, they should be safe.
But you probably already guessed the problem.
Not everybody used a strong enough master password, and those people are now in serious
trouble.
Passbolt took a different approach.
Passbolt is also a zero-knowledge password manager, and Passbolt also uses a master password;
but that master password is not used to encrypt your vault.
Passbolt wanted to build something so secure that even if the bad guys managed to hack
Passbolt and steal your vault, and those very same bad guys got hold of your password, it is still
not enough to access your data.
Let's look at how you log in to Passbolt.
This looks familiar, right?
You type your password and you're in.
There was no multi-factor prompt because I have not enabled the multi-factor authentication
on my free instance of Passbolt.
But I contend that this page is wrong.
Look, the options are here in the free edition now; but this is still wrong.
Let me fix it.
Additional multi-factor authentication.
Now I know what you're thinking:
you just saw me log in.
I typed a password and that was it.
Where was the second factor?
Well, actually, the password was the second factor.
The question you should be asking is: "What was the first factor?";
and this is where things get interesting.
Unlike a lot of other password managers, the encryption key used to secure your vault in
Passbolt is not derived from your master password.
Instead, Passbolt uses an encryption system called PGP.
This uses public key cryptography, much like SSL certificates.
In public key cryptography there are two keys:
a public key that Passbolt knows and a private key that only you know.
The encryption key for your vault is derived from your private key.
This key is installed on your device and that key is your primary authentication factor.
There are a couple of reasons why a private key is way more secure than a password.
The first is… well just look at it.
The longer a password is, the harder it is to break.
Good luck trying to crack that monster!
The other reason it's more secure is that unlike passwords where most websites have
you send the password, your key, to the website; the private key never leaves your computer.
The way the public and private keys work is that anything encrypted with one key can only
be decrypted using the other key.
To verify your identity, Passbolt doesn't need to see your private key.
Passbolt can verify you have it by encrypting some random information using your public
key and challenging you to try and decrypt it.
If you can decrypt the challenge and give Passbolt the correct answer, that proves you
must be in possession of the correct private key.
This all happens invisibly in the background because my device has the private key installed.
The first authentication factor is therefore my device itself: something I have.
The password is the second authentication factor: something I know, but it never actually
gets sent to Passbolt either.
When I typed in the password here, that wasn't used to log into Passbolt.
You see this private key?
It's useless right now because it's encrypted.
It's also not one I actually use. Don't get too excited.
Unlike with LastPass or Bitwarden, my password doesn't encrypt my vault.
It encrypts my private key.
When I logged in with the password, I wasn't logging into Passbolt. I was unlocking the
key on my own computer.
If the key wasn't encrypted then if someone stole my device they could log into Passbolt
because they'd have my private key.
Because the key is encrypted you need both my device (something I have) plus my password
(something I know) to decrypt the private key on my device to log into Passbolt.
That's multi-factor authentication, even with Passbolt's multi-factor authentication
feature supposedly disabled.
If you try to log in using a device without the key, you don't get the chance to enter
a password; because there's no key there to decrypt it in the first place, so no way
to log in.
You can enter an email address, but this just starts your account recovery process.
If I follow the link in my email I get to a page that asks for my private key.
There's no getting past it. You need the key.
By the way, this webpage doesn't send the key to Passbolt, either.
It installs an encrypted copy of the key in the Passbolt browser extension's local storage.
We'll be coming back to that, because there's more.
But here's a question first:
Passbolt's baseline authentication is already multi-factor, but how good is it?
Because as I pointed out in a recent video, different authentication factors are not equally
strong.
In that video, I arranged a lot of common device factors into a tier list of sorts;
so where would Passbolt's fit?
It's using public key cryptography with a private key installed on your device.
That's functionally equivalent to certificate-based authentication, which I already placed on
the Good tier.
If you haven't seen that video, I'll link it below, but the difference between the Good
and the Best tier is that the methods in the Best tier also provide protection against
man-in-the-middle attacks and phishing.
These typically start out with an email that invites you to click on a link.
This link takes you to a website that looks like the one you're expecting to log into,
but it's not.
It belongs to the attacker.
It might be a mocked-up replica of the real site, or if they're being really clever
what they can do is position themselves between you and the real site.
When this happens, your browser creates an encrypted connection to the attacker and
the attacker creates their own encrypted connection to the real website.
Anything you send to them, they pass on, and anything the real website replies with, they
pass back to you.
This means the website you're staring at looks and behaves like the real thing.
When you log in, you'll even see your own data from the real website.
Because the attacker's sat in-between decrypting and re-encrypting the data, though they can
see everything.
The multi-factor authentication methods in the Best tier protect against this by working
with your browser to validate the website you're connected to.
If it doesn't match the address stored in the authentication device or embeded in the
authentication request, they won't respond.
So what about Passbolt?
Have a look at this.
I'll open Chrome's DevTools so you can see the traffic between my browser and YouTube.
The request URL is the bit I want you to pay attention to.
This is the web address the browser is requesting data from.
Nothing surprising here.
Now look at Passbolt.
If I select one of its requests, take a close look at the URL.
It doesn't start with HTTPS like a normal website address.
It starts with "chrome-extension".
That's because my browser is not talking directly to the Passbolt website.
It's talking to my Passbolt browser extension and the extension is talking to Passbolt on
its behalf.
This is weird.
You'd expect your web browser to talk to the web server, but instead Passbolt has its
extension stuck in the middle.
Part of the reason for this is encryption.
When you request sensitive details like a password from the server, the password itself
is encrypted using PGP.
This is an additional layer of encryption inside the normal browser-level HTTPS
encryption, which neither your browser nor any attacker sat in the middle of your connection
can decrypt.
The extension is needed to decrypt that second layer.
Another thing the extension does is that it verifies the identity of the server you're connecting
to.
If you land at a Passbolt login page, but the address doesn't match the details stored
in the browser extension, it will not allow you to log in.
Here's an example.
This is my Passbolt server.
If I disable the browser extension and try to log in, it doesn't work, and I get taken
to the account recovery page; because without the extension, there's no private key.
Now I'll enable the extension and log on normally.
By the way, this orange colour and the letters "PTS" are user-specific indicators I selected
when I logged in.
It's a way of making it harder for an attacker to mock up a replica website, because they
won't know what combination of colour and letters to use for every account.
I'll log in normally so you can see everything's above board.
Now I'm going to make a tiny change to the URL.
It's no longer PTS.lab, it's now PTS.lob.
This is actually the same website, but I've presented it on a different URL using a tool
called Burp Suite that has been used to launch real-world man-in-the-middle attacks.
It looks legit, and the difference in URL is very subtle.
This is how a real-world attack might look.
If I try to log in though, you'll see I'm taken to the account recovery page.
The extension is enabled; in fact, it's still logged in;
but even though this is the Passbolt server the extension talks to, it will not communicate
with the server because the URL has been tampered with.
This is not the correct address, so the Passbolt extension refuses to authenticate me to it.
So actually, if you go back to the multi-factor authentication tier list from an earlier video,
Passbolt does not sit in the Good tier.
It has got protection against man-in-the-middle attacks, which means by my own pre-existing
criteria it has to be placed in the Best tier.
And remember, this is with Passbolt's multi-factor authentication feature still disabled.
It's kind of bizarre.
People were shouting at Passbolt and begging them to add one-time passcodes to the free tier
because according to their own website it didn't have multi-factor authentication;
but the crazy thing is that all the time, the authentication Passbolt was using was
not only multi-factor: it was more secure than using one-time passcodes!
That's why I wanted to make this video. Because having looked into what they're doing, it
seems to me that Passbolt have done a better job of building their security than explaining
it to people, and they really are trying to go above and beyond here.
That leads me to an interesting question, though.
Now that the multi-factor feature is also available in the free tier as well, and given
Passbolt without its multi-factor feature is still multi-factor, should you even use the
additional MFA?
I mean, look, I'm the kind of guy where if there's a security feature available, I'm
going to turn it on. So yes, I'd use it.
But does it really make a difference?
In most cases, you won't be adding any additional factors.
Passbolt already uses the knowledge and the possession factors, so it's two-factor.
A one-time passcode is a possession factor, so that's still two-factor.
You're using a possession factor twice, but there are still only two unique types of factor
being used.
Passbolt's YubiKey support only extends to using it as a one-time passcode generator,
so that's another possession factor.
If you really want to add something that's unarguably an extra layer of security, you could use DUO;
because DUO will support a biometric YubiKey.
So now you've something you know, the password; something you have,
your computer with the Passbolt private key;
another something you have, the YubiKey BIO with its FIDO2 private key;
and then something you are, your fingerprint to unlock the YubiKey BIO.
Yes, this is possibly getting a bit silly now.
I mean, I'd still enable the extra multi-factor option because it's there, but Passbolt
is doing a good job of security, even without it.
Which may make you ask the question "Is there a cost for this security?"
The answer is "yes and no".
It's in the free edition, so there isn't necessarily a financial cost; but there are
other types of cost.
One of the guys I work with likes to talk about this idea of the security triangle.
The points in this triangle are security, cost, and convenience; and any time you tug
on one corner of that triangle, something else has to move.
In Passbolt's case, they're adding in more security than your average password manager,
so they're tugging away at the security corner.
You get all of the security in the free version, so the cost isn't moving.
That leaves convenience.
Now, not saying Passbolt's difficult to use.
In fact, it's pretty easy.
Add and view passwords using a website, browser extension, or a mobile app.
Auto-fill forms, etc., etc.
If you're familiar with password managers, you'll know the drill.
The complexity is in the management of those private keys.
If you lose that key, you're screwed.
That's by design.
If you don't have the key, you're not getting in.
It's part of the security.
For the sort of people who watch this channel, you're probably OK with that.
Go, deploy a self-hosted instance of Passbolt for free, look after your key, and get on with
your life.
But let's be honest: it's a bit complicated for your average computer user.
Oh, your laptop got stolen?
Here's your new one.
Log in with your key.
Oh... your only copy of that key was on that laptop...
right...
Passbolt knows this.
If you look at the wording on the website, they talk about it being a password manager
for teams or for organisations.
It's aimed more at business use cases than individuals, which makes sense; because I think
that either you need to be fairly switched on to the importance of looking after your
private key, or you need someone in an IT department worrying about that for you.
And this is OK.
In the other video I made comparing password managers I said that password managers that
are aimed at being convenient for home use don't scale particularly well to business
scenarios, and enterprise password managers are far too complex for your average person
to maintain.
They all fit somewhere on this scale and have a range within which they work best.
I use a different password manager at home than I do at work for this very reason.
Passbolt seems to be targeting the middle section of this scale - the standard kind of password
sharing you might find within teams rather than within home use.
If you're considering it for business purposes, I would recommend upgrading to a paid version;
because with that you get the escrow feature that provides a way to recover accounts for
other people.
If you're managing this at scale, that's going to make it easier to deal with those
private keys.
You see, we're tugging on that triangle again.
The other feature you get with a paid version that I consider to be essential for business
use is audit logging.
For me, that's a must-have for businesses.
If upgrading to a paid version, make sure to use the promo code PRO-TECH-SHOW.
I don't get anything for that, I've already been paid, but you will get a 20% discount.
If you want to learn more or test it out, head over to Passbolt.com.
It's open source, so if you're that way inclined you can take a look at the code for
yourself.
They've had third-party assessments carried out as well; and most of those reports have
been published so you can read them, too.
So there you go: another open source password manager for your consideration, and one that
should be of interest to those who prefer a balance tipped more heavily towards security
than raw features.
Speaking of security: I've talked about multi-factor authentication a lot in this
video, but Passbolt's key and browser extensions only work for Passbolt.
For everything else, you'll need another type of multi-factor authentication; and this
video will tell you which ones are the most secure so that all of your accounts can remain
protected, and not just Passbolt.