Four Ways You Can Protect Your Password Manager From Malware

Karen Scarfone 08-12-2014

Password managers are utilities for safeguarding your passwords. By entering a single master password, you can gain access to all your securely stored passwords. This allows you to have a unique, complex password for every website and application you use while only having to remember a single master password. Sounds great, right?


Unfortunately, attackers have begun to target some popular password managers. If your computer has been infected by malware, the malware can use keylogger software 5 Ways to Protect Yourself Against Keyloggers Keyloggers are one of the most feared threats to computer security. Heed these tips so you don't fall victim to hackers. Read More to record your keystrokes when you type in your master password, stealing it. This allows the malware to gain access to your stored passwords. In this case, a password manager can actually decrease security because all the passwords can be compromised by stealing just one.

The best practice, of course, is to keep your computer free of malware. But you actually have several other options for improving the security of your password manager so that it’s less vulnerable, should your computer be infected by malware.

Virtual Keyboard

Some password managers, such as Password Safe and LastPass, offer virtual keyboards. Instead of entering your master password with the keyboard, you enter it with a graphic keyboard displayed on the screen. Password Safe has a little keyboard icon to the right of where you would normally type in a password, and LastPass has a hyperlink that says Screen Keyboard.

Logon screen for Password Safe utility

When the virtual keyboard is displayed, you click on the letters, numbers, and symbols that make up your master password. The idea of using a virtual keyboard is that keyloggers can track keystrokes, but most can’t track the screen location of mouse clicks. So when you enter a master password using a virtual keyboard, the keylogger probably won’t be able to steal it. Be careful, though, because some forms of malware can monitor screen activity and still reveal your password through observation.


Virtual keyboard for Password Safe utility

One-Time Passwords

A virtual keyboard provides a stronger authentication solution than typing in a password, but stronger solutions are available. A one-time password is, as the name implies, a password that you can only use one time. Some password managers, such as LastPass and Intuitive Password, support the use of one-time passwords. Because a one-time password is only good the first time it’s used, an attacker that captures you using it can’t reuse it themselves.

The list below presents computer-generated one-time passwords from LastPass. Note that there is a Print option; it is a common practice to print out these passwords and store them in your wallet for safekeeping. It may be tempting to save them in a file on your computer, then copy and paste them into your password manager as needed, but this is a poor security practice. Assuming that your computer gets infected by malware, the malware is likely to seek out text files containing passwords, and if anyone gets physical access to your computer, they could copy and paste the password and immediately gain access to everything stored in your password manager.

One-time password listing from LastPass


Another option for one-time passwords is to get a randomly generated number from a special one-time password application. A notable example of this is the Google Authenticator mobile app. Password managers such as DashLane and LastPass can leverage Google Authenticator. When you want to unlock your passwords, you go to your mobile device and generate a new one-time password using Google Authenticator Can Two-Step Verification Be Less Irritating? Four Secret Hacks Guaranteed to Improve Security Do you want bullet-proof account security? I highly suggest enabling what's called "two-factor" authentication. Read More . Then you type this password (typically six digits) into your password manager. Here’s a video that shows you how to set up Google Authenticator for use with LastPass.

There are also password managers such as Intuitive Password that can be configured to send you a one-time password through a text message.


Another option for some people is the use of biometric readers, such as fingerprint scanners. The Premium version of LastPass and the RoboForm utility both support use of biometrics in lieu of a master password. Some computers, especially laptops, have fingerprint scanners built in, and some computers (desktops and laptops) have external fingerprint scanners.

If your device already has a fingerprint scanner, you might want to consider acquiring a password manager that can use that scanner. If you don’t have a scanner, one of the other options (virtual keyboard or one-time password) is probably a better fit for you.


Multifactor Authentication

A final option is multifactor authentication. So far we’ve only talked about single-factor authentication, which means using a single authentication method, typically a password. For stronger security, you can adopt multifactor authentication, which refers to using multiple authentication methods at the same time, such as a password (something you know) and a fingerprint (something you are).

For example, the password manager KeePass can use a cryptographic key file that it sets up on a USB flash drive, along with a password. If an attacker gets your password, they would still need to get your flash drive, and vice versa. But if your computer is infected with malware, it’s likely that a determined attacker could grab a copy of your key file from your flash drive as well as your password. So in this situation, multifactor authentication may not be stronger than single-factor authentication.

Most people will find multifactor authentication unnecessarily complicated for their password manager. Ultimately, if your computer is infected with malware, your passwords are at risk. And no matter how strong your password manager’s authentication method is, at some point you’ll be unlocking that secure vault of stored passwords and malware will be able to access it. Strengthening your authentication method  is a deterrent, not an absolute preventative.

Recommendations for Password Manager Authentication

Using a regular password to protect your password manager is becoming increasingly risky because of malware. Consider using a virtual keyboard, or even better, a one-time password in place of a master password to thwart the possibility of malware grabbing your master password and accessing your stored passwords.


And don’t forget to follow all the recommended practices for keeping malware off your computer, such as foiling social engineering attacks How To Protect Yourself Against Social Engineering Attacks Last week we took a look at some of the main social engineering threats that you, your company or your employees should be looking out for. In a nutshell, social engineering is similar to a... Read More , using antivirus software What Is The Best Free Antivirus Software? [MakeUseOf Poll] Because no matter how careful you are when using the Internet, it's always advisable to have antivirus software installed on your computer. Yes, even Macs. Read More , and promptly installing patches and updates 3 Reasons Why You Should Be Running The Latest Windows Security Patches & Updates The code that makes up the Windows operating system contains security loop holes, errors, incompatibilities, or outdated software elements. In short, Windows isn't perfect, we all know that. Security patches and updates fix the vulnerabilities... Read More for your computer’s operating system, web browser, and other important applications. If your computer doesn’t get infected in the first place, the strength of your password manager authentication won’t be so important.

Are you prepared to handle the threats against your password manager? What precautions are you taking?

Image credits: Phone security by Ervins Strauhmanis via Flickr

Affiliate Disclosure: By buying the products we recommend, you help keep the site alive. Read more.

Whatsapp Pinterest

Leave a Reply

Your email address will not be published. Required fields are marked *

  1. Gavin
    December 9, 2014 at 1:58 pm

    I keep my passwords in an entirely not very useful encrypted .csv on a drive attached to my keys. Chrome can be quite easily forced into exporting passwords, so it is worth considering all your options!

  2. Luke
    December 9, 2014 at 12:55 pm

    Hey Karen, great article! I like you have summed it up so I know there are also one time passwords possibilities within some password managers. I use Sticky Password ( and they have a virtual keyboard too as well as fingerprint reader authentication on supported devices.
    Which antivirus application do you recommend by the way?