31–40 of 212 posts
Isn't copying the password to clipboard a vulnerability? I think a better idea would be to fill in the password through something like xdotool
Password managers clear the clipboard after 1 minute or so.
I've been using pass for a long time now. I have over 200 passwords stored. I like it because you can use it to store sensitive info along with metadata, not just single field passwords. It's also super easy to access the info on the command line with ways to auto-copy passwords to your clipboard (which expires after 45 seconds). I did a write up on it a while back at https://nickjanetakis.com/blog/managing-your-pass…
Isn't copying the password to clipboard a vulnerability? I think a better idea would be to fill in the password through something like xdotool
Sure other applications can see the clipboard, but if you've got software running on the user's machine you've already won.
Earlier quoted context omitted.
Password managers clear the clipboard after 1 minute or so.
there are so many clipboard listeners out there :D so the fact that you clear the clipboard doesn't really matter
A password manager effectively can't protect against other applications on the same machine. IMO that makes the universality of the clipboard more valuable than the safety of using alternate input methods.
Though since there are plenty of things that block pasting passwords, those alternate options are appreciated.
Earlier quoted context omitted.
there are so many clipboard listeners out there :D so the fact that you clear the clipboard doesn't really matter
Clearing the clipboard protects against the user. A password manager effectively can't protect against other applications on the same machine. IMO that makes the universality of the clipboard more valuable than the safety of using alternate input methods. Though since there are plenty of things that block pasting passwords, those alternate options are appreciated.
I think this is something the browser should offer by default.
I don't like the fact someone with access to my hard-drive can figure out all the services I'm using just by looking at the filenames. It's convenient yes, but I prefer one encrypted file that contains it all.
See https://github.com/roddhjav/pass-tomb
However keep in mind it's not always a big "issue", for instance only looking at your browser history will retrieve the same knowledge.
I've been using pass for a long time now. I have over 200 passwords stored. I like it because you can use it to store sensitive info along with metadata, not just single field passwords. It's also super easy to access the info on the command line with ways to auto-copy passwords to your clipboard (which expires after 45 seconds). I did a write up on it a while back at https://nickjanetakis.com/blog/managing-your-pass…
How do you deal with multiple devices? Do you sync your password files regularly between them?
Anybody else here simply hashing their master password with the domain name of the website? I think this is something the browser should offer by default.