Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Password Managers

lock.cmpxchg8b.com

Post reply on HN
Print view View original

321–330 of 342 posts

Re: Password Managers

#321

Post by justusthane »

paulryanrogers wrote: post #302
justusthane wrote: post #203

Earlier quoted context omitted.

> I believe the point the article is making is that any browser extension to auto fill is inherently insecure for architectural reasons. No, that is not what the article said. The article said that password managers that insert elements into the webpage are insecure. You don’t need need to do that to autofill passwords.

Can extensions auto fill without content scripts?

I don't think the Bitwarden extension uses content scripts—at least, it doesn't insert any elements into the webpage, which seemed to be the main issue that the article was bringing up.

Just to be clear, when I say autofill I'm not suggesting that it fills in passwords with zero interaction, but when you're on a website that Bitwarden has a password for, it shows a little flag on the extension icon, and you can click on it to fill the password.

Re: Password Managers

#322

Post by Wowfunhappy »

mimimi31 wrote: post #313
Wowfunhappy wrote: post #312

Earlier quoted context omitted.

Nope, they don't allow that anymore! https://blog.mozilla.org/addons/2020/03/10/support-for-exten... This is in addition to the fact that Firefox has absolutely mandatory code signing for extensions (the only recourse is to recompile Firefox). That's something I'm very much not happy about, but does have upsides.

I have a hard time imagining how they enforce that. What keeps a malicious program from replicating the exact changes that Firefox makes when installing an extension? What about just replacing the whole profile folder with one that has a malicious extension installed? >Firefox has absolutely mandatory code signing for extensions That helps I guess, but there are clearly still malicious extensions that can pass the au…

> What keeps a malicious program from replicating the exact changes that Firefox makes when installing an extension? What about just replacing the whole profile folder with one that has a malicious extension installed?

I obviously haven't spent time trying to break this, but I would assume the config file is hashed. You probably could replace the whole profile, but that would be very noticeable to the user.

Re: Password Managers

#323

Post by DeathMetal3000 »

To me anyone dispensing security advice while using Chrome loses all credibility. Sure, it’s not an insecure browser per se. But it facilitates Google slurping my data and that falls within my threat model.

Re: Password Managers

#324

Post by Ajedi32 »

kstrauser wrote: post #189
Ajedi32 wrote: post #182

Earlier quoted context omitted.

But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?

If a crappy website’s user database gets attacked, the hacker may have my plaintext password stored in it. They may not have my 2FA seed, so there’s at least a chance that the attacker still may not be able to access my account. I think this is much more likely than an attacker cracking my 1Password vault.

Wouldn't the TOTP seed be stored in the same breached database? Where else would they store it?

Re: Password Managers

#325

Post by kevinkeller »

mackrevinack wrote: post #245
Dedime wrote: post #97

Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…

auto-type is much more secure than using the companion keepassxc browser extension to fill your passwords since it didn't need a connection between your browser and your password manager. it also removes the chance of some dodgy website having a username and password box off screen and using it to trick the atuofill feature. one minor inconvenience with auto-type is that your passwords don't auto fill by themselves,…

> another downside with auto-type is that not all websites put their full names in the browser title bar so auto-type won't show you your related passwords in some cases. to fix that you can install a browser extension that puts the full web url in titlebar https://github.com/erichgoldman/add-url-to-window-title

Instead of modifying the browser title, I use AutoTypeSearch plugin for Keepass, that opens a dialog allowing me to suggest entries in case of no matches.

There is also another plugin that allows search using both URL and title -- "WebAutoType".

These two plugins together make the Keepass experience almost seamless.

Re: Password Managers

#326

Post by gtyras2mrs »

kiwijamo wrote: post #314
yunohn wrote: post #112

Earlier quoted context omitted.

Bitwarden definitely supports this interface, I use it. You can check which provider is enabled in your system settings.

Where might I find it and what's it called? I have had a look and can't find anything. Although it's possible Xiaomi doesn't include it in their version of Android.

System -> Languages & input -> Autofill service

Not sure if MIUI was organised differently.

Re: Password Managers

#327

Post by Seb-C »

brabel wrote: post #261
kbuck wrote: post #38

I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…

> exploiting a browser-based password manager likely means escaping the sandbox that contains web pages and accessing the shadow DOM Any PM that injects a script into the DOM is vulnerable, as the article explains, because the script runs with the exact same privilleges as everything else in the DOM (so the existing DOM can mess with your script or with the changes your script tries to make). Also, the shadow DOM has…

The page's scripts can indeed see and alter the changes you make to the DOM, but cannot access the extension's script or data, so there isn't much risk actually.

Extensions are protected by a mechanism called Xray vision, not the shadow dom.

https://developer.mozilla.org/en-US/docs/Mozilla/Tech/Xray_v...

Re: Password Managers

#328

Post by Thorrez »

tialaramex wrote: post #284
Thorrez wrote: post #236

Earlier quoted context omitted.

Overall I agree, but couldn't Edward steal the users' Facebook cookies regardless of WebAuthn? I think those last until the user clicks logout, so many of them will last forever. Additionally, Edward can steal the cookies of every user using Facebook for that hour. But he can only steal the passwords of a small fraction of those users, because only a small fraction will start a new session; most users will use existi…

Facebook can invalidate all existing cookies, and with them Edward's access based on cookies. This is slightly inconvenient for users (they are logged out and need to log back in) but it locks Edward out except for where users are relying on passwords alone and Edward knows their password. You as an individual Facebook user can also invalidate sessions you subsequently realise shouldn't exist and thus the associated…

Invalidating all cookies will only happen if Facebook learns of the attack. Facebook can invalidate all cookies used during the 1 hour period, and they can also invalidate all passwords used during the 1 hour period (a much smaller number) and force people to recover their accounts by other means (recovery email or phone). Yes, it would be quite painful, but it would be possible.

Most users are not motivated or knowledgeable enough to manually invalidate sessions. If a user is motivated to do that, the user could just as easily do a password change.

Re: Password Managers

#329

Post by kiwijamo »

gtyras2mrs wrote: post #326
kiwijamo wrote: post #314

Earlier quoted context omitted.

Where might I find it and what's it called? I have had a look and can't find anything. Although it's possible Xiaomi doesn't include it in their version of Android.

System -> Languages & input -> Autofill service Not sure if MIUI was organised differently.

Wow apparently Bitwarden is already set as the autofill service. So it does seem like the Android implementation is not quite as polished as the iOS. Although I'll definitely have to teet a device from a different vendor to be sure it's not some issue Xiaomi has added in...

Re: Password Managers

#330

Post by brabel »

ubercow13 wrote: post #268
brabel wrote: post #261

Earlier quoted context omitted.

> exploiting a browser-based password manager likely means escaping the sandbox that contains web pages and accessing the shadow DOM Any PM that injects a script into the DOM is vulnerable, as the article explains, because the script runs with the exact same privilleges as everything else in the DOM (so the existing DOM can mess with your script or with the changes your script tries to make). Also, the shadow DOM has…

Why does that matter if the content script doesn’t have privileged access to anything itself?

Because one can monkey-patch any JS function used by the injected script, as the OP showed, to make the injected script do whatever it wants it to.
Post reply on HN