Browser Extension Password Managers Exposing Passwords Everywhere
isecpartners.github.io
Browser Extension Password Managers Exposing Passwords Everywhere
1–10 of 93 posts
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#2Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#3Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.
I am curious, is there a way to do OTPs with offline databases?
I tried poking around with the add-in, but couldn't quite determine whether the implementation could properly protect from replay attacks, most notably whether a copy of the xml file used and the matching old OTP would be enough to unlock a newer database file.
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#4I see it's not mentioning the open source KeePass.
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#5How bad is it for LastPass? I've used KeePass for a while, but the convenience of LastPass is such a killer feature :(
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#6Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.
Why NON--browser-integrated? What's wrong with the one integrated in the browser?
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#7I see it's not mentioning the open source KeePass.
Because it's not a browser extension, which auto-fills the login fields. And that's why I use KeePass.
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#8Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain.
1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find useful.
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#9Every example in this paper stems from the issue that these password managers do not respect same origin policy. Sounds like something that's easy to fix for the developers.
Re: Browser Extension Password Managers Exposing Passwords Everywhere
#10Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…
With LP, auto-fill is an opt-in, per-domain feature.