Browser password managers – flawed security, by design

If your home directory is readable or writable by anyone other than you, you're compromised in a dozen more important ways, even though this is of very high importance. Your home directory's security is an axiom. It's not true, no, in the same way that there were once upon a time remote exploitable worms in major http frameworks but we don't question that a webserver doesn't allow remote-code-execution - it's the wrong layer of abstraction.

Even encrypting the browser's data store at the application level is misguided and probably pointless - Anything that can read the browser's files is going to read the encryption key just as well . Anything that can read the browser's files when running as you is probably going to pop up an identical looking "Enter Password" prompt and will have the right timing and permissions to enter it into the browser once it's been leaked. Gui frameworks are not designed to protect the user from malicious applications.

Android actually handles this much better - Applications (Rather, developers) are given their own user id, and so separation of files between apps is enforced at the OS level. Some level of this is why everyone has moved to Docker on the server, too.

Lot of critical reactions, maybe deserved. Some saying master password is not all that important. I notice that with Firefox Sync that means knowing the unlock swipe of your Android is all that's needed to view passwords in plain text via the Settings UI when you lose your phone or someone peeks in it on an unguarded moment.

The new Hell I'm experiencing is everyone wanting to validate my identity through my phone. Email does it, banking does it, I suspect by the end of the year Windows will probably be sending me a code before I can log in. I'm sick of it. I don't like needing to have my phone on me, I don't like the fear that if I lose my phone I'll be locked out of everything, and I really don't like being forced into this.

It feels like there's a lot of fear around passwords right now. I'm sure companies see them as a liability and are eager to move away from them as soon as possible. Are we going to have a future where each person (or identity) has a single hardware token for all logins? I don't think we're anywhere close to that yet.

I switched to Google Voice after changing my phone number a couple of times and going through the 2fa replacement hell.

If filesystem access is a legitimate concern, you have bigger problems. Even if passwords were secured by FIDO or similar, session tokens are not.

If you compromise a computer, you can compromise web sessions. There is no mitigation for this. Shame on the author for attempting to create panic when far more productive security can be achieved elsewhere.