121–130 of 342 posts
Earlier quoted context omitted.
Currently, I use Chrome on my desktop, mobile Safari on my phone, Safari on my Macbook, and Firefox on another machine. I need to sync my passwords across them!
If you install chrome on iOS you can use it as a password manager while you're using other apps, including Safari.
Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…
I believe the point the article is making is that any browser extension to auto fill is inherently insecure for architectural reasons.
I find it odd someone so serious about password managers would recommend KeePassX which hasn't seen a release since 2016. Perhaps they meant the KeePassXC fork.
Earlier quoted context omitted.
Ok so: 1) not use any manager => bad 2) use a 3rd party => pretty crap as the article says 3) use a built-in => great Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy. I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additi…
3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into…
Earlier quoted context omitted.
My setup is almost identical, though I skip the browser plugins and let the password manager auto-paste into the browser. Keepass inside GDrive, job done. Very occasionally I'll make a copy out to a portable drive. I've been running this setup for about a decade,since some big breach (I forget which one) made it clear to me that using the same or similar passwords across multiple sites was not gonna fly any longer. T…
After realizing how every program running on your machine can Snoop on your clipboard I'm never allowing any program to send my password to the clipboard again.
> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. Unfortunately, it also means I can basically never switch web browsers again, so it's an absolute non-option for me. I don't want to be locked into Chrome forever.
I think the only reasonable way to achieve Tavis' conclusion would be for browsers to start providing actual password management APIs for extensions. I agree that locking in all my passwords with my browser vendor would be unacceptable.
I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…
I'm also a 1password customer and curious how the attack vector of spoofing the 1password input icon can harm the user. They might be able to get your master password, but that doesn't mean they gain access to anything. Also, I never use that icon and exclusively use the shortcut. I'm curious if that can be spoofed somehow. But again, they can only get your master password. In the case of 1password, I'm pretty sure t…
Earlier quoted context omitted.
The point is that while yes, many 3rd party password managers have issues, the overwhelming majority of attacks are not against password managers but against reused passwords - so honestly either the 1st or 3rd party choice is a win over using neither.
That's only because there are more people who reuse passwords than people who use online password managers. As they're becoming popular, more cybercriminals are going to exploit it.
Earlier quoted context omitted.
I recently moved my passwords from an expired 1Password account to Bitwarden (right at the time they announced linux support actually, which was always the biggest thing I missed). Bitwarden has a FF extension and allows me to use it across mac/windows/linux.
I was looking at Bitwarden yesterday as I've been putting off moving over from LastPass and 1Password seemed weird with importing from it. Is Bitwarden decent enough? The fact that it has a cli, FF extension etc. on a free plan is pretty tempting.
But all in all really happy with it.
Earlier quoted context omitted.
If you install chrome on iOS you can use it as a password manager while you're using other apps, including Safari.
Interesting to know, this doesn't fully solve all the problems with this approach for me but it might be helpful for some family members. Thanks for the information
Earlier quoted context omitted.
I think the only reasonable way to achieve Tavis' conclusion would be for browsers to start providing actual password management APIs for extensions. I agree that locking in all my passwords with my browser vendor would be unacceptable.
This is something along those lines, right? https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... keepassxc's browser extensions uses it, I believe.
What I want is an API for extensions to hook into the built-in password field detection and auto-fill mechanisms of the browser, while providing their own storage mechanism for the password data (maybe by connecting to a cloud service or something). This would avoid every password manager having to re-implement its own workflows for those things.