201–210 of 342 posts
I think iOS does this right. It helps you get a password from the Bitwarden app when using the browser. No browser extension with injection is required.
Earlier quoted context omitted.
But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?
If a crappy website’s user database gets attacked, the hacker may have my plaintext password stored in it. They may not have my 2FA seed, so there’s at least a chance that the attacker still may not be able to access my account. I think this is much more likely than an attacker cracking my 1Password vault.
Here's a the best solution I've found for those looking for password manager recommendations. It's secure, free open source, easy to use, and syncs to all of your devices 1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOT…
> 4. Browser support: KeePassXC-Browser. Allows you to autofill your username / password / TOTP from your KeePassXC application to Chrome / Firefox. I believe the point the article is making is that any browser extension to auto fill is inherently insecure for architectural reasons. I find it odd someone so serious about password managers would recommend KeePassX which hasn't seen a release since 2016. Perhaps they m…
No, that is not what the article said. The article said that password managers that insert elements into the webpage are insecure. You don’t need need to do that to autofill passwords.
I use unix pass as my "source of truth" and then individual browser password managers (mostly Firefox) as a local "cache" for sites where it is painful to manually go out to pass too often. Honestly it works brilliantly, pass syncs using git which I do to a bare ssh repo on a server I control (although it would be perfectly safe to put on github tbh). I really feel like people overthink this sometimes.
Earlier quoted context omitted.
And rightly so.
It has nothing to do with security - they want to move everyone to a subscription model for reoccurring revenue. I can't blame them for that, but it isn't necessarily the best for customers.
In this case it is about security, I believe. Primarily because of the additional secret material needed to encrypt the vault, but also because I trust them to store that vault securely for me versus my self. I’m lazy. I’m forgetful. They’re not. It’s literally they’re business and they’re getting better at it daily (one would hope at least.)
This somewhat overlooks the main threat model that password managers solve - leaked credentials. People can’t remember 80 passwords so they reuse the same one, that password eventually gets leaked and 9/10 times it doesn’t get leaked due to a targeted attack or a compromised machine but rather due to a breach of a service you signed up too. Sure password managers have issues, they don’t solve user related errors and…
Yeah, idiot web programmers that don't encrypt PWs and use salting. Use a PW manager. If you really don't want to use one, don't use the same PW. At least at your own salt. eg. HN@thepwialwaysuse4 HN would be the "salt" for Hackernews.
E.g. myBank@thepwialwaysuse
Earlier quoted context omitted.
> I’ve seen a couple of experiments of them trying it, ? Browser-addon 1password has been the only way to use (modern?) 1password on Linux for a long time.
This is a recent development, but 1Password is now available on Linux as a native program, and it’s probably my favorite implementation! https://1password.com/downloads/linux/
Earlier quoted context omitted.
My setup is almost identical, though I skip the browser plugins and let the password manager auto-paste into the browser. Keepass inside GDrive, job done. Very occasionally I'll make a copy out to a portable drive. I've been running this setup for about a decade,since some big breach (I forget which one) made it clear to me that using the same or similar passwords across multiple sites was not gonna fly any longer. T…
After realizing how every program running on your machine can Snoop on your clipboard I'm never allowing any program to send my password to the clipboard again.
Perfect security doesn't exist, of course, so somewhere in the middle lies a good compromise that trades off risk and convenience. For me keepass on a synced drive hits the mark.
Not sure what the solution would be if you don't trust local programs - Keepass' paste method already bypasses the clipboard IIRC by entering directly into the fields.
Earlier quoted context omitted.
This is something along those lines, right? https://developer.mozilla.org/en-US/docs/Mozilla/Add-ons/Web... keepassxc's browser extensions uses it, I believe.
This isn't really what I want: This allows the extension to communicate with a native app, and that's often used to implement password managers. But actually I would prefer if extensions don't use native components at all, especially password managers. What I want is an API for extensions to hook into the built-in password field detection and auto-fill mechanisms of the browser, while providing their own storage mech…