221–230 of 342 posts
Earlier quoted context omitted.
This used to be the case, but somewhere around Android 7 (might've been 8 or 9) added proper support for autofill services.
Bitwarden doesn't seem to do this even in Android 10. The Bitwarden UX on iOS is fantastic though, it behaves excatly as you'd expect from a native solution. Any examples of good password managers on Android that uses the proper support for autofill?
For the few sites where security matters more than trust in browser vendors it's probably better to memorize those passphrases, or use completely offline password managers.
Earlier quoted context omitted.
This isn't quite true. 2FA still protects you from password breaches (and weak passwords, though you shouldn't have those if you're using a password manager). Also, keeping 2FA codes in a syncable password manager is a huge boon for people who ever break/lose phones. Can't tell you how many people get locked out of their accounts because they lose their 2FA codes. As an alternative, companies have to have a 2FA-reset…
TOTP-based 2FA wouldn't protect you against a password breach, since the breach would most likely include the TOTP seed alongside any password hashes. WebAuthn-based 2FA would; but AFAIK there isn't really a way to store WebAuthn keys in password managers at the moment.
https://github.com/keepassxreboot/keepassxc/issues/1870 says "awesome!"
https://github.com/keepassxreboot/keepassxc/issues/1996 says "go away"
and I can't figure out what is going on with https://github.com/keepassxreboot/keepassxc/issues/3560
They reference https://github.com/kryptco/kr-u2f in one of the issues, but it was bought by Akamai and the code was never under an open source license to begin with :-(
Earlier quoted context omitted.
Yeah, idiot web programmers that don't encrypt PWs and use salting. Use a PW manager. If you really don't want to use one, don't use the same PW. At least at your own salt. eg. HN@thepwialwaysuse4 HN would be the "salt" for Hackernews.
But if that salted pw gets exposed, can a hacker just guess your pws for other sites? E.g. myBank@thepwialwaysuse
You should still use a password manager. Or at least a paper notebook.
I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…
In fact, LastPass and others had some pretty embarrassing vulnerabilities that can be exploited due to being an extension.
There's no question that a local PM has a significantly lower attack surface.
Here are some stories:
https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso...
https://www.csis.dk/newsroom-blog-overview/2021/moserpass-su...
There were several classic web vulnerabilities for 1password and bitwarden when it comes to extensions.
The built-in browser password manager is the only one that ever made sense for me. You want the machine to verify the domain for you so you don't enter your credentials into some other site (no copying and pasting) and all third-party scripts are always clunky. I use Firefox with Lockwise[1] for Android and pass[2] as overflow for more involved secrets. This is a solo solution though that doesn't solve sharing these…
> and all third-party scripts are always clunky > I use [...] pass as overflow for more involved secrets Why don't you consider pass a third-party script here in this context? Don't you use the Firefox plugin passFF?
what about Bitwarden?
The most secure solution is a local PM.
However, I would still advocate for a web based password manager for regular people. The benefits overpower the possible risks which are more targeted than generic.
For security personal, like myself, a reliable local password manager is unbeatable. yes, it is less convenient no doubt, but removes any remote based attacks from the picture which is a huge deal.