Earlier quoted context omitted.
> The blog suggest using Chrome's password manager That's not what the article said
The conclusion says to use the browser and that the author uses chrome.
Close enough.
Password Managers
231–240 of 342 posts
Re: Password Managers
#232I would NOT recommend the chrome password manager. If you sync your passwords, they will not be stored encrypted at the google side. You need to specifically set password encryption in the settings.
I've also spend a lot of time with understanding password managers in my master thesis. What I can recommend is: https://pfp.works/
The creator was auditing password managers like LastPass, found a lot of issues, and used his knowledge to create pfp, which does it right imho.
Re: Password Managers
#233The "attack surface" I worry about is forgetting to lock my screen before going down the hall to get some water, and someone slipping in to obtain a sensitive financial password. I've never succeeded in explaining this to any password manager's tech support. They stay in business because their tools are convenient to use. I've migrated from 1Password to a Dashlane family plan. I use two separate accounts for myself.…
I recommend adding a constant "PIN" you remember in your head to the end of each password in your password manager. It only takes a couple seconds to type it after the password manager auto-types the stronger, longer password.
Re: Password Managers
#234I have a bash script which takes in name of the website and generates a 64 character long random string(lower,upper,number,symbol), then puts that in a text file and then encrypts it with gpg using aes256 and puts that file in a dropbox synced directory. Whenever I need to use one, another option retrieves the password, and if I want to use my phone, I just use yet another option which uses qrencode to generate a QR…
That’s a pretty big dependency because it won’t work when you’re traveling/at work without your personal pc.
Re: Password Managers
#235Good article
This is why, while I do use Password Managers, I hate the tiny widgets and prefer to copy/paste or use a typeable password.
Having your password as "@#$!@#-<_" will just annoy you every time you need to type it and/or use it in an automated fashion (because every system gets confused by $, \, /, -, etc, in different ways)
Re: Password Managers
#236Earlier quoted context omitted.
> Passwords are a lost cause. I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? What's to prevent me from using a similarly long, randomly generated secret as my password, using a different one for every site? Because that's what I'm doing with KeePass. Backing up the auth database/file and having enough redundancy in place, as well as ha…
> I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? No. I find it easiest to keep this straight in my head with a line from the U2 song "The Fly", "a secret is something you tell one other person". You're thinking of Ed25519 private keys, you mustn't tell those to anybody and they're minted as a pair with a public key you can tell to ever…
Overall I agree, but couldn't Edward steal the users' Facebook cookies regardless of WebAuthn? I think those last until the user clicks logout, so many of them will last forever.
Additionally, Edward can steal the cookies of every user using Facebook for that hour. But he can only steal the passwords of a small fraction of those users, because only a small fraction will start a new session; most users will use existing sessions (because the cookies last forever).
Re: Password Managers
#237Earlier quoted context omitted.
In the case of Firefox, at least, the Lockwise application allows you to use your credentials even outside of the browser, on mobile devices. On the desktop, both Firefox and Chromium allow you to copy passwords so you can paste them in any application.
Maybe so, but what website do I have to load to get Chrome to offer the password for the app that's in the foreground of my phone? The 1P keyboard knows what app I'm using, and auto fills accordingly
If we're talking mobile OSs, Lockwise can be set as the system autofill service and provide passwords to the running apps. There's also a Google autofill service which I believe shares its credential store with Chrome. My experience is with Android, but I think iOS works the same way.
Re: Password Managers
#238I'm a little disappointed in the conclusion because there are more secure password managers out there that still offer the same level of convenience as the browser built-in password manager. Yes, if you use a password manager that's implemented entirely as a browser extension, you may as well use the browser's built-in password management features. However, if you're an advanced user and are comfortable using a separ…
His conclusion seems off to me too. I got "Password managers that use content scripts are bad" not "password managers are bad". Edit: I just cracked open the 1password extension, and it does indeed use a content script. Glancing over the code I only see stuff related to locating which fields are the username and password field - but I was mistaken in thinking that they didn't use a content script.
It's not just content scripts, I've seen vulnerabilities from information leaking(not necessarily creds) to authentication bugs.
Connecting the application that manages your secrets to the most exposed application on your PC is a bad idea.
Re: Password Managers
#239Given this advice I would - turn off any webpage integration LastPass does - still use LastPass to store my passwords in the cloud so I can share passwords between iOS apps and web.
You still have to trust your passwords being stored elsewhere, with weak encryption, if at all.
Re: Password Managers
#240Earlier quoted context omitted.
Haven't you pretty much already lost when you can't trust the programs running on your machine? If they can snoop on your clipboard, they're probably also able to access your sensitive files, log key presses, take screenshots, install browser extensions etc.
They'd need root access to do half of those things. The other half are bad but not life-shattering.
This obviously depends on your OS and setup, but on Linux + Xorg at least I don't need root access to do any of the things I listed.