241–250 of 278 posts
Earlier quoted context omitted.
Gah what then? I use strong passwords but almost all of them flow through my clipboard.
I used to use Keepass with auto-type. I had a hotkey for it, and it would recognize the site based on the browser window title. That would probably be the best of both, no clipboard, and no browser addons.
Earlier quoted context omitted.
I have little faith site developers care about password managers. Many even try to block them from working due to some perceived notion that they are insecure.
I remember using a company-mandated pension website which required a very long password with a comprehensive selection of complexity requirements. To log in, the password had to be entered twice, but they had disabled the ability to use a password manager to populate them (I forget the exact mechanism). To me this is the worst of all worlds. If you put people off using your website, you are less likely to have breach…
But yeah, that's infuriating.
This is an example of a common antipattern in software: some piece of software fails to correctly implement something (here, modern HTML autocomplete="cc-exp-year"), and another piece of software goes through all kinds of contortions to work with incorrect or incomplete implementations with the result that it now behaves undesirably with a third piece of software. Specifically, 1Password has to do complicated guesses…
> I can't offer a general solution, but if password managers simply refused to autofill to any field other than the one with the matching standard autocomplete attribute, web developers might start doing the right thing. Unlikely. The password managers would just lose users. I've even caught myself being annoyed at 1Password when it doesn't work while the cause is obviously the website doing some stupid thing. I wond…
I had a similar 1Password moment. I was buying airline tickets; entered my name, my wife’s name, address, declined insurance, declined hotel offer, scroll scroll scroll... Then I let 1Password fill in my payment details, which it did perfectly fine. But... what it ALSO did, on a field now well off the top of the screen, was change my wife’s first name to my full name. I caught this when I got the confirmation email.…
I had a similar story a few years ago, except it changed my birthdate rather than my name. Luckily I looked at the confirmation email for some reason and noticed it. Was a total nightmare to get that changed, although I didn't end up paying in the end.
I’m lucky that my status meant it was an automatic approval for the second visa!
Earlier quoted context omitted.
You do realize that in 10 seconds your computer can achieve a lot of stuffs right?
I don't think a webpage can read clipboard without the user manually pasting. If there's some malicious desktop program running on your machine at the same time as the password manager then you're probably screwed regardless of whether the password passes through the clipboard - but maybe there's some subtleties I'm missing here.
If I have to do it, I immediately copy something else right afterwards, to avoid an accidental paste later on.
Earlier quoted context omitted.
You wouldn't encrypt/hash it, since 4-5 letters (say 30 bits) is trivial to brute force anyway. Talking about offline password encryption/hashing is a bit of a red herring anyway, since it distracts from the fact that you're still sending your full password to the server for verification each time, so if the server is compromised for any length of time your password will be as well. Reusing passwords is broken: you r…
> you're still sending your full password to the server for verification each time, so if the server is compromised for any length of time your password will be as well. The key difference between storing plaintext passwords and hashed passwords is that with hashed passwords, you can only compromise users who log in during the interval when the system is compromised, and even then, only for worse compromises (eg if a…
Why only then?
Earlier quoted context omitted.
I had a similar story a few years ago, except it changed my birthdate rather than my name. Luckily I looked at the confirmation email for some reason and noticed it. Was a total nightmare to get that changed, although I didn't end up paying in the end.
A few years ago they wouldn’t let me board a flight from SFO to Australia because my visa said I was born in 1921 when my passport didn’t agree. After a good bit of hassle we just had me go and apply for (and pay for) another visa on the electronic application site and this time I noticed that it’s exactly what happened: 1Password (IIRC) used my Visa expiration year for my visa birthday. I’m lucky that my status mean…
The deeper problem here is that credit card numbers are obsolete. Websites should be using Apple Pay and similar stored payment info APIs that don't go through an unnecessary error-prone user-facing interface. (Yes, Apple etc. are oligopolists, but so are Visa/MasterCard)
I think the problem is precisely that very last character, the "s". How many such APIs should "websites" be using?
I had a similar 1Password moment. I was buying airline tickets; entered my name, my wife’s name, address, declined insurance, declined hotel offer, scroll scroll scroll... Then I let 1Password fill in my payment details, which it did perfectly fine. But... what it ALSO did, on a field now well off the top of the screen, was change my wife’s first name to my full name. I caught this when I got the confirmation email.…
I also had a similar experience yesterday, with less expensive purchases fortunately.
The default behavior of 1Password auto-fill is wrong IMO. It should only fill fields after the field that currently has the focus. Not start filling whatever is available from the top of the page.