251–260 of 342 posts
Combined with being completely open-source (including backend), full-featured even in the free version, and $10/year pro version (with features like sharing, encrypted storage, etc.), I can recommend it to practically anyone.
I would NOT recommend the chrome password manager. If you sync your passwords, they will not be stored encrypted at the google side. You need to specifically set password encryption in the settings. I've also spend a lot of time with understanding password managers in my master thesis. What I can recommend is: https://pfp.works/ The creator was auditing password managers like LastPass, found a lot of issues, and used…
Earlier quoted context omitted.
You're wrong. you can exploit browser extensions without escaping sandbox. In fact, LastPass and others had some pretty embarrassing vulnerabilities that can be exploited due to being an extension. There's no question that a local PM has a significantly lower attack surface. Here are some stories: https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso... https://www.csis.dk/newsroom-blog-overview/2021/moserpass…
> https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso... That’s a clickjacking vulnerability. Gp post discussed why UI should be out-of-DOM. > https://www.csis.dk/newsroom-blog-overview/2021/moserpass-su... I’m not familiar with the password manager here, but that's a CDN compromise causing auto-update to download a malicious dll. Of course voluntarily installing malicious code is a game-over scenario unrela…
kbuck made it seem like there's just a single issue here that can be avoided. that's not true.
I have a bash script which takes in name of the website and generates a 64 character long random string(lower,upper,number,symbol), then puts that in a text file and then encrypts it with gpg using aes256 and puts that file in a dropbox synced directory. Whenever I need to use one, another option retrieves the password, and if I want to use my phone, I just use yet another option which uses qrencode to generate a QR…
That’s a pretty big dependency because it won’t work when you’re traveling/at work without your personal pc.
Earlier quoted context omitted.
I have that debate inside my head often, but ultimately it boils down that "security" is a spectrum and convenience is on one end of the spectrum. Having all passwords be "asdfasdf" is massively convenient, massively insecure. Having to carry my titan key with me all the time (assuming my suck ass financial institutions even allow WebAuthn) is massively inconvenient, and pretty secure. I'm 100% on board with not usin…
But wouldn't it be even more convenient to just not use 2FA in the first place? If you're just going to store your TOTP seed in the same place you store your password, why even bother?
> If you want to use an online password manager, I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. Unfortunately, it also means I can basically never switch web browsers again, so it's an absolute non-option for me. I don't want to be locked into Chrome forever.
Why wouldn't you just use `pass`?
"Things start to go wrong when you want integration with other applications, or when you want data synchronized by an untrusted intermediary. There are safe ways to achieve this, but the allure of recurring subscription fees has attracted businesses to this space with varying degrees of competence. I’m generally skeptical of these online subscription password managers, and that’s going to be the focus of the rest of this article."
So yeah the article focuses more on people who want the convenience of a password manager embedded in their browser.
Earlier quoted context omitted.
You're wrong. you can exploit browser extensions without escaping sandbox. In fact, LastPass and others had some pretty embarrassing vulnerabilities that can be exploited due to being an extension. There's no question that a local PM has a significantly lower attack surface. Here are some stories: https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso... https://www.csis.dk/newsroom-blog-overview/2021/moserpass…
> https://blog.lastpass.com/2019/09/lastpass-bug-reported-reso... That’s a clickjacking vulnerability. Gp post discussed why UI should be out-of-DOM. > https://www.csis.dk/newsroom-blog-overview/2021/moserpass-su... I’m not familiar with the password manager here, but that's a CDN compromise causing auto-update to download a malicious dll. Of course voluntarily installing malicious code is a game-over scenario unrela…
authentication bugs:
https://blog.lastpass.com/2017/04/lastpass-2fa-bug-reported- resolved/
Information leaking bugs:
https://hackerone.com/reports/337189
server side bugs, rogue updates(all extension are auto-update by default), breaking security boundaries and more.
I use Bitwarden, and to my knowledge the issue raised in this article does not apply to it -- all interaction is through the extension's icon, with no UI elements injected into the page itself. Combined with being completely open-source (including backend), full-featured even in the free version, and $10/year pro version (with features like sharing, encrypted storage, etc.), I can recommend it to practically anyone.
Copying out of Bitwarden and pasting into the visible fields would get around that instead of using its auto-fill.
> I would recommend using the one already built into your browser. They provide the same functionality, and can sidestep these fundamental problems with extensions. I haven't used the browsers built-in password manager for years, so I don't know what features they have, but I find it hard to believe that they can provide the same functionality as a dedicated password manager. Some of the top features of dedicated pas…
Please don't put TOTP codes or back up codes in password managers. The whole point of 2FA is to have two factors protecting you. If you do that, you're back to 1 factor (your password manager master password).
That's only true if you are using an online service as a password manager, so the master password is the only thing protecting you. Not necessarily for offline password managers. E.g. in my case, I use Keepass that I never sync/store online, so even without enabling a website's 2FA, for many attack models I am effectively using 2FA: logging into the website requires both something I have (a device with my Keepass database) and something I know (the password for my Keepass database). But without website 2FA those two factors then produce one single factor (the website's password) that is transmitted to log in, so enabling website's 2FA and storing it in Keepass makes it 2FA against even more attack models, i.e. attacks where it's not my password database that it compromised, but just that one password. So it's still a benefit.
If I ever feel the need to sync my Keepass database, e.g. on Dropbox; I could set a key file (that I transferred offline between my devices) in addition to the master password to preserve this 2FA aspect, so that even if my Dropbox password and Keepass master password were both compromised, they would still be useless without access to my devices that contain the key file. But I never had the need to use my password manager on a different device, so no syncing needed so far. In any case, I don't actually care about 2FA (when I enable 2FA, I actually do it to decrease security, not increase it, as I explained in my other comment), this 2FA is just a bonus of my not needing and liking online services.
As it looks like Tavis isn't hanging out and responding to comments here, I thought it'd be worth linking to a question and response he gave on Twitter as most comments revolve around this point. > @diractelda: Based on your thoughts, it seems a more accurate statement is "Don't use a password manager that interacts with your browser automatically unless it's the built in password system. Non-integrated password stor…
I don’t blame him for trying to be punchy — you don’t get noticed otherwise, to be honest.