31–40 of 342 posts
I use Firefox with Lockwise[1] for Android and pass[2] as overflow for more involved secrets. This is a solo solution though that doesn't solve sharing these secrets with others.
First of all, a very interesting topic! Author is obviously someone with a lot of knowledge. Nevertheless he is employed at Google( https://en.wikipedia.org/wiki/Tavis_Ormandy ) and recommends Chrome? ..combined with lack of references and research material this all seems a little bit sus to me.
I may be biased though because I agree with the opinion. I use a combination of my browser's support and `pass`.
First of all, a very interesting topic! Author is obviously someone with a lot of knowledge. Nevertheless he is employed at Google( https://en.wikipedia.org/wiki/Tavis_Ormandy ) and recommends Chrome? ..combined with lack of references and research material this all seems a little bit sus to me.
There's nothing sus here; he's saying that the password managers built into the browser use a more secure model than a plugin that uses javascript to communicate with a web page. That seems to be 100% accurate.
If a Chrome dev had said we should use Chrome's password manager because Mozilla's in fundamentally broken, I would want more proof of that claim, but he did a fine job of explaining the vulnerabilities of a plugin versus a native manager.
After building my new rig, I also made a successful jump from Windows 7 to PopOS. It was mostly a very smooth transition, but I am having real problems with replacing Password Safe I used on Win. I eventually defaulted to using FF for passwords, but it still feels wrong. Password Safe had password generators, space for notes.. lil things that I keep missing.
I recently moved my passwords from an expired 1Password account to Bitwarden (right at the time they announced linux support actually, which was always the biggest thing I missed). Bitwarden has a FF extension and allows me to use it across mac/windows/linux.
Is Bitwarden decent enough? The fact that it has a cli, FF extension etc. on a free plan is pretty tempting.
It’s irritating to me that there’s no standard integration between password managers and authentication elements on a page. We can do this correctly if we want. Furthermore, I’d love some standard programmatic way to change passwords and communicate complexity and rotation timelines. If I use a password manager anyway, it should just deal with changing my password if some organization decides to use a backwards rotat…
For example, exploiting a browser-based password manager likely means escaping the sandbox that contains web pages and accessing the shadow DOM. But this is still a larger surface area than 1Password, where the password selection menu (on Windows at least...) is actually rendered by an entirely separate process on the system. (I.e., clicking the icons that the extension displays triggers the 1Password desktop application to display UI at the cursor's current position. Picking a password from this UI will transmit it to the browser extension for filling. The password is only present in the browser's memory once you've interacted with the desktop application's UI.)
As always, do your research. Don't get suckered into paying a subscription fee for a browser extension that offers the same functionality your browser has built-in. But realize that there are other options out there that may actually be worth investing in.
Disclaimer: I've been a happy 1Password customer for a few years now.
This does not reallz discuss offline password managers like keepassx except for this one sentence > Conceptually, what could be simpler than a password manager? It’s just a trivial key-value store. In fact, the simplest implementations are usually great. Good examples of simple and safe password managers are keepass and keepassx, or even pass if you’re a nerd. I think keepass synched via nextcloud is a great solution…
What’s is the difference between keepass synced by X and another service which is completely online? Simplified with keepass I have a) the database and b) an online accessible Location for storage. If I use Bitwarden, I still have a) and b), right? So for keepass to be better it would need to be better (as in safer) for one of those. I’m not sure if that’s the case (you can even selfhost both Bitwarden and nextcloud…
The blog suggest using Chrome's password manager. I used MacOS KeyChain as my primary store and Chrome's password manager for my secondary store for years and finally gave up because KeyChain didn't work with Chrome or sync with anything (unless maybe I used iCloud) and Chrome only synced with and worked with Chrome and too often it didn't save passwords properly. For all other browsers, apps, or uses, Chrome passwor…
The password interface in iOS has improved a whole bunch (tells you about weak passwords, reused passwords, etc) but doesn’t support attaching a TOTP to an entry.
Which may or may not be a big deal now what everyone is moving to U2F etc.