31–40 of 93 posts
I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…
Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…
Non--browser-integrated password managers with 2-factor authentication are one of the best security solutions around right now. Every step away from that costs you security, but probably is still a good ways better than using passwords alone purely from memory.
What the hell happens if I lose the yubikey? Or indeed anything else that substitutes as the 2nd factor?
Every example in this paper stems from the issue that these password managers do not respect same origin policy. Sounds like something that's easy to fix for the developers.
The takeaway here is to turn off auto-fill and auto-login. You'll still get most of the convenience of the browser extension password manager: a repository of strong passwords that you don't have to remember and can access easily on multiple devices. This is why I use LastPass. I used to use KeePass and even donated to the project, but I wanted more convenience, support in the long run, and never liked the .NET dependency.
https://news.ycombinator.com/item?id=6943837
Actual Link: https://helpdesk.lastpass.com/security-options/multifactor-a...
I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…
... this doesn't sound easier, this sounds much more annoying. But each to is own.
Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…
I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.
Is there a good, ideally free password manager that works on Android, iPhone, and the web? Any recommendations?
I use Keepass for this. The android port ( https://play.google.com/store/apps/details?id=com.android.ke... ) works perfectly fine for me, and it looks like there are a few ports for iOS as well. Keepass itself has, of course, long established itself as a solid password manager. And the cost is $0.