311–320 of 342 posts
After building my new rig, I also made a successful jump from Windows 7 to PopOS. It was mostly a very smooth transition, but I am having real problems with replacing Password Safe I used on Win. I eventually defaulted to using FF for passwords, but it still feels wrong. Password Safe had password generators, space for notes.. lil things that I keep missing.
KeePassXC is also a good option, and I'm considering switching to it.
Earlier quoted context omitted.
Sorry, I must have been very tired last night. This morning, I can't remember (or figure out) which actions I was thinking of when I wrote that. The only one that still jumps out to me is browser extensions—I'm pretty sure none of the major browsers allow that without user approval within the browser. You'd have to do something nasty which would require root.
>The only one that still jumps out to me is browser extensions—I'm pretty sure none of the major browsers allow that without user approval within the browser. You'd have to do something nasty which would require root. I've admittedly never tried it, but as far as I understand, installing an extension in Firefox just involves copying the corresponding .xpi file to the profile folder (which is owned by the user, not ro…
This is in addition to the fact that Firefox has absolutely mandatory code signing for extensions (the only recourse is to recompile Firefox). That's something I'm very much not happy about, but does have upsides.
Earlier quoted context omitted.
>The only one that still jumps out to me is browser extensions—I'm pretty sure none of the major browsers allow that without user approval within the browser. You'd have to do something nasty which would require root. I've admittedly never tried it, but as far as I understand, installing an extension in Firefox just involves copying the corresponding .xpi file to the profile folder (which is owned by the user, not ro…
Nope, they don't allow that anymore! https://blog.mozilla.org/addons/2020/03/10/support-for-exten... This is in addition to the fact that Firefox has absolutely mandatory code signing for extensions (the only recourse is to recompile Firefox). That's something I'm very much not happy about, but does have upsides.
>Firefox has absolutely mandatory code signing for extensions
That helps I guess, but there are clearly still malicious extensions that can pass the automated tests and get signed. Even if that wasn't possible, you could probably use some userscript extension and load malicious scripts that way.
Earlier quoted context omitted.
Bitwarden doesn't seem to do this even in Android 10. The Bitwarden UX on iOS is fantastic though, it behaves excatly as you'd expect from a native solution. Any examples of good password managers on Android that uses the proper support for autofill?
Bitwarden definitely supports this interface, I use it. You can check which provider is enabled in your system settings.
Earlier quoted context omitted.
BW has had other issues before. For example, it tends to send your credentials with basic auth requests without your knowledge and without a setting to turn it off. The code executed in your browser can also be manipulated to exfiltrate your entire password store once you unlock it if someone gains access to whatever account Bitwarden uses to publish their addon. Bitwarden is certainly one of the better password mana…
> BW has had other issues before. For example, it tends to send your credentials with basic auth requests without your knowledge and without a setting to turn it off. This isn't true - I use BW and annoyingly it doesn't work with Basic Auth at all. This is because I have disabled auto-fill.
From what I can see, this issue was till being reported in April[0] but perhaps it's been patched in the mean time. The devs were been going back and forth about this so long that I stopped paying attention to the issue after a while.
Earlier quoted context omitted.
I think the OP is talking about salts that get concatenated as a prefix or suffix, not the salting that happens in oneway hash functions. Remember the topic here is related to getting your pw's exposed and how to easily create different pw's to deal with that scenario.
Both. The salting SHOULD happen in one way Hash functions. But sometimes it does not. Using your own prefix when always using the same password is the second worst solution but at least better than nothing. Poor mans salting :-) Use a PW manager.
Earlier quoted context omitted.
Ok so: 1) not use any manager => bad 2) use a 3rd party => pretty crap as the article says 3) use a built-in => great Why would you ever use 2? This is almost as bad as Bitcoin, which not only solves nothing but also destroys a ton of energy. I have never used a manager except for the builtins. And I would have never expected them (prior to reading this article) to be such utterly junk solutions to just inject additi…
3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into…
The one integrated with Firefox supports integration with an Android stored password entry tool. As a manager it's of very poor quality - better to do all your actual management from desktop Firefox - but as a tool to enter a stored password into an app, or to save the password you just entered, it works quite nicely.
> - compromised password warnings (maybe some of the built in password systems do this now?)
Firefox does have that service
Earlier quoted context omitted.
Yes, but you're not important enough for someone to try your password on other sites by hand, and bots are hopefully not smart enough to do this automatically. You should still use a password manager. Or at least a paper notebook.
Do bots need to do this automatically? What if a programmer gets that database and does a quick search for those naive salts? Then he can do some pattern matching and try the same pattern in some sites like PayPal, Apple, Gmail, etc. Generalize it a bit and you can even create a tool to do this for you for every new database leaked.
It's the bikelock principle. A bikelock is rarely going to be strong enough to secure your bike. It doesn't have to. It just needs to be secure enough that the thief will nick the next bike. Putting pnt12:HackerNews53cureP4ssw0rd and pnt12@gmail.com:HackerNews53cureP4ssw0rd into every service is going to be profitable enough that they don't necessarily have to try the next step.
But in general you're right: don't use these. Reused passwords aren't secure. Use keys generated by so-called password managers.
Earlier quoted context omitted.
Don't cherry pick, read the rest of my comment. It wasn't at all about any individual password complexity, it was about password managers that work with browsers in context of the blog post. Out of curiosity, what does haveibeenpwned.com say about your most used email?
> Don't cherry pick, read the rest of my comment. It wasn't at all about any individual password complexity, it was about password managers that work with browsers in context of the blog post. That's fair, but the aim of my response was to have a short discussion about the idea behind passwords and the fact that they're sent over the network, maybe someone has any input on that and why that's still such a popular app…
> But talking about that wasn't my goal.
Too bad, because passwords managers in browsers are the end of the line as passwords go. Vast majority of people wouldn't be copy pasting passwords, not because it's different kind of less secure, but because it's not convenient.
Passwords are inherently flawed or they wouldn't be what we call passwords. You're trying to solve something that is already solved with 2FA, passwords just need to be there as a bare minimum that should't be considered secure by itself no matter how complex any of them they are.
If I use Chrome's built-in password manager for example and want to get the password for some website in Safari on iOS, I think that would not be as seamless as with LastPass for example.