Bitwarden uses manual autofill which is nice. You hit ctrl shift L to fill
I wish it wasn't such a weird key combo though, it would be nice to do it with 1 hand.
Autofill in password managers can allow login credentials to be stolen
41–50 of 144 posts
Re: Autofill in password managers can allow login credentials to be stolen
#42Not mentioned in the article -- a good way to prevent Chrome from ever recognizing the "same" field and attempting to autofill it is to include and randomize a "name=" attribute on all tags, or else name them with a string including a unique user id. This should always be done on web apps. Otherwise the next user on a public computer will see autofill options from previous users.
I’d prefer if you didn’t. I like 1Password knowing where to put my credentials when I ask it to.
It's not necessary on fields where type="password", since those aren't recorded by Chrome (unless you ask it to remember them). But for all other fields, the security of users on public machines far outweighs the convenience of autofill. And as I said, it can be tailored to individual users' uuids if they're logged in.
Re: Autofill in password managers can allow login credentials to be stolen
#43Good advice. Ever since Tavis Ormandy set his sights on password managers, I have been a very sceptical user. I still use 1Password, but without the browser extension. Putting autofill aside, there's a couple of other concerns I have. I am hesitant about recommending a password manager to the tech illiterate simply because one piece of malware could compromise the entire vault. In that respect, a sticky note is argua…
A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.
FieldNotesBrand.com
Sticky notes suck because people leave them in plain sight. A notebook is a totally reasonable way for a non-technical person to track passwords securely.
Re: Autofill in password managers can allow login credentials to be stolen
#44Earlier quoted context omitted.
A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.
FieldNotesBrand.com Sticky notes suck because people leave them in plain sight. A notebook is a totally reasonable way for a non-technical person to track passwords securely.
Yeah but unless you have a lot of foresight they’re not going to end up in a useful order.
Re: Autofill in password managers can allow login credentials to be stolen
#45Bitwarden uses manual autofill which is nice. You hit ctrl shift L to fill
yeah i have it autofill (its a feature now) but it doesnt auto login. so i built an extension that waits for it to fill it in and then performs some safety checks and then logs in. finally the bliss i had with lastpass before i was forced to move to bitwarden.
Can I get me some of that extension?
https://i.pinimg.com/originals/cb/14/5d/cb145d466f1958ec101f...
Re: Autofill in password managers can allow login credentials to be stolen
#46Perhaps I'm slow. But if someone's discovered an XSS vulnerability for the site you're on, can't they just as well steal your password when you type it in?
Depends. Many applications will have their login screens on simple server-generated HTML forms without heaps of Javascript, rendered by a service with higher security standards. If an XSS vulnerability appears on some other page, it may not be the same page that normally has a login form. Generally I'd say the gates are kinda open if XSS is possible, but many real exploits do require more than 1 vulnerability working…
So the attacker uses the XSS to change the "Login" link to not send you to the secure page, but rather to do a History.pushState with the same URL as the "secure" page, mimics the secure page, and exfils the credentials.
The OP is on the other side of the airtight hatch already.
(This does require said login page to be on the same origin. But even if the attacker just ignores that, and otherwise mimics the page as closely as possible, would you notice? Heck, even if you moved it to just being in the same page without the URL change, as long as the branding was close enough, I bet most folks would go "uh, the UI changed again" not "uh oh! it's not on a secure subdomain!". Let's hope your password manager notices. But even then, I suspect that most of them would just not autofill, and a confused user would manually fill, wondering what happened.)
Re: Autofill in password managers can allow login credentials to be stolen
#47Earlier quoted context omitted.
A piece of paper is the most secure solution, sure, but once you get to the point where you have a hundred passwords, even if you've got them all in the same place, it's too unwieldy to use.
FieldNotesBrand.com Sticky notes suck because people leave them in plain sight. A notebook is a totally reasonable way for a non-technical person to track passwords securely.
A notebook is a totally reasonable way for a non-technical person to track passwords securely.
I do this, even though I'm a "technical" person. I do it because I use unique passwords for almost every site I visit.
The notebook never leaves the house, but what if I have a fire? I remember a few passwords, but most of them "poof, gone".
My reckless behavior reminds me of this commercial parody on SNL, long ago:
- A Tradition of Security -
We will make a list of our clients and how much money each of them has given us to invest. We will keep this list in a safe place. If we have time we will make a copy of the list in case something happens to the first list.
Re: Autofill in password managers can allow login credentials to be stolen
#48Good advice. Ever since Tavis Ormandy set his sights on password managers, I have been a very sceptical user. I still use 1Password, but without the browser extension. Putting autofill aside, there's a couple of other concerns I have. I am hesitant about recommending a password manager to the tech illiterate simply because one piece of malware could compromise the entire vault. In that respect, a sticky note is argua…
You still need 2FA and the 2FA absolutely should NOT be a part of your password manager. Use a different app at the very least. This should help alleviate some of the worst password manager risks.
> You still need 2FA and the 2FA absolutely should NOT be a part of your password manager. Use a different app at the very least.
Recommended if storing 2FA codes in a password manager is to use 2FA for the password manager that isn't stored in the password manager. Off the top of my head, that doesn't seem to really open up any additional risks over storing 2FA passwords outside of the password manager.
Personally, it's a matter of practicality - I use my phone for personal 2FA codes, but don't have a work-provided phone and am not going to use my personal phone for work purposes - and as many services now require 2FA, it's easiest to store those 2FA codes in my work-provided password manager.
Re: Autofill in password managers can allow login credentials to be stolen
#49Earlier quoted context omitted.
I’d prefer if you didn’t. I like 1Password knowing where to put my credentials when I ask it to.
It's not necessary on fields where type="password", since those aren't recorded by Chrome (unless you ask it to remember them). But for all other fields, the security of users on public machines far outweighs the convenience of autofill. And as I said, it can be tailored to individual users' uuids if they're logged in.
I don't think "users on public machines" are really a subset of people worth catering to at the expense of others.
Public machines without sandboxed user sessions seem largely uworkable in the first place - does anywhere actually do that? (I've never been to a library, school/university or workplace that does.)
Re: Autofill in password managers can allow login credentials to be stolen
#50I get that this is a theoretical vulnerability, but there's no way I'm turning off automatic autofill. It's way too convenient.
If some site has an XSS vulnerability, then they've already got access to my session cookies, and have the ability to spoof a "you've been logged out, please log back in" screen where people could type in a password anyways.
If a site is vulnerable to XSS it's basically game over security-wise. Asking browsers and password managers not to autofill feels more like security theater at that point.
That being said, the browsers and password managers that require the username and password fields to actually be genuinely visible to the user on top, non-transparent, in the viewport, are doing the right commonsense thing, and really that seems entirely good enough.
(Obviously if you're a political dissident or a target of suspected corporate espionage or something then you'll take greater security precautions like not using a password manager at all for certain accounts -- I'm just talking about normal users here.)