41–50 of 93 posts
From skimming the paper, the only real flaw that seems broadly applicable is in autofill features which I'm not sure 1Password even has. Those intuitively seem like a bad idea and are easy to disable.
This title is hyperbolic linkbait and should probably be changed. From skimming the paper, the only real flaw that seems broadly applicable is in autofill features which I'm not sure 1Password even has. Those intuitively seem like a bad idea and are easy to disable.
Shameful plug... sorry.. I actually just released an account manager for Chrome, called Waltz. Waltz uses Clef ( http://getclef.com ) for multi-factor auth, and then submits using preconfigured login URLS - not heuristics like most other password managers. After a semi-thorough read of the article, I don't believe Waltz falls into any of the security holes mentioned in the article. http://getwaltz.com
This title is hyperbolic linkbait and should probably be changed. From skimming the paper, the only real flaw that seems broadly applicable is in autofill features which I'm not sure 1Password even has. Those intuitively seem like a bad idea and are easy to disable.
It also mentions that auto filling is the default for two of them.
But that doesn't justify this clickbait title which is simply untrue as nowhere in the report does it say that passwords are shared "everywhere."
Earlier quoted context omitted.
... this doesn't sound easier, this sounds much more annoying. But each to is own.
KeePass also makes a global keyboard shortcut available (Ctrl+Alt+A by default) that will complete login fields based on the active window title. (The mechanics of the text entry and the window title matching are all configurable, though the defaults are usually fine.) Not as slick as auto-filling without user interaction, but better than manually searching for each entry every time.
I originally looked at Lastpass, but it seemed 'too' easy. Decryption is done client side via javascript, but what happens if someone hacks into Lastpass's server, and modifies the code to send the user's entered password to their server?
Isn't the solution obvious? Use the password manager to remember a unique password for each site but combine it with something you know. Prepend a password, mix your password in the middle, append it, etc. Problem solved?
Earlier quoted context omitted.
I honestly think for security purposes in general you shouldn't auto fill in a form regardless of the domain and the extension builders should just not build that feature because it exposes issues like this.
What's the alternative? Generate randomized passwords and memorize them all? I have 250+ passwords for different websites, and not a great deal of choice about it. This is certainly way better than the actual likely alternative -- using the same password on all 250+ sites.
Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…
Are you saying that yahoo web mail lets senders create forms with submit actions? That's.. Horribly broken. But tumbler allows JavaScript redirects to phishing sites, so yahoo standard I guess.
If a form doesn't have a submit action, what's the point of the form?
If you have HTML and CSS, why not have forms?
This title is hyperbolic linkbait and should probably be changed. From skimming the paper, the only real flaw that seems broadly applicable is in autofill features which I'm not sure 1Password even has. Those intuitively seem like a bad idea and are easy to disable.
It also mentions that auto filling is the default for two of them.