Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Browser Extension Password Managers Exposing Passwords Everywhere

isecpartners.github.io

Post reply on HN
Print view View original

61–70 of 93 posts

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#61

Post by throwaway2048 »

subsection1h wrote: post #13

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…

is anyone aware of an smartphone app that allows your phone/tablet to act as a usb keyboard for a pc, and "type" passwords in for you?

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#62

Post by dredmorbius »

yeukhon wrote: post #58

I never use password managers. The reason is simple: I don't want to rely on another software. If I had to remember 20 passwords I would and in fact I do carry around 10 different passwords in my head constantly. I trust my own brain rather more. And if my brain is comprised, what else can you do with all the security we have on our desktop?

Password reuse is a bigger threat than password manager failure.

The old-school method is to use a GPG-encrypted flatfile with your passwords in it.

I generate unique, long, passwords for each site I visit. There are _very_ few of these I can remember. I'll run:

   gpg -d passwords.asc | grep siteurl
... (in a terminal) and enter my passphrase. There are other tools which can manage keychains and such, but this is simple, easy, reliable, and portable.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#64

Post by donniezazen »

aptwebapps wrote: post #56
donniezazen wrote: post #27

Earlier quoted context omitted.

Can you do that globally?

I just did. (Using LastPass).

How can you set LastPass to globally disable auto-fill and auto-login? I checked again and I couldn't find any options in the extension or vault settings.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#65

Post by wubbfindel »

jagermo wrote: post #59
eknkc wrote: post #8

Looks like LastPass really screws up by auto filling forms within emails and submitting them. Which means that I can duplicate the yahoo login page, send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain. 1Password seems to be just fine according to this paper. It did not fuck up like Lastpass and only live flaw is about subdomain matching, which I actually find use…

Not sure it would be that easy. LastPass only auto fills known domains, so you would have to spoof that too.

Hence why they said:

"send it to your yahoo mail and LastPass would fill it up and submit because it's served under yahoo domain."

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#66

Post by Havoc »

subsection1h wrote: post #13

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…

It loses one key benefit though - phishing sites. When Lastpass doesn't fill something in that I expected it to fill in I eyeball the site very carefully to see wtf is going on.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#67

Post by Havoc »

morgante wrote: post #41

This title is hyperbolic linkbait and should probably be changed. From skimming the paper, the only real flaw that seems broadly applicable is in autofill features which I'm not sure 1Password even has. Those intuitively seem like a bad idea and are easy to disable.

Lastpass does autofill, but only once a site is recognized. That to me is OK - unless there is a way to trick it of course.

EDIT: Nevermind..you can configure either behaviour. Either fill in or fill & submit.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#68

Post by aptwebapps »

donniezazen wrote: post #64
aptwebapps wrote: post #56

Earlier quoted context omitted.

I just did. (Using LastPass).

How can you set LastPass to globally disable auto-fill and auto-login? I checked again and I couldn't find any options in the extension or vault settings.

Using the Chrome extension, auto-fill is under Prefereces > General > and auto-login is under Preferences > Advanced.

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#69

Post by JelteF »

subsection1h wrote: post #13

I use KeePass and I haven't integrated it into any of the web browsers I use. When I want to log into a site, I don't load it via my web browser's address bar; instead, I Alt-Tab to KeePass, Ctrl-F to find the site/account, Ctrl-C to copy my password, and Ctrl-U to open the site. This takes only a few seconds longer than using a browser extension like LastPass (which I've used to share credentials with family members…

Keepass has browser extensions as well. They're quite good and only gives the password to the site you want.

https://github.com/pfn/passifox

Re: Browser Extension Password Managers Exposing Passwords Everywhere

#70

Post by droptableusers »

If you are on GNU/Linux you can use built in tools with PGP (with a little help of bash scripts, and git if you want). I first saw it explained on this blog http://blog.sanctum.geek.nz/linux-crypto-passwords/ and has worked really well for me. Feels more robust and secure than browser password stores, though probably not as convenient but its up to you, convenience or security.
Post reply on HN