81–90 of 342 posts
This somewhat overlooks the main threat model that password managers solve - leaked credentials. People can’t remember 80 passwords so they reuse the same one, that password eventually gets leaked and 9/10 times it doesn’t get leaked due to a targeted attack or a compromised machine but rather due to a breach of a service you signed up too. Sure password managers have issues, they don’t solve user related errors and…
How does this address the point of the article? Which is that you should use the browser's builtin password manager and not a third party manager that injects user scripts into all websites and break the sandbox model?
Additionally, if you use two different browsers or operating systems you'll need a 3rd party tool to keep your passwords in sync.
For me, that's why I use a 3rd party.
---
Funny thing is though, I consider myself the 1st party. The website or app I am using is the 2nd party. Anyone else including the browser is a 3rd party. Neither Google, nor Apple, nor Mozilla, to name a few of the top browser-makers, are anything more than middlemen.
I think it's better to trust them with less rather than allow them to keep the passwords as well since they have no incentive to make them portable between competing browsers.
Earlier quoted context omitted.
Sure, but where do the clicks actually end up?
The ui of the password manager, as demonstrated in the demo.
Earlier quoted context omitted.
3rd party password managers have a bunch of useful features, which is why I use one. Here are the first few that come to mind: - portability, if I use chrome on my desktop, firefox at work, and safari on mobile I'm out of luck. - built-in password managers only work for websites - I store many non-website security credentials in my password manager - extra details - I often add the security questions for a site into…
2, 3, 4 are handled by Chrome, for example. These really are trivial features that any decent corpo can get right. 1 obviously isn't.
Earlier quoted context omitted.
I recently moved my passwords from an expired 1Password account to Bitwarden (right at the time they announced linux support actually, which was always the biggest thing I missed). Bitwarden has a FF extension and allows me to use it across mac/windows/linux.
I was looking at Bitwarden yesterday as I've been putting off moving over from LastPass and 1Password seemed weird with importing from it. Is Bitwarden decent enough? The fact that it has a cli, FF extension etc. on a free plan is pretty tempting.
I want account management protocols so I can rotate all my passwords automatically via my password manager. That would be awesome.
Passwords are a lost cause. This doesn't mean that you need to give up on using good practices, just don't go overboard trying to plug all the theoretical holes. It's not all or nothing, sometimes it's OK to be good enough. For everything important you oughta use 2FA anyway.
> Passwords are a lost cause. I never really understood this. Ed25519 keys use SHA-512 and are considered secure. They're still just long secrets, aren't they? What's to prevent me from using a similarly long, randomly generated secret as my password, using a different one for every site? Because that's what I'm doing with KeePass. Backing up the auth database/file and having enough redundancy in place, as well as ha…
> An attacker (or malicious insider) in control of the vendor’s network can change the code that is served to your browser, and that code can obviously access your passwords. This isn’t farfetched, altering the content of websites (i.e. defacement) is so common that it’s practically a sport.
Is this actually true? For Lastpass, I would assume the code run in the browser comes from the extension directly, and (for Chrome), the extension comes from the Chrome Web Store. There are some problems here, but in theory the system could be improved so that modifications to the extension in Google Web Store are very obvious, and an attacker couldn't just inject code into the extension and update it without someone noticing immediately.