91–100 of 342 posts
He's a brilliant researcher, but I think he's wrong on this one, and the blog post is an appeal to authority and ends with basically a 'I've already heard your counter arguments and you're wrong'.
He should show his work.
The blog suggest using Chrome's password manager. I used MacOS KeyChain as my primary store and Chrome's password manager for my secondary store for years and finally gave up because KeyChain didn't work with Chrome or sync with anything (unless maybe I used iCloud) and Chrome only synced with and worked with Chrome and too often it didn't save passwords properly. For all other browsers, apps, or uses, Chrome passwor…
That's not what the article said
Earlier quoted context omitted.
Is there one present in Android? My understanding is password managers on Android and iOS abuse a11y interfaces. (I'm not a mobile dev)
This used to be the case, but somewhere around Android 7 (might've been 8 or 9) added proper support for autofill services.
Earlier quoted context omitted.
Chrome's password manager has an export feature. Are you perhaps thinking of some other browser?
Currently, I use Chrome on my desktop, mobile Safari on my phone, Safari on my Macbook, and Firefox on another machine. I need to sync my passwords across them!
I haven't used the browsers built-in password manager for years, so I don't know what features they have, but I find it hard to believe that they can provide the same functionality as a dedicated password manager.
Some of the top features of dedicated password managers include:
* Generating random passwords/passphrases (this is pretty basic)
* Storing and generating two-factor authentication codes (TOTP)
* Filling out passwords into mobile apps as well as websites
* Storing security questions, back up codes, any other site specific data that needs to be secure
* Storing credit card information
* Platform agnostic syncing
* Sharing passwords with friends, co-workers, or family
* Weak password checking / HIBP integration
I'm sure that the browser password manager can do some of these things, but I doubt it can really do all of them.
I know its about browser integration, but take a look at the repository of Lockwise android app[1] that released the last version 6 months ago and Bitwarden app[2] with last release being 1 month ago (I tried to find the firefox browser version but its a mess to analyse the activity of it). I know firefox has a much larger team but I it doesnt necessarily mean that more competent devs taking are taking care of the browser password manager's security than 1Password for example - maybe this is true for Google Chrome but who knows about Firefox and Edge.
[1] https://github.com/mozilla-lockwise/lockwise-android [2] https://github.com/bitwarden/mobile
1. Password manager for PC / Laptop: KeePassXC. It's not built into your browser, it's a seperate application. It's totally open source, and trusted by many. It also supports two factor authentication, I use a passphrase and a key file. Supports TOTP. Has a ton of "premium" features, totally free. It's awesome.
2. Syncing application: Google Drive. Sync your KeePass database using Google Drive (or whatever other sync application you want). KeePassXC supports merging databases if there's ever a conflict, as rare as those are. This is secure, because the KeePass database file is encrypted, and Google Drive / Google will never see the unencrypted database.
3. Password manager for phone: KeePass2Android. Not sure what the options are for Apple, but I'm sure they exist. Allows you to open your KeePassXC database from Google Drive.
4. Browser support: KeePassXC-Browser. Allows you to autofill your username / password / TOTP from your KeePassXC application to Chrome / Firefox.
Totally free, secure, convenient, and syncs to all your devices. Also comes with excellent redundancy for your password database so you'll never lose it. I've been using this setup for years flawlessly.
> This problem is pervasive among online password managers, you can never be sure if you’re interacting with a website or your password manager. Isn't this true for any scenario, password manager or not? If a site has been compromised without you knowing and you enter your password from memory, paste, or a password manager, that password is at risk. Is the author saying that he is able to access ALL passwords in the…
Personally using a browser based password manager is too restrictive in that you need a browser to access passwords. I use passwords in a lot of places outside of browsers and often the interface I'm using has no browser capabilities. Understand using browser based password management if you only ever use passwords on the web. But I'm sure a lot of others, like me, need them outside of that context.