4 ms·
Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what
by pfg 10y ago
Just about any scenario I can think of where the attacker could get to "what you have", by which I assume you mean the unencrypted password database (i.e. what you have after you entered something you know, since the whole point of a password manager is to have one strong password that you need to remember, instead of tens or hundreds probably-not-so-strong individual passwords), would also be a game-over scenario if you keep all your passwords in your head, since the attacker could just run a keylogger and take the passwords as you type them during regular use instead of getting your unencrypted password database after you unlock it.
- pg_is_a_butt 10y agotime to start reading the posts, lady. the browser extension is exploited to reveal all passwords without requiring anyone to type in anything. you're all idiots.
- geofft 10y agoYes, exactly. I have never understood the prevalence of threat models of the form "if an attacker gets full, unrestricted access to my running session, they still won't be able to ..." or "if an attacker gets me to run code, they won't figure out ...". They make no sense, unless the attacker is stupid. To be fair, there are a lot of script kiddies in the world.