3 ms·

Browser integration is one of the major security gains of using a password manager. It takes passwords and makes them "unphishable", because the manager knows

Browser integration is one of the major security gains of using a password manager. It takes passwords and makes them "unphishable", because the manager knows what domain you're on. Of course it's also the largest attack surface. Personally, I think that tradeoff is worth it - assuming competent development.

dotancohen 10y ago
> assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.
- farjar 10y ago
  If assuming competent development is bad, as you claim, why would it be a better idea to use a closed source password manager like LastPass instead of an open source fork of KeepassX? If this program can accomplish everything that LastPass can accomplish, while also being open source, surely that's more trust worthy then a closed source implementation that you could not audit.
  - dotancohen 10y ago
    I'm not interested in the closed- or open- source aspects of the issue. I'm interested in allowing other browser extensions to access my passwords. The issue is whether or not passwords should be stored in a browser extension, not about access to the source code.
dotancohen 10y ago
> assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.
majkinetor 10y ago
It also protects from keylogers.
- pmoriarty 10y ago
  If you have a keylogger on your system, you're screwed. Anyway, it doesn't necessarily protect from keyloggers for a couple of reasons: 1 - The password to the password database will be recorded by the keylogger. The password database can then be copied by the intruder and then opened using the logged password. 2 - Any password you type in to the password management app can be logged by the keylogger, so browser integration does not help.
  - Ajedi32 10y ago
    1. KeePass has an option to allow entering the master password on a [secure desktop][1]. 2. You usually don't type passwords into the password management app, you generate them. But yes, generally it's best if you don't get your computer infected with malware in the first place. Obviously if your computer is compromised there'll always be some way for sufficiently advanced malware to steal your password database. [1]: http://keepass.info/help/kb/sec_desk.html http://keepass.info/help/kb/sec_desk.html
    - pmoriarty 10y ago
      1. That doesn't matter if the computer has a physical keylogger installed (for example, between the keyboard and the port the keyboard plugs in to, or inside the keyboard itself, etc). 2. Generating passwords would help protect them from keyloggers and is a reason to do so. But as far as I know no password manager prevents people from typing in passwords, and I'm sure a lot of people do for a variety of reasons (from importing old passwords or passwords generated on another device to creating memorable passwords or because the password generation mechanism of the password manager is inadequate in some way, etc).

dotancohen 10y ago

> assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.

farjar 10y ago
If assuming competent development is bad, as you claim, why would it be a better idea to use a closed source password manager like LastPass instead of an open source fork of KeepassX? If this program can accomplish everything that LastPass can accomplish, while also being open source, surely that's more trust worthy then a closed source implementation that you could not audit.
- dotancohen 10y ago
  I'm not interested in the closed- or open- source aspects of the issue. I'm interested in allowing other browser extensions to access my passwords. The issue is whether or not passwords should be stored in a browser extension, not about access to the source code.

dotancohen 10y ago

> assuming competent development ...of every other extension that you use. That is a very bad assumption to make. That said, I do use Lastpass myself and in fact have a premium membership.

majkinetor 10y ago

It also protects from keylogers.

pmoriarty 10y ago
If you have a keylogger on your system, you're screwed. Anyway, it doesn't necessarily protect from keyloggers for a couple of reasons: 1 - The password to the password database will be recorded by the keylogger. The password database can then be copied by the intruder and then opened using the logged password. 2 - Any password you type in to the password management app can be logged by the keylogger, so browser integration does not help.
- Ajedi32 10y ago
  1. KeePass has an option to allow entering the master password on a [secure desktop][1]. 2. You usually don't type passwords into the password management app, you generate them. But yes, generally it's best if you don't get your computer infected with malware in the first place. Obviously if your computer is compromised there'll always be some way for sufficiently advanced malware to steal your password database. [1]: http://keepass.info/help/kb/sec_desk.html http://keepass.info/help/kb/sec_desk.html
  - pmoriarty 10y ago
    1. That doesn't matter if the computer has a physical keylogger installed (for example, between the keyboard and the port the keyboard plugs in to, or inside the keyboard itself, etc). 2. Generating passwords would help protect them from keyloggers and is a reason to do so. But as far as I know no password manager prevents people from typing in passwords, and I'm sure a lot of people do for a variety of reasons (from importing old passwords or passwords generated on another device to creating memorable passwords or because the password generation mechanism of the password manager is inadequate in some way, etc).