34 ms·

This shows another benefit of always logging in using a password manager like 1Password. Even if I were fooled and tried to login on this phishing form by press

This shows another benefit of always logging in using a password manager like 1Password. Even if I were fooled and tried to login on this phishing form by pressing Cmd+|, 1Password wouldn't fill my password because the URL doesn't match... which would lead me to think something is definitely wrong. Also another win for Single-Site Browsers like Fluid and Prism. I wouldn't expect to see Gmail in my main browser window.

snprbob86 16y ago
I would have totally fallen for this attack. My mind is blown. My father has been raving about 1Password forever, but I use a unique password "algorithm" in my head which has served me well so far. Now I'm actually considering 1Password. Anyone else what to share their experience with it? Good idea? Bad idea? And for those, like me, who had not heard of Single-Site Browsers, here are some links: http://fluidapp.com/ http://fluidapp.com/ http://prism.mozillalabs.com/ http://prism.mozillalabs.com/
- Timothee 16y ago
  I use 1Password for pretty much everything and I love it. I have its database on Dropbox, so it's synced and can be used from different computers. I also have the iPhone app, so I can get my passwords anywhere if the need arises out and about. However, I'm at a point where I need to figure out a recovery plan, because, you see, my Dropbox password is in 1Password as well, and my email password too. So, I could imagine a scenario where something gets compromised and I have a hard time getting it back…
  - rubyrescue 16y ago
    highly recommend the dropbox + 1password combo. added bonus:my wife has access to my password file because of dropbox, so when i add a new password for some service she may need, it immediately and securely shows up on her mac.
    - Timothee 16y ago
      Does that mean that your wife only use 1Password for your passwords, or can 1Password manage multiple DBs at the same time? I don't think I've seen the latter, though I would love to see some way of sharing just a part of my DB with my wife. (she has a pretty weak master password, so one shared DB would not work well for me)
      - Groxx 16y ago
        I don't know of a way to handle multiple at the same time, but you can choose which one is loaded. It'd be worth requesting on their forums though, they're pretty responsive, and it might get rolled in some time. Though there's still no AppleScript support :\
      - cubicle67 16y ago
        1Password can handle multiple accounts for the same site, if that's what you're asking oh, and the 1Password/DropBox combination is brilliant
      - rubyrescue 16y ago
        not sure but she could never handle two different files - even remembering the ONE complicated password for the file is annoying to her. so she gets only my file...
  - Derferman 16y ago
    I currently have the same setup and absolutely love it.
  - altano 16y ago
    Why not use LastPass which has the syncing across devices built-in? I have been using LastPass for the past 6 months or so and I LOVE it.
    - Timothee 16y ago
      I had never heard of LastPass before but from their website, it seems very interesting: some extra features, some features lacking, but overall probably cheaper. (one 1Password license is worth about 3 years of LastPass) I would have to try it, but this looks good. Thanks for the tip!
    - vdm 16y ago
      1Password being Mac only and no cloud sync doesn't work for me. I've been using LastPass for the last week. It has Chrome extensions which on my personal Macs and work Windows machines. The Chrome extension UX is a bit too rough for me to recommend it to non-techies but I think the idea and execution is sound. Recommended. I don't use it for Gmail or banking passwords of course.
  - MikeCapone 16y ago
    > I use 1Password for pretty much everything and I love it. I have its database on Dropbox, so it's synced and can be used from different computers. Brilliant, I'm going to do that right now. Thank you!
  - snprbob86 16y ago
    OK -- 1Password&Dropbox -- Giving it a shot!
- Groxx 16y ago
  Similar to others, I've had an excellent experience with it. The Chrome plugin is a bit sub-par, but it's still in development, and does fill passwords reliably. Capturing doesn't always work, however - a guaranteed way to save a password is to use Safari / WebKit (never had a problem with the webkit nightlies) / Firefox, which all have more "full" plugin capabilities, and mature plugins. My personal favorite feature: the keychain-package is just a folder / bundle, and it contains a website... which is capable of decrypting your passwords, given your master password. Which means you can recover your passwords without the application, on any machine with a web browser. Including through the Dropbox web interface, without needing to download it locally. Go for it, they've made an excellent product.
  - TheBranca18 16y ago
    Unfortunately I've found that the passwordanywhere stuff doesn't work on Chrome on Linux anyway. Probably wishful thinking :)
    - Groxx 16y ago
      Yeah, I've been having problems with it offline too, not sure what to make of it. Launching it within Dropbox's website keeps working though, so I'm not really bothered. * shrug * 'tis strange.
- rufo 16y ago
  If you're on a Mac and use Gmail/Google Apps, I'd recommend Mailplane - it's essentially an SSB tuned precisely to Gmail, and providing some interesting OS integration features. It also handles multiple accounts relatively well. http://mailplaneapp.com/ http://mailplaneapp.com/
  - vdm 16y ago
    SSB?
    - rufo 16y ago
      Single-site browser - sorry, I thought the term was defined in my parent.
Pistos2 16y ago
This is part of the reason I use browser password managers. I'm brazen in activating Opera's password manager, because of this "feature".
Natsu 16y ago
I've never used a single-site browser, but I generally do make sure that my email is the only thing open when I'm visiting it (and clear private data to avoid anything weird in the cache beforehand). Between that and noscript (and enough savvy to spot even slightly-wrong websites), I haven't had any problems. I don't think this attack would work on me because I've long kept email segregated from normal web browsing due to other attacks, which rely on you clicking malicious links while logged into the site they want to get your information from. So I would, if anything, just think I'd clicked on the wrong shortcut and close out of it rather than logging in. Score one for paranoia? I've never been infected by spyware/viruses/etc.

snprbob86 16y ago

I would have totally fallen for this attack. My mind is blown. My father has been raving about 1Password forever, but I use a unique password "algorithm" in my head which has served me well so far. Now I'm actually considering 1Password. Anyone else what to share their experience with it? Good idea? Bad idea? And for those, like me, who had not heard of Single-Site Browsers, here are some links: http://fluidapp.com/ http://fluidapp.com/ http://prism.mozillalabs.com/ http://prism.mozillalabs.com/

Timothee 16y ago
I use 1Password for pretty much everything and I love it. I have its database on Dropbox, so it's synced and can be used from different computers. I also have the iPhone app, so I can get my passwords anywhere if the need arises out and about. However, I'm at a point where I need to figure out a recovery plan, because, you see, my Dropbox password is in 1Password as well, and my email password too. So, I could imagine a scenario where something gets compromised and I have a hard time getting it back…
- rubyrescue 16y ago
  highly recommend the dropbox + 1password combo. added bonus:my wife has access to my password file because of dropbox, so when i add a new password for some service she may need, it immediately and securely shows up on her mac.
  - Timothee 16y ago
    Does that mean that your wife only use 1Password for your passwords, or can 1Password manage multiple DBs at the same time? I don't think I've seen the latter, though I would love to see some way of sharing just a part of my DB with my wife. (she has a pretty weak master password, so one shared DB would not work well for me)
    - Groxx 16y ago
      I don't know of a way to handle multiple at the same time, but you can choose which one is loaded. It'd be worth requesting on their forums though, they're pretty responsive, and it might get rolled in some time. Though there's still no AppleScript support :\
    - cubicle67 16y ago
      1Password can handle multiple accounts for the same site, if that's what you're asking oh, and the 1Password/DropBox combination is brilliant
    - rubyrescue 16y ago
      not sure but she could never handle two different files - even remembering the ONE complicated password for the file is annoying to her. so she gets only my file...
- Derferman 16y ago
  I currently have the same setup and absolutely love it.
- altano 16y ago
  Why not use LastPass which has the syncing across devices built-in? I have been using LastPass for the past 6 months or so and I LOVE it.
  - Timothee 16y ago
    I had never heard of LastPass before but from their website, it seems very interesting: some extra features, some features lacking, but overall probably cheaper. (one 1Password license is worth about 3 years of LastPass) I would have to try it, but this looks good. Thanks for the tip!
  - vdm 16y ago
    1Password being Mac only and no cloud sync doesn't work for me. I've been using LastPass for the last week. It has Chrome extensions which on my personal Macs and work Windows machines. The Chrome extension UX is a bit too rough for me to recommend it to non-techies but I think the idea and execution is sound. Recommended. I don't use it for Gmail or banking passwords of course.
- MikeCapone 16y ago
  > I use 1Password for pretty much everything and I love it. I have its database on Dropbox, so it's synced and can be used from different computers. Brilliant, I'm going to do that right now. Thank you!
- snprbob86 16y ago
  OK -- 1Password&Dropbox -- Giving it a shot!
Groxx 16y ago
Similar to others, I've had an excellent experience with it. The Chrome plugin is a bit sub-par, but it's still in development, and does fill passwords reliably. Capturing doesn't always work, however - a guaranteed way to save a password is to use Safari / WebKit (never had a problem with the webkit nightlies) / Firefox, which all have more "full" plugin capabilities, and mature plugins. My personal favorite feature: the keychain-package is just a folder / bundle, and it contains a website... which is capable of decrypting your passwords, given your master password. Which means you can recover your passwords without the application, on any machine with a web browser. Including through the Dropbox web interface, without needing to download it locally. Go for it, they've made an excellent product.
- TheBranca18 16y ago
  Unfortunately I've found that the passwordanywhere stuff doesn't work on Chrome on Linux anyway. Probably wishful thinking :)
  - Groxx 16y ago
    Yeah, I've been having problems with it offline too, not sure what to make of it. Launching it within Dropbox's website keeps working though, so I'm not really bothered. * shrug * 'tis strange.
rufo 16y ago
If you're on a Mac and use Gmail/Google Apps, I'd recommend Mailplane - it's essentially an SSB tuned precisely to Gmail, and providing some interesting OS integration features. It also handles multiple accounts relatively well. http://mailplaneapp.com/ http://mailplaneapp.com/
- vdm 16y ago
  SSB?
  - rufo 16y ago
    Single-site browser - sorry, I thought the term was defined in my parent.

Pistos2 16y ago

This is part of the reason I use browser password managers. I'm brazen in activating Opera's password manager, because of this "feature".

Natsu 16y ago

I've never used a single-site browser, but I generally do make sure that my email is the only thing open when I'm visiting it (and clear private data to avoid anything weird in the cache beforehand). Between that and noscript (and enough savvy to spot even slightly-wrong websites), I haven't had any problems. I don't think this attack would work on me because I've long kept email segregated from normal web browsing due to other attacks, which rely on you clicking malicious links while logged into the site they want to get your information from. So I would, if anything, just think I'd clicked on the wrong shortcut and close out of it rather than logging in. Score one for paranoia? I've never been infected by spyware/viruses/etc.